Edit tour

Windows Analysis Report
https://hallmark.greetingsweb.com/2865d1125997389a?l=22

Overview

General Information

Sample URL:	https://hallmark.greetingsweb.com/2865d1125997389a?l=22
Analysis ID:	1585542
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious URL

Connects to many ports of the same IP (likely port scanning)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2212,i,9266091377051850730,3308463755355501370,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hallmark.greetingsweb.com/2865d1125997389a?l=22" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /secure/browser_post HTTP/1.1Host: hallmark.greetingsweb.comConnection: keep-aliveContent-Length: 1902sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*Content-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://hallmark.greetingsweb.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 19:03:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 2511Connection: closeVary: Accept-EncodingX-Request-Id: 78173096-1c4d-401b-82da-30c77a8cb4f3X-Runtime: 0.000859X-Host-Info: lw-prod-us-i-0836334fc2fbeda37X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ceServer: ThreatSim-Web-Server

Source: chromecache_142.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
Source: chromecache_142.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble1.gif)
Source: chromecache_142.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble2.gif)
Source: chromecache_142.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble3.gif)
Source: chromecache_142.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/fish.gif)
Source: chromecache_135.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png);
Source: chromecache_135.2.dr	String found in binary or memory: https://d25q7gseii1o1q.cloudfront.net/training/fish/pixel.gif);
Source: chromecache_142.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_109.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_134.2.dr, chromecache_116.2.dr, chromecache_128.2.dr, chromecache_101.2.dr	String found in binary or memory: https://github.com/mikesherov/jquery-idletimer
Source: chromecache_133.2.dr	String found in binary or memory: https://hallmark.greetingsweb.com
Source: chromecache_133.2.dr	String found in binary or memory: https://hallmark.greetingsweb.com:49153/alt_pixel_click_65d1199738.gif?correlation_id=e6dcdb89-a2c9-
Source: chromecache_142.2.dr	String found in binary or memory: https://ie7-js.googlecode.com/svn/version/2.1(beta4)/IE9.js
Source: chromecache_120.2.dr	String found in binary or memory: https://ts-uploads.s3.amazonaws.com/training/production/13913/clights-c61e57.png
Source: chromecache_142.2.dr, chromecache_150.2.dr, chromecache_143.2.dr	String found in binary or memory: https://tscontent.s3.amazonaws.com/
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d
Source: chromecache_134.2.dr, chromecache_116.2.dr, chromecache_128.2.dr, chromecache_101.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/getJavaInfo.jar?guid=
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-4
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e
Source: chromecache_142.2.dr, chromecache_133.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/detect/wmp.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c
Source: chromecache_142.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/languages/language.18071.js
Source: chromecache_142.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/training/embedded/css/url.css
Source: chromecache_143.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/training/embedded/default.png
Source: chromecache_120.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/training/production/314/hallmark-2102f5.png
Source: chromecache_120.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/training/production/314/hallmarkfooterlogo-d4ab56.png
Source: chromecache_142.2.dr	String found in binary or memory: https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css
Source: chromecache_122.2.dr, chromecache_117.2.dr	String found in binary or memory: https://www.proofpoint.com/us/legal/privacy-policy
Source: chromecache_142.2.dr	String found in binary or memory: https://www.wombatsecurity.com/privacy-policy

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: classification engine

Classification label: mal48.troj.win@16/87@26/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2212,i,9266091377051850730,3308463755355501370,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hallmark.greetingsweb.com/2865d1125997389a?l=22"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2212,i,9266091377051850730,3308463755355501370,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://hallmark.greetingsweb.com/2865d1125997389a?l=22	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.9.1/jquery.min.js	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/pixel.gif);	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/fish.gif)	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20pinlady&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=undefined&msg=window.tracking_id%20is%20not%20set%2C%20let%27s%20get%20it&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=Loading%20embedded%20html	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com	0%	Avira URL Cloud	safe
https://www.wombatsecurity.com/privacy-policy	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/assets/all.js?g=65d1199738	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com:49153/alt_pixel_click_65d1199738.gif?correlation_id=e6dcdb89-a2c9-	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20WindowsMediaPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=embeddedhtmlemail%20id%20exists%20with%20environment%20%3D%20production	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20quicktime%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble1.gif)	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://ie7-js.googlecode.com/svn/version/2.1(beta4)/IE9.js	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble2.gif)	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/assets/all.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble3.gif)	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Could%20not%20find%20AdobeReader%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version_pl%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png);	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=quicktime%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/secure/browser_post	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=silverlight%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20deployJava&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/favicon.ico	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version%20%3D%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=unknown&msg=get-id%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20flash%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=unknown&msg=did%20not%20find%20guid%20in%20last%20part%20of%20location&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=wmp%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=pdf%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://tscontent.s3.amazonaws.com/	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=training_page_no_browser_post&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20RealPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20pdf%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=logo_object%20does%20not%20exist	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=flash%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/training_screenshot?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=redirect_url%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version_jres%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Silverlight%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	3.5.25.233	true	false	high
java.com	2.23.227.218	true	false	high
www.google.com	142.250.184.196	true	false	high
d25q7gseii1o1q.cloudfront.net	18.245.62.126	true	false	unknown
prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com	54.175.8.220	true	false	high
tslp.s3.amazonaws.com	unknown	unknown	false	high
_49153._https.hallmark.greetingsweb.com	unknown	unknown	false	unknown
ts-uploads.s3.amazonaws.com	unknown	unknown	false	high
www.java.com	unknown	unknown	false	high
hallmark.greetingsweb.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tslp.s3.amazonaws.com/detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20pinlady&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.9.1/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=undefined&msg=window.tracking_id%20is%20not%20set%2C%20let%27s%20get%20it&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		unknown
https://tslp.s3.amazonaws.com/detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=Loading%20embedded%20html	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/assets/all.js?g=65d1199738	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20WindowsMediaPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=embeddedhtmlemail%20id%20exists%20with%20environment%20%3D%20production	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20quicktime%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/training/embedded/translations/url/en-us.json	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://tslp.s3.amazonaws.com/training/production/314/hooks-a3eab7.png	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/2865d1125997389a?l=22	false		unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/assets/all.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/assets/js/training.js	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version_pl%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/secure/browser_post	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Could%20not%20find%20AdobeReader%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=quicktime%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=silverlight%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20flash%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/training/production/314/hallmarkfooterlogo-d4ab56.png	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20deployJava&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version%20%3D%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=unknown&msg=get-id%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/training/production/314/hallmark-2102f5.png	false		high
https://hallmark.greetingsweb.com/trace?id=unknown&msg=did%20not%20find%20guid%20in%20last%20part%20of%20location&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=wmp%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://ts-uploads.s3.amazonaws.com/training/production/13913/clights-c61e57.png	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=pdf%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=training_page_no_browser_post&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20RealPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20pdf%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=java_version_jres%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/log?id=65d1199738&campaign_guid=3476ad5eaa&msg=logo_object%20does%20not%20exist	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=flash%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=65d1199738&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=redirect_url%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/languages/language.18071.js	false		high
https://hallmark.greetingsweb.com/training_screenshot?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com/trace?id=7d65d118199738ee&msg=Loading%20Silverlight%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/wmp.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://d25q7gseii1o1q.cloudfront.net/training/fish/pixel.gif);	chromecache_135.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://d25q7gseii1o1q.cloudfront.net/training/fish/fish.gif)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://tslp.s3.amazonaws.com/detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://hallmark.greetingsweb.com	chromecache_133.2.dr	true	Avira URL Cloud: safe	unknown
https://hallmark.greetingsweb.com:49153/alt_pixel_click_65d1199738.gif?correlation_id=e6dcdb89-a2c9-	chromecache_133.2.dr	false	Avira URL Cloud: safe	unknown
https://www.wombatsecurity.com/privacy-policy	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://github.com/mikesherov/jquery-idletimer	chromecache_134.2.dr, chromecache_116.2.dr, chromecache_128.2.dr, chromecache_101.2.dr	false		high
https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css	chromecache_142.2.dr	false		high
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble1.gif)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/training/embedded/default.png	chromecache_143.2.dr	false		high
https://ie7-js.googlecode.com/svn/version/2.1(beta4)/IE9.js	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble2.gif)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png);	chromecache_135.2.dr	false	Avira URL Cloud: safe	unknown
https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble3.gif)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://www.proofpoint.com/us/legal/privacy-policy	chromecache_122.2.dr, chromecache_117.2.dr	false		high
https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-4	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://tslp.s3.amazonaws.com/detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://tscontent.s3.amazonaws.com/	chromecache_142.2.dr, chromecache_150.2.dr, chromecache_143.2.dr	false	Avira URL Cloud: safe	unknown
https://tslp.s3.amazonaws.com/detect/getJavaInfo.jar?guid=	chromecache_134.2.dr, chromecache_116.2.dr, chromecache_128.2.dr, chromecache_101.2.dr	false		high
https://tslp.s3.amazonaws.com/detect/wmp.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c	chromecache_142.2.dr, chromecache_133.2.dr	false		high
https://tslp.s3.amazonaws.com/training/embedded/css/url.css	chromecache_142.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
18.245.62.126	d25q7gseii1o1q.cloudfront.net	United States	16509	AMAZON-02US	false
18.245.62.137	unknown	United States	16509	AMAZON-02US	false
3.5.25.233	s3-w.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
16.15.178.1	unknown	United States	unknown	unknown	false
3.5.28.76	unknown	United States	14618	AMAZON-AESUS	false
16.182.32.137	unknown	United States	unknown	unknown	false
54.80.6.128	unknown	United States	14618	AMAZON-AESUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.175.8.220	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585542
Start date and time:	2025-01-07 20:01:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://hallmark.greetingsweb.com/2865d1125997389a?l=22
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.troj.win@16/87@26/11

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 142.250.186.142, 64.233.166.84, 142.250.185.78, 142.250.185.174, 142.250.186.110, 2.23.227.218, 2.23.227.198, 199.232.210.172, 192.229.221.95, 142.250.186.174, 142.250.185.142, 142.250.185.238, 142.250.185.138, 142.250.185.170, 172.217.18.3, 142.250.186.163, 142.250.181.238, 23.56.254.164, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ajax.googleapis.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, e91569.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, ds-www.java.com.edgekey.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://hallmark.greetingsweb.com/2865d1125997389a?l=22

Input	Output
URL: https://hallmark.greetingsweb.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://hallmark.greetingsweb.com
URL: https://hallmark.greetingsweb.com/assets/ajax/libs... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library v1.9.1, which is a widely used and trusted JavaScript library. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is well-structured and follows common patterns for a JavaScript library. Overall, this script is considered low risk." }
/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license //@ sourceMappingURL=jquery.min.map /(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H))};b.fn=b.prototype={jquery:p,constructor:b,init:function(e,n,r){var i,a;if(!e)return this;if("string"==typeof e){if(i="<"===e.charAt(0)&&">"===e.charAt(e.length-1)&&e.length>=3?[null,e,null]:N.exec(e),!i\|\|!i[1]&&n)return!n\|\|n.jquery?(n\|\|r).find(e):this.constructor(n).find(e);if(i[1]){if(n=n instanceof b?n[0]:n,b.merge(this,b.parseHTML(i[1],n&&n.nodeType?n.ownerDocument\|\|n:o,!0)),C.test(i[1])&&b.isPlainObject(n))for(i in n)b.isFunction(this[i])?this[i](n[i]):this.attr(i,n[i]);return this}if(a=o.getElementById(i[2]),a&&a.parentNode){if(a.id!==i[2])return r.find(e);this.length=1,this[0]=a}return this.context=o,this.selector=e,this}return e.nodeType?(this.context=this[0]=e,this.length=1,this):b.isFunction(e)?r.ready(e):(e.selector!==t&&(this.selector=e.selector,this.context=e.context),b.makeArray(e,this))},selector:"",length:0,size:function(){return this.length},toArray:function(){return h.call(this)},get:function(e){return null==e?this.toArray():0>e?this[this.length+e]:this[e]},pushStack:function(e){var t=b.merge(this.constructor(),e);return t.prevObject=this,t.context=this.context,t},each:function(e,t){return b.each(this,e,t)},ready:function(e){return b.ready.promise().done(e),this},slice:function(){return this.pushStack(h.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(0>e?t:0);return this.pushStack(n>=0&&t>n?[this[n]]:[])},map:function(e){return this.pushStack(b.map(this,function(t,n){return e.call(t,n,t)}))},end:function(){return this.prevObject\|\|this.constructor(null)},push:d,sort:[].sort,splice:[].splice},b.fn.init.prototype=b.fn,b.extend=b.fn.extend=function(){var e,n,r,i,o,a,s=arguments[0]\|\|{},u=1,l=arguments.length,c=!1;for("boolean"==typeof s&&(c=s,s=arguments[1]\|\|{},u=2),"object"==typeof s\|\|b.isFunction(s)\|\|(s={}),l===u&&(s=this,--u);l>u;u++)if(null!=(o=arguments[u]))for(i in o)e=s[i],r=o[i],s!==r&&(c&&r&&(b.isPlainObject(r)\|\|(n=b.isArray(r)))?(n?(n=!1,a=e&&b.isArray(e)?e:[]):a=e&&b.isPlainObject(e)?e:{},s[i]=b.extend(c,a,r)):r!==t&&(s[i]=r));return s},b.extend({noConflict:function(t){return e.$===b&&(e.$=u),t&&e.jQuery===b&&(e.jQuery=s),b},isReady:!1,readyWait:1,holdReady:function(e){e?b.readyWait++:b.ready(!0)},ready:function(e){if(e===!0?!--b.readyWait:!b.isReady){if(!o.body)return setTimeout(b.ready);b.isReady=!0,e!==!0&&--b.readyWait>0\|\|(n.resolveWith(o,[b]),b.fn.trigger&&b(o).trigger("ready").off("ready"))}},isFunction:function(e){return"function"===b.type(e)},isArray:Array.isArray\|\|function(e){return"array"===b.type(e)},isWindow:function(e){return null!=e&&e==e.window},isNumeric:function(e){return!isNaN(parseFloat(e))&&isFinite(e)},type:function(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[m.call(e)]\|\|"object":typeof e},isPlainObject:function(e){if(!e\|\|"object"!==b.type(e)\|\|e.nodeType\|\|b.isWindow(e))return!1;try{if(e.constructor&&!y.call(e,"constructor")&&!y.call(e.constructor.prototype,"isPrototypeOf"))return!1}catch(n){return!
URL: https://hallmark.greetingsweb.com/assets/ajax/libs... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the jQuery library, which is a widely used and trusted JavaScript library. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is well-structured and follows common JavaScript patterns, indicating it is likely a legitimate library. While it uses some legacy practices like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is considered low risk." }
/! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license / !function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject\|\|this.constructor(null)},push:f,sort:c.sort,splice:c.splice},n.extend=n.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]\|\|{},h++),"object"==typeof g\|\|n.isFunction(g)\|\|(g={}),h===i&&(g=this,h--);i>h;h++)if(null!=(e=arguments[h]))for(d in e)a=g[d],c=e[d],g!==c&&(j&&c&&(n.isPlainObject(c)\|\|(b=n.isArray(c)))?(b?(b=!1,f=a&&n.isArray(a)?a:[]):f=a&&n.isPlainObject(a)?a:{},g[d]=n.extend(j,f,c)):void 0!==c&&(g[d]=c));return g},n.extend({expando:"jQuery"+(m+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===n.type(a)},isArray:Array.isArray\|\|function(a){return"array"===n.type(a)},isWindow:function(a){return null!=a&&a==a.window},isNumeric:function(a){return a-parseFloat(a)>=0},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},isPlainObject:function(a){var b;if(!a\|\|"object"!==n.type(a)\|\|a.nodeType\|\|n.isWindow(a))return!1;try{if(a.constructor&&!j.call(a,"constructor")&&!j.call(a.constructor.prototype,"isPrototypeOf"))return!1}catch(c){return!1}if(l.ownLast)for(b in a)return j.call(a,b);for(b in a);return void 0===b\|\|j.call(a,b)},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typeof a?h[i.call(a)]\|\|"object":typeof a},globalEval:function(b){b&&n.trim(b)&&(a.execScript\|\|function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(p,"ms-").replace(q,r)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b,c){var d,e=0,f=a.length,g=s(a);if(c){if(g){for(;f>e;e++)if(d=b.apply(a[e],c),d===!1)break}else for(e in a)if(d=b.apply(a[e],c),d===!1)break}else if(g){for(;f>e;e++)if(d=b.call(a[e],e,a[e]),d===!1)break}else for(e in a)if(d=b.call(a[e],e,a[e]),d===!1)break;return a},trim:k&&!k.call("\ufeff\xa0")?function(a){return null==a?"":k.call(a)}:function(a){return null==a?"":(a+"").replace(o,"")},makeArray:function(a,b){var c=b\|\|[];return null!=a&&(s(Object(a))?n.merge(c,"string"==typeof a?[a]:a):f.call(c,a)),c},inArray:function(a,b,c){var d;if(b){if(g)return g.call(b,a,c);for(d=b.length,c=c?0>c?Math.max(0,d+c):c:0;d>c;c++)if(c in b&&b[c]===a)return c}return-1},merge:function(a,b){var c=+b.length,d=0,e=a.length;while(c>d)a[e++]=b[d++];if(c!==c)while(void 0!==b[d])a[e++]=b[d++];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;g>f;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,f=0,g=a.length,h=s(a),i=[];if(h)for(;g>f;f++)d=b(a[f],f,c),null!=d&&i.push(d);else for(f in a)d=b(a[f],f,c),null!=d&&i.push(d);return e.apply([],i)},guid:1,proxy:function(a,b){var c,e,f;return
URL: https://hallmark.greetingsweb.com/2865d1125997389a... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script contains some moderate-risk indicators, such as external data transmission to the 'hallmark.greetingsweb.com' domain and the use of a fallback domain in case the primary URL fails. However, the script does not appear to have any high-risk indicators like dynamic code execution or data exfiltration. The overall behavior seems to be related to analytics or tracking functionality, which is a common practice. With the contextual adjustments, the final risk score is in the medium range, indicating the need for further review but no clear signs of malicious intent." }
window.plugin_detector = PluginDetect; window.console_debug = false; window.guid = "65d1199738"; window.test_mode = false; window.tracking_id = "65d1199738"; window.correlation_id = "e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"; window.redirect_url = "/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"; try { window.base_post_url = ((window.location.protocol === "https:") ? "https" : "http") + "://hallmark.greetingsweb.com"; } catch (i) { window.base_post_url = "https://hallmark.greetingsweb.com"; }
URL: https://hallmark.greetingsweb.com/assets/all.js?g=... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a logging and error reporting utility, which is a common practice for web applications. While it sends data to external domains, the behavior is consistent with typical analytics and telemetry functionality. The script does not exhibit any high-risk indicators like dynamic code execution or data exfiltration. Some moderate-risk indicators, such as external data transmission and the use of legacy APIs, are present, but the overall risk is low due to the legitimate context of the script." }
(function() { window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) { window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id; }, window.log_to_console = function() { void 0 !== window.console_debug && console.log; }, window.log_message = function(e) { window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id; }; }).call(this), window.log_message \|\| (window.log_message = function(e) { new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e); }); var BrowserDetect = { init: function() { this.browser = this.searchString(this.dataBrowser) \|\| "unknown", this.browserString = this.browser.toString().replace(/;/g, "%3B"), this.version = this.searchVersion(window.navigator.userAgent) \|\| this.searchVersion(navigator.appVersion) \|\| "unknown", this.versionString = this.version.toString().replace(/;/g, "%3B"), this.OS = this.searchString(this.dataOS) \|\| "unknown", this.OSString = this.OS.replace(/;/g, "%3B"), this.osVersionString = this.osVersion().toString(), this.isAndroid() && (this.OS = "Android"), this.isBlackberry() && (this.OS = "BlackBerry"); }, _hasLocalStorage: null, hasLocalStorage: function() { if (null !== this._hasLocalStorage) return window.log_message("BrowserDetect - CACHE: localStorage = " + this._hasLocalStorage), this._hasLocalStorage; try { var e = new Date(); window.localStorage.setItem(e, e), window.localStorage.getItem(e), window.localStorage.removeItem(e), this._hasLocalStorage = !0; } catch (i) { this._hasLocalStorage = !1; } return window.log_message("BrowserDetect - localStorage = " + this._hasLocalStorage), this._hasLocalStorage; }, _hasSessionStorage: null, hasSessionStorage: function() { if (null !== this._hasSessionStorage) return window.log_message("BrowserDetect - CACHE: sessionStorage = " + this._hasSessionStorage), this._hasSessionStorage; try { sessionStorage.setItem("ac_browser_detect", "test"), this._hasSessionStorage = !0, sessionStorage.removeItem("ac_browser_detect", "test"); } catch (e) { this._hasSessionStorage = !1; } return window.log_message("BrowserDetect - sessionStorage = " + this._hasSessionStorage), this._hasSessionStorage; }, _hasCookies: null, hasCookies: function() { if (null !== this._hasCookies) return window.log_message("BrowserDetect - CACHE: hasCookies = " + this._hasCookies), this._hasCookies; try { this._hasCookies = !("undefined" == typeof document.cookie \|\| !navigator.cookieEnabled); } catch (e) { this._hasCookies = !1; } return window.log_message("BrowserDetect - hasCookies = " + this._hasCookies), this._hasCookies; }, getAgent: function() { return navigator.userAgent.toLowerCase(); }, isWebKit: function(e) { if (this._isWebKit === undefined) { var i = e \|\| this.getAgent(); this._isWebKit = !!i.match(/AppleWebKit/i), this.isWebKit = function() { return this._isWebKit; }; } return this._isWebKit; }, isiPad: function(e) { var i = e \|\| this.getAgent(); return !(!this.isWebKit(i) \|\| !i.match(/ipad/i)); }, isAndroid: function(e) { var i = e \|\| this.getAgent(); return !(!this.isWebKit(i) \|\| !i.match(/android/i)); }, isBlackberry: function(e) { return !!(e \|\| this.getAgent()).match(/blackberry\|rim tablet/i); }, isMobile: function(e) { var i = e \|\| this.getAgent(), n = null !== i.match(/Mobile/i) \|\| this.isiPad(i) \|\| this.isAndroid(i); return null !== n && n; }, isMac: function(e) { return !!(e \|\| this.getAgent()).match(/macintosh/i); }, macOSVersion: function(e) { var i = e \|\| this.getAgent(), n = i.match(/(mac os x )([\d\._]*)/i), t = 0; if (!this.isMac(i)) return ""; if (null === n) return ""; for (n = n[2].match(/\./) ? n[2].split(".") : n[2].split("_"), t
URL: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "OOPS! You fell for a phish!", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Model: Joe Sandbox AI	{ "brands": "unknown" }

URL: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Model: Joe Sandbox AI	{ "brands": [ "Hallmark" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 18:02:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9812270464588475
Encrypted:	false
SSDEEP:	48:8rdWTSClHTidAKZdA19ehwiZUklqehyy+3:8QDvdy
MD5:	FD09D11812E2FD5CB1D94FAA5FF42A02
SHA1:	EA60581BE1535FC1DE89A31CFACF63332E88D836
SHA-256:	C22B74FDE0A83FF8AB04D76AAE0F8E2EEDF29CE96A33B2589E356A12852B2A04
SHA-512:	0120F17F1DD6E5B99DB726688AEFFB28FFBC4D487A486A0F72D13ADDF73DA226BF30DFBE98C93562160B6005B4A6902ADE19AEDC60B886977E072B1CD9F8F0AF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......^.6a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 18:02:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994006474455281
Encrypted:	false
SSDEEP:	48:87dWTSClHTidAKZdA1weh/iZUkAQkqehNy+2:8ADV9Qoy
MD5:	0946EA12CCD645F6969FA237F9338B98
SHA1:	27F12B88A969B022E8AF27A66DD5184C826B80A8
SHA-256:	58D70193355D86BE7BABC276BE7D4D5D5E1823031505B25E59C741F75BCFA1E7
SHA-512:	31387423A34F3AF39BAF728058B84A1500A68F7E809C0DEE12815DD6A8FA971F5DD58BE456933D3E750FB1730EE90E69E2B5FCD0FE08C1C86D13B25C91EA0912
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....m.R.6a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010883140652874
Encrypted:	false
SSDEEP:	48:8xLdWTSCsHTidAKZdA14tseh7sFiZUkmgqeh7sDy+BX:8xwDen5y
MD5:	3E4DF66F126392CC4234D41ED1447F49
SHA1:	E85F89ADA4BB9B58EA81F65CD83A156E3FE05708
SHA-256:	78A4563A86723EDC3CEDCA52A6C15097D6447D7132802085A8BA83549B9E5390
SHA-512:	B20EB4110FCAF1CC2518BAF95A769901EF4223E8E2F6AC5FD6991EED66223E9A09E158DCC28364571FD278B8AE47F4778D575EE3983E4A6F45769B8D6E17EE5D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 18:02:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995613452290633
Encrypted:	false
SSDEEP:	48:8X5dWTSClHTidAKZdA1vehDiZUkwqehBy+R:8iD2Ly
MD5:	01ACF4E12961871BE1A6CF94D29DB080
SHA1:	4AB814E97694E8F70CC4E025152053EFB57E444B
SHA-256:	CF5ADBE176028EFCDAA3970D38B2F5439AF18463615C4F5DFC49E25BC5792BBD
SHA-512:	060A8B4C2AA39D211A4E460EC811F84C109403DFDCCBE394EF792C1910AAF559AA3DB0C7695E31F2F8D7267A4178802E73BD3D96FAE8AFE223D511C4741FC673
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......K.6a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 18:02:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982337274866252
Encrypted:	false
SSDEEP:	48:8udWTSClHTidAKZdA1hehBiZUk1W1qeh/y+C:8XDW9fy
MD5:	A0DE082424CF196330738E98FB8DA2C1
SHA1:	EC663DEA2B78BB5F74586D4816CC80D6BE586BEE
SHA-256:	EE1F011648421C25FCCA69C8655E5C23BECAA4F119C1593C35744AAAC0A6693C
SHA-512:	7D23DC8AC3338D2B7E022F6E6A392A91B1D882D0AA524DD06BB14A914088E18BA6ECD8695238CD705979DBC5020C6E0E9AF949ACFA750CC0ED8F50E5F30DB381
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....i.Z.6a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 18:02:48 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9935205645758445
Encrypted:	false
SSDEEP:	48:8ydWTSClHTidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb5y+yT+:87DoT/TbxWOvTb5y7T
MD5:	044FB603F3276AFD6B72DB5ED0751658
SHA1:	5124214B8C756F17E454AF7129F8A9BD84B9EFE2
SHA-256:	97C9058684672F6B4B146932E4E2AB993E2D8859CC7F389913F48B61169D2480
SHA-512:	42807E4294C0BE9FCF7772751EADAEC4EA5031372FB6DD142ABF34B5803A669F0B8F7A3959C3C6B9FFB5593CCB52CBC88EB29FF77A919C702BDBC30A373A6371
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....j.D.6a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I'ZV.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZV.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZV.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZV............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (18444), with no line terminators
Category:	downloaded
Size (bytes):	18444
Entropy (8bit):	5.456975703611994
Encrypted:	false
SSDEEP:	384:nP+BlKMkep6FzS/S5yAiCAf0AHXIs1RJl:nPAeyAbA3P1t
MD5:	9C1AE8D324E45716080572DFC20993A3
SHA1:	0AFDD5636017B31750DD4E1A41CED118AAA5D3AB
SHA-256:	358BB442F5D81DDC8E393D922458A9D84010EFEE2C346763AE87A45BE92224D1
SHA-512:	79423F106203776CA07DC3ED730AF0B40F839C10B3C980BC9E8AD60D7FEF85A6FD411B661D01CA14272728C21075DA297A2673F288F8485FB47BAFDBC1713316
Malicious:	false
Reputation:	low
URL:	https://www.java.com/js/deployJava.js
Preview:	var version_regex_base="^(\\d+)(?:\\.(\\d+)(?:\\.(\\d+)(?:[_\\.](\\d+))?)?)?";var version_regex_strict=version_regex_base+"$";var version_regex_with_family_modifier=version_regex_base+"(\\*\|\\+)?$";var deployJava=function(){var l={core:["id","class","title","style"],i18n:["lang","dir"],events:["onclick","ondblclick","onmousedown","onmouseup","onmouseover","onmousemove","onmouseout","onkeypress","onkeydown","onkeyup"],applet:["codebase","code","name","archive","object","width","height","alt","align","hspace","vspace"],object:["classid","codebase","codetype","data","type","archive","declare","standby","height","width","usemap","name","tabindex","align","border","hspace","vspace"]};var v=l.object.concat(l.core,l.i18n,l.events);var j=l.applet.concat(l.core);if(typeof String.prototype.startsWith!=="function"){String.prototype.startsWith=function(x,w){w=w\|\|0;return this.indexOf(x,w)===w}}function k(w){if(!i.debug){return}if(console.log){console.log(w)}else{alert(w)}}function h(){var y='Java

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	28356
Entropy (8bit):	5.215232550543418
Encrypted:	false
SSDEEP:	384:Ldz9MmIbpuTuAs7KoUSvm9m/QUYcBw6xwQPfWjU82bleXg7Gv:LrMlIT2KZ8Q4Bw6xwQPfWjUN5ew6v
MD5:	A6B682FEC1E95D9A565627499E1B0FD2
SHA1:	9D9B94C97C01446AE496006BEAFA2B3A05AB7C6A
SHA-256:	940DA9FCC9AEF9C6F5EC3E47002962DC008A6B70D9A012F5D22AF8C53DA29210
SHA-512:	0AB6339098AF3CFA0D1F500D93FD2773472415DDAE8E33C0819A44DB3CFD46F10B20FEA1D18BF20CEE1757F1F3DB1F9B7E83BB8724E1528487EF4CE03D377DEA
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/assets/all.js?g=65d1199738
Preview:	(function() {.window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {.window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id;.}, window.log_to_console = function() {.void 0 !== window.console_debug && console.log;.}, window.log_message = function(e) {.window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id;.};.}).call(this), window.log_message \|\| (window.log_message = function(e) {.new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e);.});..var BrowserDetect = {.init: function() {.this.browser = this.searchString(this.dataBrowser) \|\| "unknown", this.browserString =

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	352
Entropy (8bit):	4.685775248288353
Encrypted:	false
SSDEEP:	6:0ULLaqtCVGWAf97nnM3+mMwEzG/TxQ1eQ/Y6ule0pbdIfQH8w74Mhv:NLntCMfFnM3+ERTWQQuAibdyQH8w7Tv
MD5:	029AB28CA3C245DC425E3F3F6599D480
SHA1:	845057D3630D0A06E797A7049B3E9658D7650AF1
SHA-256:	8A1170223599205267C6EE3A3072855F1727461D9DD1066BB94F39180F963AF9
SHA-512:	5429DDC21DD62EBF7192985BAD0E22BD350C6C65051CA005BBFC27A9CD64088AEAE2B7AA2BC1065155B74509BE36E1524E04488A3E05D0407F5031F9E43480AB
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/assets/js/training.js
Preview:	$(document).ready(function () {. $('#training-form').prop('action', function (i, val) {. var correlation_id = new RegExp('correlation_id=([^&#]*)').exec(window.location.href);. if (correlation_id === null) {. correlation_id = "";. } else {. correlation_id = '?' + correlation_id[0];. }. return val + correlation_id;. });.});.

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322)
Category:	downloaded
Size (bytes):	6999
Entropy (8bit):	3.826075419802806
Encrypted:	false
SSDEEP:	192:s3gnyGXyCBzNOxSyiWyiZMPQsh1jayiSiy0r:luQcr
MD5:	EE73F2F47D51116DC40B85A6B57EAF20
SHA1:	6C42011667BAC1FA6C3272A11B510F22962D72A2
SHA-256:	6AE53963F41133561C78B4332B564C01F551C471CD91D980436A9F5DACDD8F19
SHA-512:	162F426E8C5787B989C07332EC466A68F97164400EE09562B925D3B4FE34D4BF393214C8A173174F22B0A47F635A0864D81D9E1BD3CB8D73DA4335A3F715A37D
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ QuickTime ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var i = {. setPluginStatus: function(q, p, s) {. var r = this;. r.version = p ? j.formatNum(p, 3) : null;. r.installed = r.version ? 1 : (s ? (s > 0 ? 0.7 : -0.1) : (q ? 0 : -1));. r.getVersionDone = r.installed == 0.7 \|\| r.installed == -0.1 \|\| r.nav.done === 0 ? 0 : 1;. },. getVersion: function(s, t) {. var u = this,. p = null,. r = 0,. q;. t = j.browser.isIE ? 0 : t;. if ((!r \|\| j.dbug) && u.nav.query(t).installed) {. r = 1. }. if ((!p \|\| j.dbug) && u.nav.query(t).version) {. p = u.nav.version. }. q = !p ? u.codebase.isMin(s) : 0;. if (q) {. u.setPluginStat

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 186 x 75, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13208
Entropy (8bit):	7.926458188139606
Encrypted:	false
SSDEEP:	384:UensKg1pTt1oonfE+uHeEKSgL2YWQSkVhg4:9iJh2YWQSk04
MD5:	766AE556EA87C2848ED1234CD766C982
SHA1:	65809C7DACCCD8E0FBE01B94CFF627061B127FD6
SHA-256:	F22FD137CA2F8CFE2A49C5E2740C201711BC8F8A83F5FEBC5B3C9D0312ABACFC
SHA-512:	1106E8C8BDF3AE536F4546D60D45BC7AF43CE83EDFBAC08FF539E13582C933755CC5C5F9AF30A3D9E686775149F68ADEF091B34F88F620B0903598375B2533E3
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/production/314/hallmark-2102f5.png
Preview:	.PNG........IHDR.......K........M....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-02-04T11:02:54-05:00" xmp:ModifyDate="2019-02-04T11:24:28-05:00" xmp:MetadataDate="2019-02-04T11:24:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:900ed65c-e1c5-324b-8267-8a15bcc678a6" xmpMM:DocumentID="xmp.did:900ed65c-e1c5-324b-8267-8a15bcc678a6" xmpMM:Origi

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 78 x 34, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4105
Entropy (8bit):	7.895740575375788
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT6ushS1tpoVALlzJn:LSDS0tKg9E05T6u3eeLlzh
MD5:	6537C0A611DF91C8D5A7468AFCA9415D
SHA1:	E9CF86A3DA96568635D49AB86E7F0CE67AFD31DA
SHA-256:	E9517B723C091A844B7F0FF2547D4C5589E35CC1A4AB3D4E70875382CC7FD487
SHA-512:	BB8166362062A4B9B574664563618C7332D70699D5DD50DC138CE937C6CE69D6A0649F7BBD1E75DDA02D187743C3DA634691D16F58551C3BFA99E3E9382A0D2F
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/production/314/hallmarkfooterlogo-d4ab56.png
Preview:	.PNG........IHDR...N...".......<....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	926
Entropy (8bit):	7.650083871007416
Encrypted:	false
SSDEEP:	24:tbog9ogPw8Ex8DNf49VRoZTkP7dr8bHhFKklqN:tsg9ogPwR8Rf49++6hFlu
MD5:	3C506B80D78539262795C9BA59A0631A
SHA1:	0B7EF5BDEADE81C3FFC8ABC8EF8A17F7566A10F4
SHA-256:	A35DE3A30E58BF477FEBCA8B47225959F48FD384FAF088A218D6BF2251F06CBE
SHA-512:	AA04687DE6D0C6DF36B655891B055FA3BC22BF8A5619589CA012150B7F64036A5F21FF8EBBD6C604C6FBCBA686D1946AC23712EE052FFFEB163C16E29A9A23E6
Malicious:	false
Reputation:	low
URL:	https://d25q7gseii1o1q.cloudfront.net/training/fish/mail.png
Preview:	.PNG........IHDR...0...0......,.....PLTE..............................`.......tRNS...........F.X...%IDATx^u.;o.W....:.4..vK:...%.0....v.. fG#v.vd^.v+E..s.K-...N..N..f.......G....]~/\|"V...ss..i......AF.(..G..q......3..=...0....2...E..._v.y......8..@..z..\.]3..+6..~...r.r.>R...............'=..W......NO........M#.,.]..67.c..A.......o..^..'H.b>....i.....C..(....\c....,....M..j:.M......9[ ..BY>...u....+mUD..d..n..E...F..{1.d.d%......FUUg..........E.<?h.......".......X.m->c....I...V..O9k.........f.yf#!.xn.N.......`.M._..<C.Z.>%.K!.J.........#q........W5.5..Dq...UX..&.3.1..<;.C.x'..S.N...........R......g......=...Ez.."=l.tNU.$...s.Z#..~.-..W.0.}"..W!Rr...V....@..5=........D..>.h3....J..^..]......%..2:R_.2U...M.Mp....."..1=.w..y....b?.0...jc.....d...K.Xh.z+.I...iH..?F#....E.d.P....7....u.C...@.{ip.j..n.]..gW...!.N..E.Z.M...M.@<.$..a.}..<.........HCW.b:s..j+....R...c5....IEND.B`.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	3.7012321814825753
Encrypted:	false
SSDEEP:	96:so5y9P80AbkhE5SoO6Dn5pqQ1cQp4oVNl0yKAiyC:soc9P80AI6SoOw5pqQPTl0yKAiyC
MD5:	E6DD596D2BC204EA573B868B92028C26
SHA1:	FA58BBA4C9A01B3764A881949A8423B773D8A338
SHA-256:	0730A7E6770925FA4232096E4D9874514985EC791A63FE873F0E4E3CD7722381
SHA-512:	4857A83D1F1AC1127A578B2BDE94973BCE3ECD2720CBC4D72DDF8CB193F0F3676BF932D0352F0F45CA3A553677D3960A61B472CA15C66E74F3E6384E36E018B4
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Silverlight ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = window.detector;. var h = {. getVersion: function() {. var r = this,. p = null,. q = 0;. if ((!q \|\| j.dbug) && r.nav.query().installed) {. q = 1. }. if ((!p \|\| j.dbug) && r.nav.query().version) {. p = r.nav.version. }. if ((!q \|\| j.dbug) && r.axo.query().installed) {. q = 1. }. if ((!p \|\| j.dbug) && r.axo.query().version) {. p = r.axo.version. }. r.version = j.formatNum(p);. r.installed = p ? 1 : (q ? 0 : -1). },. nav: {. hasRun: 0,. installed: 0,. version: null,. mimeType: ["application/x-silverlight", "application/x-silve

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.2915497523596535
Encrypted:	false
SSDEEP:	6:wBqWekiTakpxxdGztoIhS3EaaaWR0NKj8PxRjLCmKhv6vbcaS3jfU0cMdv6CT:dkK9dg5qEaiuNKYPXKQIjfSq
MD5:	D4F9143E19EEE7227E2F2E4E982FB893
SHA1:	71B625AF5BFCEEEF087A3B4958F83E3C25D607E4
SHA-256:	69C6DF06FB20C5647EFCEC88F12456B85287BE8D221CF8405E30B1261C02F20C
SHA-512:	F344128B31184890874C5640C93317AECCEF37BB8E17EAD49BB510B6EC6CBF6AB2075040B9EE249BD005D745C126B1D8F18791A10CA8A838763C4611A9EA980A
Malicious:	false
Reputation:	low
Preview:	<HTML><HEAD>.<TITLE>Access Denied</TITLE>.</HEAD><BODY>.<H1>Access Denied</H1>. .You don't have permission to access "http://www.java.com/js/deployJava.js" on this server.<P>.Reference #18.c6c41402.1736276576.36f0253a.<P>https://errors.edgesuite.net/18.c6c41402.1736276576.36f0253a</P>.</BODY>.</HTML>.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	11588
Entropy (8bit):	5.32113961330478
Encrypted:	false
SSDEEP:	192:weA85q1bfqbrbqGIwV4RePqceZFgqsmfqmrbqGIwV4YTPv8:Xf7qY4H4AqY4d
MD5:	B630D8EC59B107E15A64CB2E8236B144
SHA1:	246E8EB4235D443936F3AA35E329E7F8E5DA82FC
SHA-256:	4099D0DC74EA892BF49FD78A729C8ED5528E6D5F885786575AB525AE54E33978
SHA-512:	601F2F0DFE0E0DDA08720B34780865C47317C046DA3E93C256E926902DA7173DAD94D0962155D271FA5468732A583569882675C9239E5BB1192C5B51431FD22E
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65480)
Category:	dropped
Size (bytes):	93435
Entropy (8bit):	5.372924511876392
Encrypted:	false
SSDEEP:	1536:bYUfBybwh3KRI83RExoulFXo7CkSsz/G0bSVze/3260eMSTC5bqYKKhwFvxizJSM:XIi3kIP9kSsgo/ZvxYrtPTKCNtHyUtCg
MD5:	0B6ECF17E30037994D3FFEE51B525914
SHA1:	D09D3A99ED25D0F1FBE6856DE9E14FFD33557256
SHA-256:	F554D2F09272C6F71447EBFE4532D3B1DD1959BCE669F9A5CCC99E64EF511729
SHA-512:	468C0F964014D76EC5966F5589B2CCC0A7B5F3E8A785134897DFA282A3E6824CE9A75584C9404B77A6962FEF99547356AABE8AA71A6499E2568B9DE792D90579
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.8.2 jquery.com \| jquery.org/license /.(function(a,b){function G(a){var b=F[a]={};return p.each(a.split(s),function(a,c){b[c]=!0}),b}function J(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(I,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:+d+""===d?+d:H.test(d)?p.parseJSON(d):d}catch(f){}p.data(a,c,d)}else d=b}return d}function K(a){var b;for(b in a){if(b==="data"&&p.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function ba(){return!1}function bb(){return!0}function bh(a){return!a\|\|!a.parentNode\|\|a.parentNode.nodeType===11}function bi(a,b){do a=a[b];while(a&&a.nodeType!==1);return a}function bj(a,b,c){b=b\|\|0;if(p.isFunction(b))return p.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return p.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=p.grep(a,function(a){return a.nodeType===1});if(be.test(b))return p.filter(b,d,!c);b=p.filter(b,

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	1713
Entropy (8bit):	4.909213983910174
Encrypted:	false
SSDEEP:	24:mPLXjHpS2ntWrkJ+eKL35VMY8DJQyPFf+gDe+LGbVwZRSyzdlbyDHuCtaU7bhiKn:ES2nt/J+Xh4zdf+iGVidlWO/Uf8KXYQ
MD5:	BC7F970AD0F163BC72C9AE9AA09E1CDE
SHA1:	BF67B0D0F3BB4038CAF1021A692B6EB6024C3E02
SHA-256:	5243766EEDFCBA70128C2931DBEF8875F942B81E39002D80DC0110167D4EF742
SHA-512:	86662D26C0D26E1DD10BA4E355385AEA41F8CD9859E0F0BC1A3759ED553CCC7A86D650512439E1E0CFA4142FF78352C9AC0A96DACD5B074CA196A9C9C785ECF8
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css
Preview:	html {. margin: 0;. padding: 0;. -ms-text-size-adjust: 100%;. -webkit-text-size-adjust: 100%;.}..body {. line-height: 1;. margin: 0; padding: 0;.}..* {. -webkit-box-sizing: border-box;. -moz-box-sizing: border-box;. box-sizing: border-box;.}..ol,ul,li {. font-size: 100%;. font: inherit;. margin: 0;. padding: 0;.}...langDrop {. font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;. background: #484c55;. border: 1px solid white;. border-radius: 4px;. color: white;. display: inline-block;. font-size: 14px;. line-height: 160%;. margin-left: 10px;. padding: 5px 15px;. position: fixed;. top: 10px; right: 10px;. vertical-align: middle;. z-index: 2;. min-width:150px;. text-align: center;.}...langDrop span:before {. content: 'Language:';. position: absolute;. top: 5px; left: -80%;.}...langDrop span:after {. content: ' .';.}...langDrop ul {. border: 1px solid transparent;. border-top: 0 none;. list-style: none;. max-height: 0;. opacity: 0;. overflo

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32341)
Category:	downloaded
Size (bytes):	96381
Entropy (8bit):	5.38156916982579
Encrypted:	false
SSDEEP:	1536:EPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jqkODZ2D5N9Rag0MOIdSZAgtgoX5Yn:bIO/e2D5c4LgtImLja98HrK
MD5:	8FC25E27D42774AEAE6EDBC0A18B72AA
SHA1:	B66ED708717BF0B4A005A4D0113AF8843EF3B8FF
SHA-256:	B294E973896F8F874E90A8EB1A8908AC790980D034C4C4BDF0FC3D37B8ABF682
SHA-512:	87D90A665C15D71AC872BD8BC003D9863964C7EC7ADA6370B902B93C0BBD7770FE25730D946C7C6A465BAA95EFA74BC0E78AF3F83AEA615AF35060CC8702A6C1
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.11.0/jquery.min.js
Preview:	/! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functio

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5941
Entropy (8bit):	3.890139995787555
Encrypted:	false
SSDEEP:	96:sxUIn2DA0ApgkdNbT2HmsUlOOo+dUOoNP4L4bKdUP1/OFVlKx6pCyiSd5VXxkU0R:sxUIQA0Apgk96wd6P+dUPk84pCyiSd5Y
MD5:	FFD2CC77BB64D40BEEB5D561FFFE1F79
SHA1:	6CB535641677D27E4DE591CEB3C4E2F408826E7D
SHA-256:	CDB16CA3DDD3CEAD71121799751FA80D3033375ABCDBC5FC84D35FB82C7FC9DE
SHA-512:	F47EC76CE96D8652D068FE13DFF15D76CE31B1292061765844BEFCDF668270BA75A1D0757A993F2B73F8D509BCC1883DDE2D4CC5B58B320CF21B77A526F43556
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ WindowsMediaPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var o = {. setPluginStatus: function(p, r) {. var q = this;. if (p) {. q.version = j.formatNum(p). }. q.installed = q.version ? 1 : (r ? 0 : -1);. q.getVersionDone = q.installed === 0 ? 0 : 1;. },. getVersion: function(t, q) {. var r = this,. s, p = null;. if ((!s \|\| j.dbug) && r.nav.query().installed) {. s = 1. }. if ((!s \|\| j.dbug) && r.axo.query().installed) {. s = 1. }. if ((!p \|\| j.dbug) && r.axo.query().version) {. p = r.axo.version. }. if (((!s && !p) \|\| q \|\| j.dbug) && r.FirefoxPlugin.query().version) {. s = 1;.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	9775
Entropy (8bit):	3.5887745114878893
Encrypted:	false
SSDEEP:	192:s8soEtP1SPpdXXVPrQSaa/nA3fkCtSZSlKp6jt6yYiSL0P5P4iSHPUIsCyiSibOY:s7t2A8pVSHCB
MD5:	3D7BE656672C16A34806C13388410325
SHA1:	C391646C980C60D75C35B33A974C97AE88114EEF
SHA-256:	88BE902CC76B5EC1EC932B6AE93457B6B0CA69D7A36BFADEFC2F24DB225DC238
SHA-512:	E4BFA1B906B6F12F9CE8FBB1CFC41FFD5341149B6AFFEB8567A6486E386C000C501AF6040D7986046CBF3E0E0C99C4F08B4011003302753536BA0166DE49CE0F
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ RealPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var n = {. mimeType: ["audio/x-pn-realaudio-plugin", "audio/x-pn-realaudio"],. classID: "clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA",. setPluginStatus: function(r, p) {. var s = this,. q;. if (p) {. s.version = j.formatNum(j.getNum(p)). }. s.installed = s.version ? 1 : (r ? 0 : -1);. q = s.installed == -1 \|\| s.instance.version;. q = q \|\| s.axo.version;. s.getVersionDone = q ? 1 : 0;. },. navObj: {. hasRun: 0,. installed: null,. version: null,. find: "RealPlayer.*Plug-?in",. avoid: "Totem\|QuickTime\|Helix\|VLC\|Download",. plugins: ["RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	2511
Entropy (8bit):	4.169228539892239
Encrypted:	false
SSDEEP:	48:nulNM2WVjh7ndVjhTMtZn/W/p54+GFkT1/5J7:nWNjWBh7dBhotZn/I4+GFk951
MD5:	118032089FF5601C26DB331DC455DC1C
SHA1:	DA0F04C3B17DE1EBB03701F5760F1D53CFFA29B6
SHA-256:	FF15EE304B9FA684507D889A5A342F7C89116739B04B0A160BE65E0A63718F0F
SHA-512:	100161F784BF69F7BBD6FF9D80EF6DD30B7DDD7774CE877F889DDF91CF6F26EECE08E24B55900D8706169E43CC4406507D4FCB30DAC0FD03BD106DEE260C9807
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"."http://www.w3.org/TR/html4/strict.dtd">.<html>. <head>. <script>window.test_mode = true;</script>. <title>. The page cannot be found. </title>. <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">. <style type="text/css">. BODY { font: 8pt/12pt verdana }. H1 { font: 13pt/15pt verdana }. H2 { font: 8pt/12pt verdana }. A:link { color: red }. A:visited { color: maroon }. </style>. </head>. <body>. <script src="/assets/ajax/libs/jquery/1.8.0/jquery.min.js" type="text/javascript">.</script><script src="/assets/all.js?g=404" type="text/javascript">.</script>. <table width="500" border="0" cellspacing="10">. <tr>. <td>. <h1>. The page cannot be found. </h1>The page you are looking for might have been removed, had its name changed,

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	28356
Entropy (8bit):	5.215232550543418
Encrypted:	false
SSDEEP:	384:Ldz9MmIbpuTuAs7KoUSvm9m/QUYcBw6xwQPfWjU82bleXg7Gv:LrMlIT2KZ8Q4Bw6xwQPfWjUN5ew6v
MD5:	A6B682FEC1E95D9A565627499E1B0FD2
SHA1:	9D9B94C97C01446AE496006BEAFA2B3A05AB7C6A
SHA-256:	940DA9FCC9AEF9C6F5EC3E47002962DC008A6B70D9A012F5D22AF8C53DA29210
SHA-512:	0AB6339098AF3CFA0D1F500D93FD2773472415DDAE8E33C0819A44DB3CFD46F10B20FEA1D18BF20CEE1757F1F3DB1F9B7E83BB8724E1528487EF4CE03D377DEA
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/assets/all.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	(function() {.window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {.window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id;.}, window.log_to_console = function() {.void 0 !== window.console_debug && console.log;.}, window.log_message = function(e) {.window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id;.};.}).call(this), window.log_message \|\| (window.log_message = function(e) {.new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e);.});..var BrowserDetect = {.init: function() {.this.browser = this.searchString(this.dataBrowser) \|\| "unknown", this.browserString =

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1900
Entropy (8bit):	4.759503479044407
Encrypted:	false
SSDEEP:	48:56wp7A6ceB6ZOPbjqNegvi3Iv8kN3eJvM:dpT/XVg67kIM
MD5:	5B4AB6EBB4B3B8082F88EA8F0C539B63
SHA1:	6E8228DE914A1E00DFA956248015C6540BB8667D
SHA-256:	4352F5405C4986ECDA99A6E6896D4DF331465A81F3647A0BB6332B720C2CD4E6
SHA-512:	1ABC2856934350EC34A9A56DB168C19FD920E582759B6B78ABDC70862FAE847BA24CDDA8A04A78DCBDBE920D78D31173AC3F8855C50839D21E723189B643F41E
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/embedded/translations/url/en-us.json
Preview:	{. "replacements":{. "title":"You have been Phished!",. "h1":"OOPS!",. "h2":"You fell for a <strong>phish!</strong>",. "p0":"Do not worry, this was an approved phishing simulation run by %COMPANY%.<br> <strong>We are here to help.</strong>",. "p1":"Below is the simulated phishing message you just received. Like a real phishing attack, on the surface, the email seems to be legitimate.. but it isn't..",. "p2":"If this had been an actual attack, clicking the link would have sent you to a dangerous site and exposed your system to ransomware, malware or another cyber security threat.",. "p3":"<br> When you receive an unsolicited email with embedded web links, keep the following tips in mind:",. "ul1":"<li>Be immediately suspicious if the message tries to scare you, offers an incredible deal, or prompts you to reset a password or update account information.</li> <li>Check each link by hovering over it to see its true source. If the URL is unfamiliar or differs fr

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (306)
Category:	dropped
Size (bytes):	50085
Entropy (8bit):	3.5610506396954245
Encrypted:	false
SSDEEP:	768:so4D6PW10HQN3WQ9tD9BsiAmvwyWSdovbEuXg/:shDCW10HQN3WQ9tD9BsRyWSCvgUg/
MD5:	00A513F07603DF01E3B99BE00F370754
SHA1:	F0C03B1C50F39C95075DF687CD55F18861631526
SHA-256:	4BAB432979D731F8264BCD9D40422CA7DFCFCB0E0E703288DB78BBFA555F853A
SHA-512:	9824C521D8B214847E6193CB8046488CFF1F113D6C9637241D5EE1042ADC6C8C7724452611DD0994E7A478768860E69A29B4F4E6B51FD726761DE520D5C05765
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. var j = {. version: "0.9.1",. name: "PluginDetect",. addPlugin: function(p, q) {. if (p && j.isString(p) && q && j.isFunc(q.getVersion)) {. p = p.replace(/\s/g, "").toLowerCase();. j.Plugins[p] = q;. if (!j.isDefined(q.getVersionDone)) {. q.installed = null;. q.version = null;. q.version0 = null;. q.getVersionDone = null;. q.pluginName = p;. }. }. },. uniqueName: function() {. return j.name + "998". },. openTag: "<",. hasOwnPROP: ({}).constructor.prototype.hasOwnProperty,. hasOwn: function(s, t) {. var p;. try {. p = j.hasOwnPROP.call(s, t).

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6680
Entropy (8bit):	3.6986423324780655
Encrypted:	false
SSDEEP:	192:szfwSCu89PUlb1h3U3ZY8SsbAdJO3NyiSiYPDPM9bUaX09+EQ:i7r36D09+n
MD5:	F9AD9A096894BA248E4A1F73E7EBA1BE
SHA1:	F2449CE5F7A5C42FFDCC5F087A75B2513E73592C
SHA-256:	A26D01D5912459798481786640DC44FD7605D09F2F9E6DD24720205EFCAB6861
SHA-512:	230C6B3F64BAD4A1681A90CD835FD2037068AD951D1BFB027E2B90F832C074D0AF686D2AA51175BE538BFAE9A08D96E9D46C941AEF223567937E0CD280B76DD4
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Flash ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var e = {. mimeType: "application/x-shockwave-flash",. setPluginStatus: function(t, q, p) {. var s = this,. r;. s.installed = q ? 1 : (t ? 0 : -1);. s.precision = p;. s.version = j.formatNum(q);. r = s.installed == -1 \|\| s.instance.version;. r = r \|\| s.axo.version;. s.getVersionDone = r ? 1 : 0;. },. getPrecision: function(t) {. if (j.isString(t)) {. var q, s = "\\d+",. r = "[\\._,]",. p = [s, s, s, s];. for (q = 4; q > 0; q--) {. if ((new RegExp(p.slice(0, q).join(r))).test(t)) {. return q. }. }. }. return 0.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	1908
Entropy (8bit):	5.30612486029944
Encrypted:	false
SSDEEP:	24:hYmsZAGrRtzIRKv348hRQX+eP2dAD76jhvQ+S+/PP2dAkxuN+ere6g:AKGrjERKA6QvPZDejRgQPPZkfz
MD5:	5118D96AF4C6244607F609EF9EBD3F7E
SHA1:	0020FC8D75BD94D9A624306DA975704C29782695
SHA-256:	502F480F6B9F7E634A7C16ADDE4BD7A01EB323805F8FDE0DBCB75BCCC8A0EE12
SHA-512:	14436E9F7FBC21D8445FFA53358EDB81E15A99899C9FDAC1DC5C0C4F042F034C06739C2272AA5129EF11B59149DC6D1BE531EEC65409C4A2904FD5B78D36DFBB
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/training_screenshot?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<title></title>..<meta charset="UTF-8">.</head>.<body style="margin: 40px 0;font-family: Arial, Helvetica, sans-serif;font-size: 18px;">.<table align="center" border="0" cellpadding="0" cellspacing="0" class="container" style="width: 600px;margin: 0 auto;border-collapse: collapse;" width="600">..<tbody>...<tr>....<td><img alt="Hallmark e cards logo" src="https://tslp.s3.amazonaws.com/training/production/314/hallmark-2102f5.png"></td>...</tr>...<tr class="banner">....<td style="padding: 10px 0px; background-color: rgb(247, 247, 247);">....<div style="text-align:center"><img alt="" height="157" src="https://ts-uploads.s3.amazonaws.com/training/production/13913/clights-c61e57.png" width="594"></div>....</td>...</tr>...<tr>....<td style="background-color: rgb(247, 247, 247);">....<p>Hello Kathleen,<br>....Someone sent you an Holiday card.</p>.....<p><em><strong><a href="javascript:v

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 186 x 75, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13208
Entropy (8bit):	7.926458188139606
Encrypted:	false
SSDEEP:	384:UensKg1pTt1oonfE+uHeEKSgL2YWQSkVhg4:9iJh2YWQSk04
MD5:	766AE556EA87C2848ED1234CD766C982
SHA1:	65809C7DACCCD8E0FBE01B94CFF627061B127FD6
SHA-256:	F22FD137CA2F8CFE2A49C5E2740C201711BC8F8A83F5FEBC5B3C9D0312ABACFC
SHA-512:	1106E8C8BDF3AE536F4546D60D45BC7AF43CE83EDFBAC08FF539E13582C933755CC5C5F9AF30A3D9E686775149F68ADEF091B34F88F620B0903598375B2533E3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......K........M....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-02-04T11:02:54-05:00" xmp:ModifyDate="2019-02-04T11:24:28-05:00" xmp:MetadataDate="2019-02-04T11:24:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:900ed65c-e1c5-324b-8267-8a15bcc678a6" xmpMM:DocumentID="xmp.did:900ed65c-e1c5-324b-8267-8a15bcc678a6" xmpMM:Origi

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	4.759503479044407
Encrypted:	false
SSDEEP:	48:56wp7A6ceB6ZOPbjqNegvi3Iv8kN3eJvM:dpT/XVg67kIM
MD5:	5B4AB6EBB4B3B8082F88EA8F0C539B63
SHA1:	6E8228DE914A1E00DFA956248015C6540BB8667D
SHA-256:	4352F5405C4986ECDA99A6E6896D4DF331465A81F3647A0BB6332B720C2CD4E6
SHA-512:	1ABC2856934350EC34A9A56DB168C19FD920E582759B6B78ABDC70862FAE847BA24CDDA8A04A78DCBDBE920D78D31173AC3F8855C50839D21E723189B643F41E
Malicious:	false
Reputation:	low
Preview:	{. "replacements":{. "title":"You have been Phished!",. "h1":"OOPS!",. "h2":"You fell for a <strong>phish!</strong>",. "p0":"Do not worry, this was an approved phishing simulation run by %COMPANY%.<br> <strong>We are here to help.</strong>",. "p1":"Below is the simulated phishing message you just received. Like a real phishing attack, on the surface, the email seems to be legitimate.. but it isn't..",. "p2":"If this had been an actual attack, clicking the link would have sent you to a dangerous site and exposed your system to ransomware, malware or another cyber security threat.",. "p3":"<br> When you receive an unsolicited email with embedded web links, keep the following tips in mind:",. "ul1":"<li>Be immediately suspicious if the message tries to scare you, offers an incredible deal, or prompts you to reset a password or update account information.</li> <li>Check each link by hovering over it to see its true source. If the URL is unfamiliar or differs fr

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (306)
Category:	downloaded
Size (bytes):	50085
Entropy (8bit):	3.5610506396954245
Encrypted:	false
SSDEEP:	768:so4D6PW10HQN3WQ9tD9BsiAmvwyWSdovbEuXg/:shDCW10HQN3WQ9tD9BsRyWSCvgUg/
MD5:	00A513F07603DF01E3B99BE00F370754
SHA1:	F0C03B1C50F39C95075DF687CD55F18861631526
SHA-256:	4BAB432979D731F8264BCD9D40422CA7DFCFCB0E0E703288DB78BBFA555F853A
SHA-512:	9824C521D8B214847E6193CB8046488CFF1F113D6C9637241D5EE1042ADC6C8C7724452611DD0994E7A478768860E69A29B4F4E6B51FD726761DE520D5C05765
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. var j = {. version: "0.9.1",. name: "PluginDetect",. addPlugin: function(p, q) {. if (p && j.isString(p) && q && j.isFunc(q.getVersion)) {. p = p.replace(/\s/g, "").toLowerCase();. j.Plugins[p] = q;. if (!j.isDefined(q.getVersionDone)) {. q.installed = null;. q.version = null;. q.version0 = null;. q.getVersionDone = null;. q.pluginName = p;. }. }. },. uniqueName: function() {. return j.name + "998". },. openTag: "<",. hasOwnPROP: ({}).constructor.prototype.hasOwnProperty,. hasOwn: function(s, t) {. var p;. try {. p = j.hasOwnPROP.call(s, t).

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	4.685775248288353
Encrypted:	false
SSDEEP:	6:0ULLaqtCVGWAf97nnM3+mMwEzG/TxQ1eQ/Y6ule0pbdIfQH8w74Mhv:NLntCMfFnM3+ERTWQQuAibdyQH8w7Tv
MD5:	029AB28CA3C245DC425E3F3F6599D480
SHA1:	845057D3630D0A06E797A7049B3E9658D7650AF1
SHA-256:	8A1170223599205267C6EE3A3072855F1727461D9DD1066BB94F39180F963AF9
SHA-512:	5429DDC21DD62EBF7192985BAD0E22BD350C6C65051CA005BBFC27A9CD64088AEAE2B7AA2BC1065155B74509BE36E1524E04488A3E05D0407F5031F9E43480AB
Malicious:	false
Reputation:	low
Preview:	$(document).ready(function () {. $('#training-form').prop('action', function (i, val) {. var correlation_id = new RegExp('correlation_id=([^&#]*)').exec(window.location.href);. if (correlation_id === null) {. correlation_id = "";. } else {. correlation_id = '?' + correlation_id[0];. }. return val + correlation_id;. });.});.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:	768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 188 x 232, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5003
Entropy (8bit):	7.918202068997788
Encrypted:	false
SSDEEP:	96:Kwd8dJlYp6p4pdkErxIeifSlAz/GbO1h+Bk70vB0nm0eceK53SUVQ/4A:Kwad0AIZC/fSlOD+fvB0nmcec1G/4A
MD5:	3E598C505586E70346FA62D104DD540F
SHA1:	497E981085A062E5E4972635E775C740FB701AD1
SHA-256:	7789F06BCF267AB54B9BC9C64EA04877C46AA141F67A21A501D908447FD95EBB
SHA-512:	D544074AA05732D6C1018B019CBB4F28AA257EC272E36DD0BCCA0094C3902DB92699127ADCC7116BC0BB0F7816028C881B5EA3DE3F6375E4144562AF7934B89C
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/production/314/hooks-a3eab7.png
Preview:	.PNG........IHDR.............UV.J...RIDATx^.....u.....\..1..BlR..b.dI...0...A.R.U....U@I..I.\.n...A...T..b=}....1.+..?.._..y...f....z.~......z...l.:..9.9<?5.}u..:.T.....Tf:.Lu.#......5"..#x.<.........A. x.<...z.^M.gg..g....{...2..~......^.5......9.......P.y..W.%.D...c........P....+.e..jom..A.].o....m..qK.?..>..3.{.j.5..`.c.....\mP>.............3/.\......C.. +.m.-....A. x.<.........A..........A. x.<.......#x.<.........A. x.<...?..rM....9..:...~U.......3..&OTg...G.J..we-e.l..tK..........~f[]......B.-.}S.k.-.~s...B.-.7.k...u.a..q6.9R-....3..2.....c..r....@.w4.^.O`~.!r..z.q\|if..\|....YW4.?..F..e.6.......g.c..i..Pk~o...sE.-.....ff."V2...U.uy#.o...D...X..../.[..+..xz...j.<Z....^o./df..w.x.E....m..r^w.:...c.}oe>o<,.;s..S......!...M..X.).Df...P.:s.&xx,.~../.s]....Kk..?>x...:..2{.....#W..._P.5.3.g>L.g..\iz.#..SYO.....u...........A. x.<.....G. x.<.........A. x.<.....A. x.<.........A. x.......A. x.<.........a..'..+.Y[.&......;..3..M......P,....V.G.

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 188 x 232, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	7.918202068997788
Encrypted:	false
SSDEEP:	96:Kwd8dJlYp6p4pdkErxIeifSlAz/GbO1h+Bk70vB0nm0eceK53SUVQ/4A:Kwad0AIZC/fSlOD+fvB0nmcec1G/4A
MD5:	3E598C505586E70346FA62D104DD540F
SHA1:	497E981085A062E5E4972635E775C740FB701AD1
SHA-256:	7789F06BCF267AB54B9BC9C64EA04877C46AA141F67A21A501D908447FD95EBB
SHA-512:	D544074AA05732D6C1018B019CBB4F28AA257EC272E36DD0BCCA0094C3902DB92699127ADCC7116BC0BB0F7816028C881B5EA3DE3F6375E4144562AF7934B89C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............UV.J...RIDATx^.....u.....\..1..BlR..b.dI...0...A.R.U....U@I..I.\.n...A...T..b=}....1.+..?.._..y...f....z.~......z...l.:..9.9<?5.}u..:.T.....Tf:.Lu.#......5"..#x.<.........A. x.<...z.^M.gg..g....{...2..~......^.5......9.......P.y..W.%.D...c........P....+.e..jom..A.].o....m..qK.?..>..3.{.j.5..`.c.....\mP>.............3/.\......C.. +.m.-....A. x.<.........A..........A. x.<.......#x.<.........A. x.<...?..rM....9..:...~U.......3..&OTg...G.J..we-e.l..tK..........~f[]......B.-.}S.k.-.~s...B.-.7.k...u.a..q6.9R-....3..2.....c..r....@.w4.^.O`~.!r..z.q\|if..\|....YW4.?..F..e.6.......g.c..i..Pk~o...sE.-.....ff."V2...U.uy#.o...D...X..../.[..+..xz...j.<Z....^o./df..w.x.E....m..r^w.:...c.}oe>o<,.;s..S......!...M..X.).Df...P.:s.&xx,.~../.s]....Kk..?>x...:..2{.....#W..._P.5.3.g>L.g..\iz.#..SYO.....u...........A. x.<.....G. x.<.........A. x.<.....A. x.<.........A. x.......A. x.<.........a..'..+.Y[.&......;..3..M......P,....V.G.

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28356
Entropy (8bit):	5.215232550543418
Encrypted:	false
SSDEEP:	384:Ldz9MmIbpuTuAs7KoUSvm9m/QUYcBw6xwQPfWjU82bleXg7Gv:LrMlIT2KZ8Q4Bw6xwQPfWjUN5ew6v
MD5:	A6B682FEC1E95D9A565627499E1B0FD2
SHA1:	9D9B94C97C01446AE496006BEAFA2B3A05AB7C6A
SHA-256:	940DA9FCC9AEF9C6F5EC3E47002962DC008A6B70D9A012F5D22AF8C53DA29210
SHA-512:	0AB6339098AF3CFA0D1F500D93FD2773472415DDAE8E33C0819A44DB3CFD46F10B20FEA1D18BF20CEE1757F1F3DB1F9B7E83BB8724E1528487EF4CE03D377DEA
Malicious:	false
Reputation:	low
Preview:	(function() {.window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {.window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id;.}, window.log_to_console = function() {.void 0 !== window.console_debug && console.log;.}, window.log_message = function(e) {.window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id;.};.}).call(this), window.log_message \|\| (window.log_message = function(e) {.new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e);.});..var BrowserDetect = {.init: function() {.this.browser = this.searchString(this.dataBrowser) \|\| "unknown", this.browserString =

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32341)
Category:	dropped
Size (bytes):	96381
Entropy (8bit):	5.38156916982579
Encrypted:	false
SSDEEP:	1536:EPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jqkODZ2D5N9Rag0MOIdSZAgtgoX5Yn:bIO/e2D5c4LgtImLja98HrK
MD5:	8FC25E27D42774AEAE6EDBC0A18B72AA
SHA1:	B66ED708717BF0B4A005A4D0113AF8843EF3B8FF
SHA-256:	B294E973896F8F874E90A8EB1A8908AC790980D034C4C4BDF0FC3D37B8ABF682
SHA-512:	87D90A665C15D71AC872BD8BC003D9863964C7EC7ADA6370B902B93C0BBD7770FE25730D946C7C6A465BAA95EFA74BC0E78AF3F83AEA615AF35060CC8702A6C1
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,functio

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9775
Entropy (8bit):	3.5887745114878893
Encrypted:	false
SSDEEP:	192:s8soEtP1SPpdXXVPrQSaa/nA3fkCtSZSlKp6jt6yYiSL0P5P4iSHPUIsCyiSibOY:s7t2A8pVSHCB
MD5:	3D7BE656672C16A34806C13388410325
SHA1:	C391646C980C60D75C35B33A974C97AE88114EEF
SHA-256:	88BE902CC76B5EC1EC932B6AE93457B6B0CA69D7A36BFADEFC2F24DB225DC238
SHA-512:	E4BFA1B906B6F12F9CE8FBB1CFC41FFD5341149B6AFFEB8567A6486E386C000C501AF6040D7986046CBF3E0E0C99C4F08B4011003302753536BA0166DE49CE0F
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ RealPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var n = {. mimeType: ["audio/x-pn-realaudio-plugin", "audio/x-pn-realaudio"],. classID: "clsid:CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA",. setPluginStatus: function(r, p) {. var s = this,. q;. if (p) {. s.version = j.formatNum(j.getNum(p)). }. s.installed = s.version ? 1 : (r ? 0 : -1);. q = s.installed == -1 \|\| s.instance.version;. q = q \|\| s.axo.version;. s.getVersionDone = q ? 1 : 0;. },. navObj: {. hasRun: 0,. installed: null,. version: null,. find: "RealPlayer.*Plug-?in",. avoid: "Totem\|QuickTime\|Helix\|VLC\|Download",. plugins: ["RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	22855
Entropy (8bit):	3.5177544592160155
Encrypted:	false
SSDEEP:	384:WKFsDSEYnCMA1gNNwbV2RG0WomPqbTLJkrU2LOp1rD:xsGbnCZ1gNN7Y73P+TtkrU2iP
MD5:	0D5882D41C8B6E40059C8D9ACBCF1518
SHA1:	53103565F3C07416FC691583A43A91943DBF0809
SHA-256:	D9B7C6163477008469AF64B211E2DBD4F4171B85B51E3714F11C99F9BA2C32F9
SHA-512:	2E70A43F053797DF07CF2A7F6CF4CDD99A0082CB3DC1FBF661FAB775E98EDC18866FC762576B9E26A9DF4C094523AF98D7B46C92F9D6A7BED2CBFE6CBA01447E
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ AdobeReader PDFjs ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX ]./.(function() {. j = PluginDetect;. var c = {. OTF: null,. setPluginStatus: function() {. var p = this,. B = p.OTF,. v = p.nav.detected,. x = p.nav.version,. z = p.nav.precision,. C = z,. u = x,. s = v > 0;. var H = p.axo.detected,. r = p.axo.version,. w = p.axo.precision,. D = p.doc.detected,. G = p.doc.version,. t = p.doc.precision,. E = p.doc2.detected,. F = p.doc2.version,. y = p.doc2.precision;. u = F \|\| u \|\| r \|\| G;. C = y \|\| C \|\| w \|\| t;. s = E > 0 \|\| s \|\| H > 0 \|\| D > 0;. u = u \|\| null;. p.version =

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5941
Entropy (8bit):	3.890139995787555
Encrypted:	false
SSDEEP:	96:sxUIn2DA0ApgkdNbT2HmsUlOOo+dUOoNP4L4bKdUP1/OFVlKx6pCyiSd5VXxkU0R:sxUIQA0Apgk96wd6P+dUPk84pCyiSd5Y
MD5:	FFD2CC77BB64D40BEEB5D561FFFE1F79
SHA1:	6CB535641677D27E4DE591CEB3C4E2F408826E7D
SHA-256:	CDB16CA3DDD3CEAD71121799751FA80D3033375ABCDBC5FC84D35FB82C7FC9DE
SHA-512:	F47EC76CE96D8652D068FE13DFF15D76CE31B1292061765844BEFCDF668270BA75A1D0757A993F2B73F8D509BCC1883DDE2D4CC5B58B320CF21B77A526F43556
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/wmp.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ WindowsMediaPlayer ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var o = {. setPluginStatus: function(p, r) {. var q = this;. if (p) {. q.version = j.formatNum(p). }. q.installed = q.version ? 1 : (r ? 0 : -1);. q.getVersionDone = q.installed === 0 ? 0 : 1;. },. getVersion: function(t, q) {. var r = this,. s, p = null;. if ((!s \|\| j.dbug) && r.nav.query().installed) {. s = 1. }. if ((!s \|\| j.dbug) && r.axo.query().installed) {. s = 1. }. if ((!p \|\| j.dbug) && r.axo.query().version) {. p = r.axo.version. }. if (((!s && !p) \|\| q \|\| j.dbug) && r.FirefoxPlugin.query().version) {. s = 1;.

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	3880
Entropy (8bit):	4.8522315004221355
Encrypted:	false
SSDEEP:	96:nsc66a404ogf4G464dH4n4k6UBnfSOFTSGEK8:nsc66B7oggdhm4ZSfSORSGEK8
MD5:	7C89BF38614713327631E713BD0BD385
SHA1:	36F7502928D78DA4F0785D6AB2D2CB21D600CABF
SHA-256:	3CBA33B4922B091454A65837ADB7352B557267F2F663FD1BE395DE9B695BF28D
SHA-512:	7332024BDEFF9533A31DE387A977116BC1997D692F728E983514FD86665C46035FA92CF0BC484EB9D9B71E4974999D520FD741F7B332A04D52E6B5599331910A
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/2865d1125997389a?l=22
Preview:	<html>. <head>. <title></title>. <noscript><meta http-equiv="refresh" content="1;url=/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"></noscript>. </head>. <body>. <noscript><img src="/trace.png?id=65d1199738&msg=JavascriptDisabled&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc" width="1" height="1" style="display: none;"></noscript>. <img src="https://hallmark.greetingsweb.com:49153/alt_pixel_click_65d1199738.gif?correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc" width="1" height="1" />. </body>. <script type="text/javascript" src="https://tslp.s3.amazonaws.com/detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"></script>.<script type="text/javascript" src="https://tslp.s3.amazonaws.com/detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"></script>.<script

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28356
Entropy (8bit):	5.215232550543418
Encrypted:	false
SSDEEP:	384:Ldz9MmIbpuTuAs7KoUSvm9m/QUYcBw6xwQPfWjU82bleXg7Gv:LrMlIT2KZ8Q4Bw6xwQPfWjUN5ew6v
MD5:	A6B682FEC1E95D9A565627499E1B0FD2
SHA1:	9D9B94C97C01446AE496006BEAFA2B3A05AB7C6A
SHA-256:	940DA9FCC9AEF9C6F5EC3E47002962DC008A6B70D9A012F5D22AF8C53DA29210
SHA-512:	0AB6339098AF3CFA0D1F500D93FD2773472415DDAE8E33C0819A44DB3CFD46F10B20FEA1D18BF20CEE1757F1F3DB1F9B7E83BB8724E1528487EF4CE03D377DEA
Malicious:	false
Reputation:	low
Preview:	(function() {.window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {.window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e) + "&msg=" + encodeURIComponent(i) + "&correlation_id=" + window.correlation_id;.}, window.log_to_console = function() {.void 0 !== window.console_debug && console.log;.}, window.log_message = function(e) {.window.log_to_console(e), new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e) + "&correlation_id=" + window.correlation_id;.};.}).call(this), window.log_message \|\| (window.log_message = function(e) {.new Image().src = window.base_post_url + "/trace?id=" + encodeURIComponent(window.tracking_id) + "&msg=" + encodeURIComponent(e);.});..var BrowserDetect = {.init: function() {.this.browser = this.searchString(this.dataBrowser) \|\| "unknown", this.browserString =

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (412)
Category:	downloaded
Size (bytes):	6367
Entropy (8bit):	4.9588260446643275
Encrypted:	false
SSDEEP:	96:p0D3zijxL1+pHWD848PIRWSQrb0o/CZ2peLDx6C6lGaDmWhSh8CX/5I:qfijxZKT9j/8qmW8RI
MD5:	0560FEBF38CFE916AB8FFBEE8CE4E9FC
SHA1:	5E41BB9B576DB52BCEA94264B9929A286A20A0F4
SHA-256:	18FD69A3BB1FC61221C8D6C3BBBD177C38A21D96392BF2B403DDD9969615CF22
SHA-512:	EB8F196049AC589A399504FB03B56C3AB011DFC508206C1AD47554C4AE961E35BF8B7284E1EEE0CCEC8FD114674C664F8058256CDDC7B60B3EBC3107708365EE
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/training/embedded/css/url.css
Preview:	.cf:after {. clear: both;. content: '';. display: table;.}..html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td,article,aside,canvas,details,embed,figure,figcaption,footer,header,hgroup,menu,nav,output,ruby,section,summary,time,mark,audio,video {. margin: 0;. padding: 0;. border: 0;. font-size: 100%;. font: inherit;. vertical-align: baseline;.}..article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section,main {. display: block;.}..body {. line-height: 1;.}..ol,ul {. list-style: none;.}..blockquote,q {. quotes: none;.}..blockquote:before,blockquote:after,q:before,q:after {. content: '';. content: none;.}..table {. border-collapse: collapse;. border-spacing: 0;.}..strong {. font-weight: bold;.}..em {. font-style: italic;.}..a {.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 860 x 227, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	52551
Entropy (8bit):	7.9651205853074165
Encrypted:	false
SSDEEP:	768:Hyck1qsYP5rdDzwmaxuyCaU1O5yrAl/dMDZnYKaA2RYG/sxCDDhJgBkWSBMNsZu:V/rdzwmaWO4AN+NfT2OGekdSnqE
MD5:	4355E91ABDDBB81C9E7450FF38D049CF
SHA1:	AAB51083E61C56250272B4E1D6ACF7ADA92AEFB3
SHA-256:	F8D5F9151D03E67C1496D8ECC667FC9E64E48420A16678AF75CA2A8F5D616DEB
SHA-512:	71462D039E971DF37931708C84BF27DB0BBDF28E042FE4718F10A56A2E41E186111D8DEA2F979FD83D3E11047AEC15EF88A977AAC8DDC9215E3492067BE22336
Malicious:	false
Reputation:	low
URL:	https://ts-uploads.s3.amazonaws.com/training/production/13913/clights-c61e57.png
Preview:	.PNG........IHDR...\.................IDATx..w\|.......m........K.....P@.AE....".F.... ..j(..Wx.~......;..e.M6.z.x>fvw.;.3s.s.=....`..a..a..a......0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0...s.7....s.n.f1.1..0..0.....UJn:y...0..0..0,\.uD.A....a..a..a.z."W,_..0..0..p=...,%.a..a..a....+.z1..0..0........0..0..0,\,Z..b..a.{.....a..].n0,^..0.SZ........,b.......0..0..T9.)gbUZ...%.aX.X.JO....?v....0...'.r.P.U...a.b.rM..../.a..qSj....^....U..u.%....a..O.\|X.%.aX....z...^......0.G.X...a.*W.r...;X.......a..%.....a.r.p.E...G...a..%..aX.....rU^....0..h.p1.....HV^.{p.\|.p1.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65480)
Category:	downloaded
Size (bytes):	93435
Entropy (8bit):	5.372924511876392
Encrypted:	false
SSDEEP:	1536:bYUfBybwh3KRI83RExoulFXo7CkSsz/G0bSVze/3260eMSTC5bqYKKhwFvxizJSM:XIi3kIP9kSsgo/ZvxYrtPTKCNtHyUtCg
MD5:	0B6ECF17E30037994D3FFEE51B525914
SHA1:	D09D3A99ED25D0F1FBE6856DE9E14FFD33557256
SHA-256:	F554D2F09272C6F71447EBFE4532D3B1DD1959BCE669F9A5CCC99E64EF511729
SHA-512:	468C0F964014D76EC5966F5589B2CCC0A7B5F3E8A785134897DFA282A3E6824CE9A75584C9404B77A6962FEF99547356AABE8AA71A6499E2568B9DE792D90579
Malicious:	false
Reputation:	low
URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
Preview:	/! jQuery v1.8.2 jquery.com \| jquery.org/license /.(function(a,b){function G(a){var b=F[a]={};return p.each(a.split(s),function(a,c){b[c]=!0}),b}function J(a,c,d){if(d===b&&a.nodeType===1){var e="data-"+c.replace(I,"-$1").toLowerCase();d=a.getAttribute(e);if(typeof d=="string"){try{d=d==="true"?!0:d==="false"?!1:d==="null"?null:+d+""===d?+d:H.test(d)?p.parseJSON(d):d}catch(f){}p.data(a,c,d)}else d=b}return d}function K(a){var b;for(b in a){if(b==="data"&&p.isEmptyObject(a[b]))continue;if(b!=="toJSON")return!1}return!0}function ba(){return!1}function bb(){return!0}function bh(a){return!a\|\|!a.parentNode\|\|a.parentNode.nodeType===11}function bi(a,b){do a=a[b];while(a&&a.nodeType!==1);return a}function bj(a,b,c){b=b\|\|0;if(p.isFunction(b))return p.grep(a,function(a,d){var e=!!b.call(a,d,a);return e===c});if(b.nodeType)return p.grep(a,function(a,d){return a===b===c});if(typeof b=="string"){var d=p.grep(a,function(a){return a.nodeType===1});if(be.test(b))return p.filter(b,d,!c);b=p.filter(b,

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	926
Entropy (8bit):	7.650083871007416
Encrypted:	false
SSDEEP:	24:tbog9ogPw8Ex8DNf49VRoZTkP7dr8bHhFKklqN:tsg9ogPwR8Rf49++6hFlu
MD5:	3C506B80D78539262795C9BA59A0631A
SHA1:	0B7EF5BDEADE81C3FFC8ABC8EF8A17F7566A10F4
SHA-256:	A35DE3A30E58BF477FEBCA8B47225959F48FD384FAF088A218D6BF2251F06CBE
SHA-512:	AA04687DE6D0C6DF36B655891B055FA3BC22BF8A5619589CA012150B7F64036A5F21FF8EBBD6C604C6FBCBA686D1946AC23712EE052FFFEB163C16E29A9A23E6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0......,.....PLTE..............................`.......tRNS...........F.X...%IDATx^u.;o.W....:.4..vK:...%.0....v.. fG#v.vd^.v+E..s.K-...N..N..f.......G....]~/\|"V...ss..i......AF.(..G..q......3..=...0....2...E..._v.y......8..@..z..\.]3..+6..~...r.r.>R...............'=..W......NO........M#.,.]..67.c..A.......o..^..'H.b>....i.....C..(....\c....,....M..j:.M......9[ ..BY>...u....+mUD..d..n..E...F..{1.d.d%......FUUg..........E.<?h.......".......X.m->c....I...V..O9k.........f.yf#!.xn.N.......`.M._..<C.Z.>%.K!.J.........#q........W5.5..Dq...UX..&.3.1..<;.C.x'..S.N...........R......g......=...Ez.."=l.tNU.$...s.Z#..~.-..W.0.}"..W!Rr...V....@..5=........D..>.h3....J..^..]......%..2:R_.2U...M.Mp....."..1=.w..y....b?.0...jc.....d...K.Xh.z+.I...iH..?F#....E.d.P....7....u.C...@.{ip.j..n.]..gW...!.N..E.Z.M...M.@<.$..a.}..<.........HCW.b:s..j+....R...c5....IEND.B`.

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/assets/ajax/libs/jquery/1.9.1/jquery.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 78 x 34, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4105
Entropy (8bit):	7.895740575375788
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT6ushS1tpoVALlzJn:LSDS0tKg9E05T6u3eeLlzh
MD5:	6537C0A611DF91C8D5A7468AFCA9415D
SHA1:	E9CF86A3DA96568635D49AB86E7F0CE67AFD31DA
SHA-256:	E9517B723C091A844B7F0FF2547D4C5589E35CC1A4AB3D4E70875382CC7FD487
SHA-512:	BB8166362062A4B9B574664563618C7332D70699D5DD50DC138CE937C6CE69D6A0649F7BBD1E75DDA02D187743C3DA634691D16F58551C3BFA99E3E9382A0D2F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...N...".......<....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	8252
Entropy (8bit):	5.1582297598053986
Encrypted:	false
SSDEEP:	192:Rb76KYoJ2o7oggdhm4YdPPk347mtRwCw+:r7oggdhm42nkoCti+
MD5:	DFD4D77D86B22846150CC26FEDE0B829
SHA1:	2151BADFFBB2246C7AD436C4BBCDEFF80C1041D5
SHA-256:	F7F854F645C5B7B561DD19805C0E8AE7FF99F3E5EA0F7A9C235E8A65FD599F1F
SHA-512:	DD7ECA814FD2838BBB5F658C50875B5113FB01287849D75F12DFC7C9735C46E315E78C1B6B08C0D170D4428FA1EAF2EFA44DFC5D77833694C375A134ABA02E1A
Malicious:	false
Reputation:	low
URL:	https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	<!doctype html>.<html lang="en">.<head>.<meta charset="UTF-8" />.<title data-text="title">You have been Phished!</title>.<link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700" rel="stylesheet" type="text/css" />.<link href="https://tslp.s3.amazonaws.com/training/embedded/css/url.css" rel="stylesheet" type="text/css" />.<link href="https://tslp.s3.amazonaws.com/training/teachable_moments/css/langdrop.css" rel="stylesheet" type="text/css" />.<meta content="width=device-width, initial-scale=1" name="viewport" /> [if lt IE 9]>. <style type="text/css">. header .fish { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/fish.gif) no-repeat }. header .bubble { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble2.gif) no-repeat }. header .bubble:first-of-type { background: url(https://d25q7gseii1o1q.cloudfront.net/training/fish/bubble1.gif) no-repeat }. header .bubble:last-of-type { background: url(https://d25q7gs

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	8207
Entropy (8bit):	5.018706942766982
Encrypted:	false
SSDEEP:	192:2EGUIaSURSVa5ACV6o+3aQdCjxk3mIY2Wv:MpabC3XmX
MD5:	8B9A9D305BD69C962B600C08F3C69EDF
SHA1:	9A907E240CDF81D8265C9FB1322CFE10ED027288
SHA-256:	73F360F08E8C2A1719C098491E17D53CDAA98D246585BFD0285A2AFAD75C51A7
SHA-512:	813A8B088B07A36A02994D0EC09EBB1CCD3974BF88C617606F7BD9F632B32D1FBDBFE4C45A421BB17B6E8BDB0CFCD6D965D7CAEF6085CFA915E99B4D34CA5109
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/languages/language.18071.js
Preview:	jQuery.support.cors = true;..window.updatePage = function(language, data) {. var direction = data.dir \|\| "ltr";. var company_name = window.company_name \|\| "%COMPANY%";. var company_name_possessive = window.company_name_possessive \|\| "%COMPANY's%";.. $("#module-container" ).css({. "font-size": data.fontsize,. "line-height": data.lineheight. });. $("#module-container").attr("class", "ict-" + language);. $("#module-container").attr("dir", direction);.. var replacements = data.replacements \|\| data;. $.each( replacements, function( key, val ) {. var data_key = "*[data-text='"+ key + "']";. if ( $(data_key) ) {. $(data_key).not('input').html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. $(data_key).html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. if (direction == "rtl") {. $(data_key).attr("ali

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4234
Entropy (8bit):	3.7012321814825753
Encrypted:	false
SSDEEP:	96:so5y9P80AbkhE5SoO6Dn5pqQ1cQp4oVNl0yKAiyC:soc9P80AI6SoOw5pqQPTl0yKAiyC
MD5:	E6DD596D2BC204EA573B868B92028C26
SHA1:	FA58BBA4C9A01B3764A881949A8423B773D8A338
SHA-256:	0730A7E6770925FA4232096E4D9874514985EC791A63FE873F0E4E3CD7722381
SHA-512:	4857A83D1F1AC1127A578B2BDE94973BCE3ECD2720CBC4D72DDF8CB193F0F3676BF932D0352F0F45CA3A553677D3960A61B472CA15C66E74F3E6384E36E018B4
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Silverlight ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = window.detector;. var h = {. getVersion: function() {. var r = this,. p = null,. q = 0;. if ((!q \|\| j.dbug) && r.nav.query().installed) {. q = 1. }. if ((!p \|\| j.dbug) && r.nav.query().version) {. p = r.nav.version. }. if ((!q \|\| j.dbug) && r.axo.query().installed) {. q = 1. }. if ((!p \|\| j.dbug) && r.axo.query().version) {. p = r.axo.version. }. r.version = j.formatNum(p);. r.installed = p ? 1 : (q ? 0 : -1). },. nav: {. hasRun: 0,. installed: 0,. version: null,. mimeType: ["application/x-silverlight", "application/x-silve

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22855
Entropy (8bit):	3.5177544592160155
Encrypted:	false
SSDEEP:	384:WKFsDSEYnCMA1gNNwbV2RG0WomPqbTLJkrU2LOp1rD:xsGbnCZ1gNN7Y73P+TtkrU2iP
MD5:	0D5882D41C8B6E40059C8D9ACBCF1518
SHA1:	53103565F3C07416FC691583A43A91943DBF0809
SHA-256:	D9B7C6163477008469AF64B211E2DBD4F4171B85B51E3714F11C99F9BA2C32F9
SHA-512:	2E70A43F053797DF07CF2A7F6CF4CDD99A0082CB3DC1FBF661FAB775E98EDC18866FC762576B9E26A9DF4C094523AF98D7B46C92F9D6A7BED2CBFE6CBA01447E
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ AdobeReader PDFjs ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX ]./.(function() {. j = PluginDetect;. var c = {. OTF: null,. setPluginStatus: function() {. var p = this,. B = p.OTF,. v = p.nav.detected,. x = p.nav.version,. z = p.nav.precision,. C = z,. u = x,. s = v > 0;. var H = p.axo.detected,. r = p.axo.version,. w = p.axo.precision,. D = p.doc.detected,. G = p.doc.version,. t = p.doc.precision,. E = p.doc2.detected,. F = p.doc2.version,. y = p.doc2.precision;. u = F \|\| u \|\| r \|\| G;. C = y \|\| C \|\| w \|\| t;. s = E > 0 \|\| s \|\| H > 0 \|\| D > 0;. u = u \|\| null;. p.version =

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (322)
Category:	dropped
Size (bytes):	6999
Entropy (8bit):	3.826075419802806
Encrypted:	false
SSDEEP:	192:s3gnyGXyCBzNOxSyiWyiZMPQsh1jayiSiy0r:luQcr
MD5:	EE73F2F47D51116DC40B85A6B57EAF20
SHA1:	6C42011667BAC1FA6C3272A11B510F22962D72A2
SHA-256:	6AE53963F41133561C78B4332B564C01F551C471CD91D980436A9F5DACDD8F19
SHA-512:	162F426E8C5787B989C07332EC466A68F97164400EE09562B925D3B4FE34D4BF393214C8A173174F22B0A47F635A0864D81D9E1BD3CB8D73DA4335A3F715A37D
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ QuickTime ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var i = {. setPluginStatus: function(q, p, s) {. var r = this;. r.version = p ? j.formatNum(p, 3) : null;. r.installed = r.version ? 1 : (s ? (s > 0 ? 0.7 : -0.1) : (q ? 0 : -1));. r.getVersionDone = r.installed == 0.7 \|\| r.installed == -0.1 \|\| r.nav.done === 0 ? 0 : 1;. },. getVersion: function(s, t) {. var u = this,. p = null,. r = 0,. q;. t = j.browser.isIE ? 0 : t;. if ((!r \|\| j.dbug) && u.nav.query(t).installed) {. r = 1. }. if ((!p \|\| j.dbug) && u.nav.query(t).version) {. p = u.nav.version. }. q = !p ? u.codebase.isMin(s) : 0;. if (q) {. u.setPluginStat

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	50717
Entropy (8bit):	3.4749180527505756
Encrypted:	false
SSDEEP:	384:6W11SeWPZO6Tw2jzKHjNQuFoDAkuo6Gkt2NftdIvS/G:66SeWPZVhjzKHjquFoQrtm1dIvcG
MD5:	2BEC0061039DC3FB25FC20AAF611D5B9
SHA1:	DFC11B0662AC5950D309E2615E887032DD1DDE0C
SHA-256:	4805FC6ABDAD8075AF2165E241B781C3073D4769AE725E4004BF79064ACB5F24
SHA-512:	A0B342EED3291E1E48E5DBECBBBE74370D06C15269196B5E5CFEC1EE58B401D5F24058E842222747B5144DC4902852B417EC3DC37A8799FD451C875C584AD8DF
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Java ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var a = {. Property_names: [],. Property_values: [],. Property_values_lock: [],. JAVATOJSBRIDGE: 0,. JSTOJAVABRIDGE: 1,. mimeType: ["application/x-java-applet", "application/x-java-vm", "application/x-java-bean"],. mimeType_dummy: "application/dummymimejavaapplet",. classID: "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93",. classID_dummy: "clsid:8AD9C840-044E-11D1-B3E9-BA9876543210",. navigator: {. init: function() {. var q = this,. p = a;. q.mimeObj = j.hasMimeType(p.mimeType);. if (q.mimeObj) {. q.pluginObj = q.mimeObj.enabledPlugin. }. },. a: (function() {. try {.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 860 x 227, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	52551
Entropy (8bit):	7.9651205853074165
Encrypted:	false
SSDEEP:	768:Hyck1qsYP5rdDzwmaxuyCaU1O5yrAl/dMDZnYKaA2RYG/sxCDDhJgBkWSBMNsZu:V/rdzwmaWO4AN+NfT2OGekdSnqE
MD5:	4355E91ABDDBB81C9E7450FF38D049CF
SHA1:	AAB51083E61C56250272B4E1D6ACF7ADA92AEFB3
SHA-256:	F8D5F9151D03E67C1496D8ECC667FC9E64E48420A16678AF75CA2A8F5D616DEB
SHA-512:	71462D039E971DF37931708C84BF27DB0BBDF28E042FE4718F10A56A2E41E186111D8DEA2F979FD83D3E11047AEC15EF88A977AAC8DDC9215E3492067BE22336
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...\.................IDATx..w\|.......m........K.....P@.AE....".F.... ..j(..Wx.~......;..e.M6.z.x>fvw.;.3s.s.=....`..a..a..a......0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0....0..0..0..p1..0..0..p1..0..0..p1..0..0..0,\..0..0..0,\..0..0..0,\..0..0..0....0..0..0....0..0..0...s.7....s.n.f1.1..0..0.....UJn:y...0..0..0,\.uD.A....a..a..a.z."W,_..0..0..p=...,%.a..a..a....+.z1..0..0........0..0..0,\,Z..b..a.{.....a..].n0,^..0.SZ........,b.......0..0..T9.)gbUZ...%.aX.X.JO....?v....0...'.r.P.U...a.b.rM..../.a..qSj....^....U..u.%....a..O.\|X.%.aX....z...^......0.G.X...a.*W.r...;X.......a..%.....a.r.p.E...G...a..%..aX.....rU^....0..h.p1.....HV^.{p.\|.p1.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6680
Entropy (8bit):	3.6986423324780655
Encrypted:	false
SSDEEP:	192:szfwSCu89PUlb1h3U3ZY8SsbAdJO3NyiSiYPDPM9bUaX09+EQ:i7r36D09+n
MD5:	F9AD9A096894BA248E4A1F73E7EBA1BE
SHA1:	F2449CE5F7A5C42FFDCC5F087A75B2513E73592C
SHA-256:	A26D01D5912459798481786640DC44FD7605D09F2F9E6DD24720205EFCAB6861
SHA-512:	230C6B3F64BAD4A1681A90CD835FD2037068AD951D1BFB027E2B90F832C074D0AF686D2AA51175BE538BFAE9A08D96E9D46C941AEF223567937E0CD280B76DD4
Malicious:	false
Reputation:	low
URL:	https://tslp.s3.amazonaws.com/detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Flash ].[ isMinVersion getVersion hasMimeType getInfo ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var e = {. mimeType: "application/x-shockwave-flash",. setPluginStatus: function(t, q, p) {. var s = this,. r;. s.installed = q ? 1 : (t ? 0 : -1);. s.precision = p;. s.version = j.formatNum(q);. r = s.installed == -1 \|\| s.instance.version;. r = r \|\| s.axo.version;. s.getVersionDone = r ? 1 : 0;. },. getPrecision: function(t) {. if (j.isString(t)) {. var q, s = "\\d+",. r = "[\\._,]",. p = [s, s, s, s];. for (q = 4; q > 0; q--) {. if ((new RegExp(p.slice(0, q).join(r))).test(t)) {. return q. }. }. }. return 0.

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8207
Entropy (8bit):	5.018706942766982
Encrypted:	false
SSDEEP:	192:2EGUIaSURSVa5ACV6o+3aQdCjxk3mIY2Wv:MpabC3XmX
MD5:	8B9A9D305BD69C962B600C08F3C69EDF
SHA1:	9A907E240CDF81D8265C9FB1322CFE10ED027288
SHA-256:	73F360F08E8C2A1719C098491E17D53CDAA98D246585BFD0285A2AFAD75C51A7
SHA-512:	813A8B088B07A36A02994D0EC09EBB1CCD3974BF88C617606F7BD9F632B32D1FBDBFE4C45A421BB17B6E8BDB0CFCD6D965D7CAEF6085CFA915E99B4D34CA5109
Malicious:	false
Reputation:	low
Preview:	jQuery.support.cors = true;..window.updatePage = function(language, data) {. var direction = data.dir \|\| "ltr";. var company_name = window.company_name \|\| "%COMPANY%";. var company_name_possessive = window.company_name_possessive \|\| "%COMPANY's%";.. $("#module-container" ).css({. "font-size": data.fontsize,. "line-height": data.lineheight. });. $("#module-container").attr("class", "ict-" + language);. $("#module-container").attr("dir", direction);.. var replacements = data.replacements \|\| data;. $.each( replacements, function( key, val ) {. var data_key = "*[data-text='"+ key + "']";. if ( $(data_key) ) {. $(data_key).not('input').html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. $(data_key).html(val.replace(/%COMPANY%/g,company_name).replace(/%COMPANY_POSSESSIVE%/g,company_name_possessive)).attr("dir", direction);. if (direction == "rtl") {. $(data_key).attr("ali

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	50717
Entropy (8bit):	3.4749180527505756
Encrypted:	false
SSDEEP:	384:6W11SeWPZO6Tw2jzKHjNQuFoDAkuo6Gkt2NftdIvS/G:66SeWPZVhjzKHjquFoQrtm1dIvcG
MD5:	2BEC0061039DC3FB25FC20AAF611D5B9
SHA1:	DFC11B0662AC5950D309E2615E887032DD1DDE0C
SHA-256:	4805FC6ABDAD8075AF2165E241B781C3073D4769AE725E4004BF79064ACB5F24
SHA-512:	A0B342EED3291E1E48E5DBECBBBE74370D06C15269196B5E5CFEC1EE58B401D5F24058E842222747B5144DC4902852B417EC3DC37A8799FD451C875C584AD8DF
Malicious:	false
Reputation:	low
Preview:	/.PluginDetect v0.9.1.www.pinlady.net/PluginDetect/license/.[ Java ].[ isMinVersion getVersion hasMimeType getInfo onDetectionDone ].[ AllowActiveX BetterIE ]./.(function() {. j = PluginDetect;. var a = {. Property_names: [],. Property_values: [],. Property_values_lock: [],. JAVATOJSBRIDGE: 0,. JSTOJAVABRIDGE: 1,. mimeType: ["application/x-java-applet", "application/x-java-vm", "application/x-java-bean"],. mimeType_dummy: "application/dummymimejavaapplet",. classID: "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93",. classID_dummy: "clsid:8AD9C840-044E-11D1-B3E9-BA9876543210",. navigator: {. init: function() {. var q = this,. p = a;. q.mimeObj = j.hasMimeType(p.mimeType);. if (q.mimeObj) {. q.pluginObj = q.mimeObj.enabledPlugin. }. },. a: (function() {. try {.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 20:02:40.608104944 CET	49674	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:40.608105898 CET	49675	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:40.717456102 CET	49673	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:50.221133947 CET	49674	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:50.221133947 CET	49675	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:50.330512047 CET	49673	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:51.452013016 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:51.452039957 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:51.452214003 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:51.452352047 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:51.452363014 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:51.987447023 CET	443	49703	23.1.237.91	192.168.2.5
Jan 7, 2025 20:02:51.987550974 CET	49703	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:02:52.095091105 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:52.095455885 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:52.095467091 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:52.096399069 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:52.096461058 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:52.097687006 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:52.097755909 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:52.142468929 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:52.142476082 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:02:52.189333916 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:02:52.934052944 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.934103966 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:52.934235096 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.934510946 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.934528112 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:52.934583902 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.934813023 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.934828997 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:52.935053110 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:52.935064077 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.590034962 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.590348005 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.590373039 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.591253042 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.591310024 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.591324091 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.591367960 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.595900059 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.595957994 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.596120119 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.596132994 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.608295918 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.608513117 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.608520985 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.609400988 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.609482050 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.609487057 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.609538078 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.609786034 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.609838009 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.646060944 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.661154985 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.661161900 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.707824945 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.719636917 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.719655037 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.719713926 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.719723940 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.719734907 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.719777107 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.721556902 CET	49714	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:53.721570015 CET	443	49714	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:53.768898010 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.768944979 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769047022 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769056082 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769071102 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769156933 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769165039 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769202948 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769212008 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769296885 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769304037 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769375086 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769427061 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769459963 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769537926 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769582033 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769594908 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769629002 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769798994 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769814968 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.769933939 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.769948006 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.770056009 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.770068884 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.770217896 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.770227909 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.770303965 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.770324945 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.770427942 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:53.770438910 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:53.799957037 CET	49723	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:53.804795027 CET	49153	49723	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:53.804855108 CET	49723	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:53.805033922 CET	49723	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:53.810108900 CET	49153	49723	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:54.323201895 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.323447943 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.323474884 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.324492931 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.324583054 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.325467110 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.325711966 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.325792074 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.325921059 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.325947046 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.326039076 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.326054096 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.327445030 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.327517033 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.328454018 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.328532934 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.328690052 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.328696966 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.340555906 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.340769053 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.340785980 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.341080904 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.341272116 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.341291904 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.341819048 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.341871977 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342181921 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342242002 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.342303038 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.342304945 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342312098 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.342354059 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342644930 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342704058 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.342757940 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.342763901 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.352624893 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.352847099 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.352863073 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.353859901 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.353918076 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.354245901 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.354301929 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.354361057 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.354367971 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.366961956 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.382858038 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.382874012 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.382878065 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.398171902 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.449055910 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.449804068 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451005936 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451014042 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451025009 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451066017 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.451075077 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451082945 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.451117992 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.451158047 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.457079887 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457093000 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457114935 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457124949 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457132101 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457142115 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.457163095 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457175970 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.457205057 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.457209110 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.457262993 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.458956003 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.459391117 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.459422112 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.459534883 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.459804058 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.459816933 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.467755079 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.467900038 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.467942953 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.467953920 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.467956066 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.467997074 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.468440056 CET	49717	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.468453884 CET	443	49717	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.469949961 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.469981909 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.470180035 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.470406055 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.470417976 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.476128101 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.477478027 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.477485895 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.477540970 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.477550030 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.491363049 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.491630077 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.491671085 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.491681099 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.491683006 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.491734982 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.492160082 CET	49719	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.492170095 CET	443	49719	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.495289087 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.495325089 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.495393038 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.495806932 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.495820045 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.495881081 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.496005058 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.496011972 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.496073961 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.496324062 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.496339083 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.496498108 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.496509075 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.496632099 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.496644020 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.499330044 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.522794008 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.537451982 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.537476063 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.537519932 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.537529945 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.537540913 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.537570000 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.538476944 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.538501978 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.538536072 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.538546085 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.538561106 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.538573980 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.538593054 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.539043903 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.539077044 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.539102077 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.539119959 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.539160013 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.539833069 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.539892912 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.539896965 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.539937019 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.540070057 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.540107965 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.540132999 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.540137053 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.540169954 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.540537119 CET	49721	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.540549040 CET	443	49721	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.543965101 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.544028044 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.544032097 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.544047117 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.544090033 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.553631067 CET	49718	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.553642035 CET	443	49718	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.563611031 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.563649893 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.563713074 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.564002037 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.564012051 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.565171957 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.565182924 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.565407038 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.565568924 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.565582037 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.567193985 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.567203999 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.567235947 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.567262888 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.567276001 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.567277908 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.567333937 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.567740917 CET	49720	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:54.567753077 CET	443	49720	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:54.571077108 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.571085930 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.571176052 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.571283102 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571304083 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571321964 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571336031 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571347952 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.571350098 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571357965 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571372986 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.571388960 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:54.571389914 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.571398973 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:54.571410894 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.655631065 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.655638933 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.655669928 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.655705929 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.655720949 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.655752897 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.655772924 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.657486916 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.657504082 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.657557011 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.657567978 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.657596111 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.657614946 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.747845888 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.747864962 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.747944117 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.747960091 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.748006105 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.749125957 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.749142885 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.749460936 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.749466896 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.749536991 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.750073910 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.750112057 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.750140905 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.750145912 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.750155926 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.750176907 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.750202894 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.751353025 CET	49715	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.751363993 CET	443	49715	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.793957949 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:54.793982029 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:54.794049025 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:54.794218063 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:54.794226885 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:54.934660912 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.937706947 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.937726974 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.938117981 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.942312956 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.942379951 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:54.942486048 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:54.987333059 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.022136927 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.030359030 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.030371904 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.030693054 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.047872066 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.049721956 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.055234909 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.055304050 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.055365086 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.055377960 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.055459976 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.055468082 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.055561066 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.055752993 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.056040049 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.056094885 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.056108952 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.056265116 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.056339979 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.057450056 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.057502985 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.057538033 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.066903114 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.074867964 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.074876070 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.075762987 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.075825930 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.076512098 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.076565981 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.076620102 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.099325895 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.103072882 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.103072882 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.103080988 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.103091002 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.116950035 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.117177010 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.117187977 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.117969990 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.117976904 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.121036053 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.121104002 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.121397018 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.121490002 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.121567965 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.130971909 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.130990982 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.131004095 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.131047964 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.131059885 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.131093025 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.131114006 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.132360935 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.132394075 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.132412910 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.132426977 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.132472992 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.133090019 CET	49724	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:02:55.133104086 CET	443	49724	54.175.8.220	192.168.2.5
Jan 7, 2025 20:02:55.135627985 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.135814905 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.135823011 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.136796951 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.136863947 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.137309074 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.137375116 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.137447119 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.138211012 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.138226986 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.138295889 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.138474941 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.138487101 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.143871069 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.155744076 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.155982018 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.155992031 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.156960011 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.157021999 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.157402992 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.157457113 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.157506943 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.157515049 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.159241915 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.174693108 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.174700975 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.176758051 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.177668095 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.177714109 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.177723885 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.177732944 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.177779913 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.177957058 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.177985907 CET	443	49725	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.178036928 CET	49725	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.180675983 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.180800915 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.181236982 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.181267977 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.181279898 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.181325912 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.181328058 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.181349039 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.181385994 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.181562901 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.181565046 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.181571960 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.181581020 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.181615114 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.181637049 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.181670904 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.182178020 CET	49727	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.182185888 CET	443	49727	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.183008909 CET	49726	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:02:55.183013916 CET	443	49726	3.5.25.233	192.168.2.5
Jan 7, 2025 20:02:55.183329105 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.187355995 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.187381029 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.187447071 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.187609911 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.187624931 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.191416979 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.191422939 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.203485966 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.203598022 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.203607082 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.203655005 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.203656912 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.203699112 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.205899954 CET	49728	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.205904961 CET	443	49728	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.206676960 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.221700907 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.240056038 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.247553110 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249300003 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249324083 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249356031 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249386072 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.249401093 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249427080 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249449015 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249458075 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.249468088 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249476910 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.249495983 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.249496937 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.249514103 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.266787052 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268871069 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268877983 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268906116 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268918037 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268930912 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268934011 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.268949032 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268970013 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.268987894 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.269011021 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.271723032 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.271799088 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.283431053 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.291405916 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.291415930 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.291470051 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.291476965 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.299264908 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.299272060 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.331976891 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.336313009 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336344957 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336359978 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336380005 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.336381912 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336416960 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336419106 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.336433887 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336435080 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.336467028 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.336488008 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.337970972 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.337990999 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338027000 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.338052988 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338088989 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.338093042 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338105917 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.338119984 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338156939 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.338232040 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338287115 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.338294983 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338401079 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.338454008 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.339061975 CET	49729	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.339075089 CET	443	49729	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.355578899 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.355593920 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.355624914 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.355678082 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.355688095 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.355711937 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.356220007 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.356251001 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.356273890 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.356281042 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.356319904 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.357054949 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.357120991 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.357124090 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.357172012 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.357379913 CET	49730	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.357384920 CET	443	49730	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.388937950 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.388951063 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.388976097 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.388987064 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.388998985 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.389000893 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.389039040 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.389046907 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.389225960 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.389282942 CET	49731	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.389292002 CET	443	49731	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.460350990 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.460540056 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.460549116 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.461550951 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.461625099 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.461643934 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.461709023 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.461941004 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.461996078 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.462101936 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.462112904 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.502969980 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.568308115 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.568331957 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.568339109 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.568353891 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.568388939 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.568406105 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.568418980 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.569560051 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.569560051 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.662615061 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.662636042 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.662717104 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.662728071 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.662775040 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.680963039 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.680983067 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.681045055 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.681051970 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.681099892 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.748142004 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.748164892 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.748364925 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.748370886 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.748431921 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.749603987 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.749620914 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.749679089 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.749685049 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.749735117 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.750519991 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.750560045 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.750581980 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.750586987 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.750597000 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.750617981 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.750642061 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.750917912 CET	49733	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.750931025 CET	443	49733	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.766585112 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.768811941 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.768826008 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.769208908 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.769491911 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.769609928 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.769676924 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.769823074 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.769849062 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.769982100 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.770138979 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.770452023 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.770510912 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.770554066 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.811326027 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.811328888 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.816144943 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.840459108 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.841528893 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.841542959 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.842556000 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.842621088 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.842628002 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.845551014 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.845993042 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.846049070 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.846153021 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.846164942 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.894020081 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.896167040 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.896961927 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.896996021 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.897006989 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.897034883 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.897068977 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.897267103 CET	49735	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.897277117 CET	443	49735	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.914087057 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.914282084 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.914325953 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.914343119 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.914395094 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.919421911 CET	49736	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:02:55.919436932 CET	443	49736	16.15.178.1	192.168.2.5
Jan 7, 2025 20:02:55.952752113 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.952771902 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.952779055 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.952833891 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:55.952846050 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.952856064 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:55.952905893 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:56.033711910 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:56.033792019 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:02:56.033803940 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:56.033958912 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:56.034286022 CET	49734	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:02:56.034301996 CET	443	49734	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:02.011650085 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:02.011709929 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:02.011801958 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:02.475361109 CET	49703	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:02.475672960 CET	49703	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:02.476075888 CET	49744	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:02.476124048 CET	443	49744	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:02.476207018 CET	49744	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:02.476466894 CET	49744	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:02.476481915 CET	443	49744	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:02.480199099 CET	443	49703	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:02.480520010 CET	443	49703	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:03.064367056 CET	443	49744	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:03.064455986 CET	49744	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:03.399679899 CET	49711	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:03.399703026 CET	443	49711	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:13.733153105 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.733186960 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.733234882 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.733273029 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.733315945 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.819922924 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.821391106 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.821435928 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.821563959 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.821568966 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.952214956 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.952253103 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.952296972 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.952316046 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.952358007 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.952675104 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:13.952711105 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:13.958389997 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:13.958427906 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:13.958475113 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:13.958690882 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:13.958705902 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:13.996084929 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:13.996129990 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:13.996205091 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:13.996483088 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:13.996496916 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.010236025 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.010251999 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.010302067 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.010585070 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.010598898 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.010649920 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.010776043 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.010787010 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.011063099 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011094093 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.011143923 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011204958 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011219978 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.011565924 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011595011 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.011646032 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011980057 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.011989117 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.012037039 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.012160063 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.012171984 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.012290001 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.012305975 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.012418032 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.012425900 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.459528923 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.459806919 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.459840059 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.460179090 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.460453033 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.460524082 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.460601091 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.460637093 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.460666895 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.473644018 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.473870039 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.473891973 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.474900961 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.474972010 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.474980116 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.475025892 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.475275993 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.475337982 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.475395918 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.475409031 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.477498055 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.477683067 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.477694988 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.478585005 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.478672028 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.478678942 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.478710890 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.478929996 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.478979111 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.479048014 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.479058027 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.491525888 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.491697073 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.491704941 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.491739988 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.491883039 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.491919041 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.492573023 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.492619991 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.492624044 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.492654085 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.492796898 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.492841959 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.492855072 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.492886066 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.493148088 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.493200064 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.493477106 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.493527889 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.493614912 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.493632078 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.493736029 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.493745089 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.498291969 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.498493910 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.498502970 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.498817921 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.499103069 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.499152899 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.499196053 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.522840977 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.522885084 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.530124903 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.530307055 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.530316114 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.530600071 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.530843973 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.530894041 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.530924082 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.538630962 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.538631916 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.539324999 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.571326971 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.575144053 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.575319052 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.575378895 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.575548887 CET	49805	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.575567961 CET	443	49805	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.577547073 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.577579975 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.577650070 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.577785969 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.577797890 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.579622030 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.579642057 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.579710007 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.579869032 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.579879999 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.582506895 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.582551003 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.582603931 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.582967997 CET	49809	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.582977057 CET	443	49809	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.585305929 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.585330009 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.585400105 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.585640907 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.585701942 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.585737944 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.585792065 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.585867882 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.585880041 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.585988045 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.586000919 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.586663961 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.586709976 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.586766005 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.587075949 CET	49810	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.587090015 CET	443	49810	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.588309050 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.588318110 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.588376999 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.588521004 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.588532925 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.589627981 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.589633942 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.589699030 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.589884996 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.589895010 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.604871035 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.605402946 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.605460882 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.605554104 CET	49808	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.605559111 CET	443	49808	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.605984926 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.606038094 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.606086016 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.606703043 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.606712103 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.606762886 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.606992960 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.607004881 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.607234001 CET	49807	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.607251883 CET	443	49807	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.608580112 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.608618021 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.608683109 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.609051943 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.609064102 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.609113932 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.609277964 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.609292030 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.609678030 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.609692097 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.609983921 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.610007048 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.610049963 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.610250950 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.610260963 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.618108034 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.619131088 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.619193077 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.619257927 CET	49806	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.619266987 CET	443	49806	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.620820045 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.620832920 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.620884895 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.621135950 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:14.621145964 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:14.622176886 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.622193098 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.622250080 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.622426987 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:14.622438908 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:14.662353039 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.663144112 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.663151026 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.663199902 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:14.663227081 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.663263083 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.663463116 CET	49803	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:14.663470984 CET	443	49803	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:15.041848898 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.042120934 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.042145014 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.042514086 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.042829990 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.042893887 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.042944908 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.066957951 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.067187071 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.067212105 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.067537069 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.067826033 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.067878008 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.067929983 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.077398062 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.077569962 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.077579975 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.078471899 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.078537941 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.078543901 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.078584909 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.078852892 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.078905106 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.078943014 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.083329916 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.087810040 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.088011026 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.088027000 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.089070082 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.089132071 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.089138985 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.089180946 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.089437962 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.089504957 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.089546919 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.089710951 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.089864969 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.089893103 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.090307951 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.090472937 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.090486050 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.090902090 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.090959072 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.090977907 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.091025114 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091226101 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091284990 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.091325998 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091424942 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.091480017 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091487885 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.091521025 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091739893 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.091799021 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.091811895 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.115331888 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.119335890 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.129447937 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.129447937 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.129456997 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.129460096 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.139329910 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.139343023 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.144751072 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.144753933 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.144758940 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.144774914 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.148823023 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.148838043 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.148884058 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.148886919 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.148925066 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.149554968 CET	49814	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.149565935 CET	443	49814	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.175398111 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.175399065 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.180275917 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.180346966 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.180394888 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.180835962 CET	49816	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.180851936 CET	443	49816	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.191186905 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.191493988 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.192112923 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.192156076 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.192209959 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.192590952 CET	49818	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.192596912 CET	443	49818	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.196713924 CET	49153	49723	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.196779966 CET	49723	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.196923971 CET	49723	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.197217941 CET	49829	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.197258949 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.197304964 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.197350979 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.197712898 CET	49824	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.197726965 CET	443	49824	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.201630116 CET	49153	49723	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.201989889 CET	49153	49829	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.202055931 CET	49829	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.202300072 CET	49829	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.202887058 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.202995062 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.203042984 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.203115940 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.203202009 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.203246117 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.203401089 CET	49821	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.203413963 CET	443	49821	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.204307079 CET	49822	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:15.204324961 CET	443	49822	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.207032919 CET	49153	49829	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:15.234232903 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.234440088 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.234447956 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.234801054 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.235088110 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.235145092 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.235189915 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.251353025 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.251568079 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.251588106 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.252574921 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.252645969 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.252654076 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.252695084 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.252970934 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.253030062 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.253062963 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.258358955 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.258392096 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.258534908 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.258546114 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.258629084 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.258636951 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.259907007 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.259910107 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.259974957 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.259975910 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.259982109 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.259983063 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.260025024 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260029078 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260250092 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260308981 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.260499001 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260560989 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.260612011 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260624886 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.260653973 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.260669947 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.274069071 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.274244070 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.274251938 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.274636030 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.274905920 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.274962902 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.274996042 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.279330015 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.297234058 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.297434092 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.297445059 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.298319101 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.298377037 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.298382998 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.298424006 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.298634052 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.298682928 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.298767090 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.298777103 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.299334049 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.302002907 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.302004099 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.302011967 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.302038908 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.318094969 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.318106890 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.349128008 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.349128962 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.350707054 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.350725889 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.350790024 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.350797892 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.350811958 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.350853920 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.351746082 CET	49813	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.351758003 CET	443	49813	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.352181911 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.352222919 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.352279902 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.354636908 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.354650974 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.355026960 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.355129957 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.355176926 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.356921911 CET	49819	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.356935978 CET	443	49819	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.360183001 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.360234022 CET	443	49820	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.360284090 CET	49820	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.370188951 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.370260000 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.370306969 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.370515108 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.370521069 CET	443	49817	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.370533943 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.370560884 CET	49817	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.373790026 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.373843908 CET	443	49815	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.373893976 CET	49815	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.374185085 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.374248028 CET	443	49823	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.374300003 CET	49823	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.382055998 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.382076979 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.382133961 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.382411003 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.382440090 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.382486105 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.383276939 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.383296013 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.383351088 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.383690119 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.383707047 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.383766890 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.384120941 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.384140015 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.384192944 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.384727001 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.384742975 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.385021925 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.385031939 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.385210991 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.385227919 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.385479927 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.385493040 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.385679960 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.385691881 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.386020899 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.386037111 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.501254082 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.501400948 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.501419067 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.501466990 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.501477957 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.501521111 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.502747059 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.502751112 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.617810011 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.617913961 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.619405985 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.619415045 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.736614943 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.736844063 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.736857891 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.736882925 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.736913919 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.736946106 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.737003088 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.737407923 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.782408953 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.782439947 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.815052986 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.817893982 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.817914963 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.818316936 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.819144964 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.819207907 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.819334984 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.832009077 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.832036018 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.833923101 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.833930016 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.836401939 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.836436033 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:15.836507082 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.836677074 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.836694956 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:15.848334074 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.848745108 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.848769903 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.849807024 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.849872112 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.849881887 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.849925995 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.850174904 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.850229979 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.850291014 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.850306034 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.852097034 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.852252960 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.852271080 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.853250027 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.853305101 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.853312016 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.853347063 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.853576899 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.853626966 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.863343954 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.893029928 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.893037081 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:15.901273012 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.938775063 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:15.939693928 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.942667961 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.942681074 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.943592072 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.943650961 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.943979025 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.944035053 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.954735994 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.961528063 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.961579084 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:15.961658001 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.961844921 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:15.961858988 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:15.968153000 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.968192101 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.968344927 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.968374968 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.968446016 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.968456030 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.968725920 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.969021082 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.969083071 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.969685078 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.969966888 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.970196962 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.970287085 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.986865044 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:15.986872911 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:15.999954939 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.013664961 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.013685942 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.013699055 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.013767004 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.013794899 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.013814926 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.013855934 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.014870882 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.014890909 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.014977932 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.014986038 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.015026093 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.018682957 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.018690109 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.018711090 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.034054041 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.041529894 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041547060 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041553974 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041563988 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041589022 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041605949 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.041632891 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.041661024 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.041671038 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.042347908 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.042381048 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.042402983 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.042409897 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.042423010 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.042431116 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.042479992 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.058346987 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.100846052 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.100868940 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.100970984 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.101000071 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.101067066 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.101201057 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.101214886 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.101253986 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.101262093 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.101285934 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.101305008 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.103055954 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.103070021 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.103140116 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.103151083 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.103190899 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.187927961 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.188024044 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.188190937 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.193850040 CET	49835	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.193867922 CET	443	49835	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.205044985 CET	49830	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.205065012 CET	443	49830	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.212035894 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.212043047 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.212095976 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.212310076 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.212322950 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.213465929 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.213491917 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.213551044 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.213783979 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.213799000 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.379415989 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.379451990 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.407565117 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.407779932 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.407790899 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.408096075 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.408924103 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.409010887 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.409284115 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:16.409307957 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:16.409363985 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:16.409660101 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:16.409671068 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:16.409734964 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.455328941 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.494968891 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.495027065 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.495069981 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.495213032 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.495424986 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.495481014 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.495495081 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.499306917 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.499347925 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.499413013 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.499634027 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.499646902 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.513768911 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.513957024 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.513972998 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.514281988 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.514683962 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.514744043 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.514867067 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.536487103 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.542840958 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.543209076 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.543263912 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.543266058 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.543309927 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.543562889 CET	49842	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.543579102 CET	443	49842	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.555330038 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.571844101 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.572590113 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.572628975 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.572686911 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.572994947 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.573003054 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.573050976 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.573157072 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.573169947 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.573286057 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.573296070 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.578128099 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.578138113 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.578186989 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.578336000 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:16.578351021 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:16.583468914 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.583477974 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.583533049 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.583693027 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.583704948 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.609723091 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.609743118 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.609790087 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.612318039 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.612349987 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.612420082 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.613368988 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.613380909 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.613998890 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.614012003 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.619330883 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.636790991 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.636946917 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.636991024 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.637691975 CET	49843	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:16.637701035 CET	443	49843	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:16.683125019 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.683211088 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.683257103 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.683758974 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.684129000 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.684175014 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.684567928 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.685535908 CET	49832	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.685550928 CET	443	49832	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.686150074 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.686192036 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.686249018 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.687747955 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.687839031 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.688662052 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:16.688677073 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:16.689850092 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.691024065 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.691250086 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.691263914 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.691596985 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.713700056 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.713777065 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.714148998 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.715713024 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.715724945 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.715786934 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.715939999 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.715951920 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.735337019 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.755337000 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.879542112 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.879569054 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.879584074 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.879661083 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.879692078 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.879749060 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.880908012 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.880947113 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.880986929 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.880986929 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.881009102 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.881030083 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.881267071 CET	49846	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.881282091 CET	443	49846	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.908782005 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.908802032 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.908813953 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.908874989 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.908885002 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.908925056 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.910399914 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.910413980 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.910476923 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.910481930 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.910522938 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.999382973 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.999403954 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.999491930 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:16.999501944 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:16.999541998 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.000590086 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.000602961 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.000659943 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.000667095 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.000703096 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.002249956 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.002263069 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.002326965 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.002336979 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.002370119 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.003184080 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.003217936 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.003249884 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.003252983 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.003292084 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.013890028 CET	49845	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.013896942 CET	443	49845	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.047911882 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.048135042 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.048145056 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.048444986 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.049063921 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.049114943 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.049207926 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.051225901 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.051419973 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.051441908 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.051826954 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.052093029 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.052166939 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.052200079 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.066843987 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.067101955 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.067111969 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.067692041 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068109989 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.068118095 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068169117 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068228006 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.068234921 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068279028 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.068443060 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068806887 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.068867922 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.068937063 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.068949938 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.069209099 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.069262981 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.069298983 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.070816040 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.078511953 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.084099054 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.084125996 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.084227085 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.084234953 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085047960 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085114002 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085119963 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085129023 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085155010 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085194111 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085200071 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085237026 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085474014 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085527897 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085783005 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085833073 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.085932016 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.085943937 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.086009979 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.086019993 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.091329098 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.099328995 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.099644899 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.114905119 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.115334034 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.115371943 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.130553007 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.130790949 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.130812883 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.130875111 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.131009102 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.131860018 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.131927013 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.132237911 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.132302046 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.132484913 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.132493019 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.149444103 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.149656057 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.149666071 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.150671959 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.150742054 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.151616096 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.151689053 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.151751995 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.151762962 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.165616035 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.165637970 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.165702105 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.165721893 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.165736914 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.165791988 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.167519093 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.168853045 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.168863058 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.169964075 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.170033932 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.170041084 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.170075893 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.170568943 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.170622110 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.170779943 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.170797110 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.172863007 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.173151970 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.173204899 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.173209906 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.173222065 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.173266888 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.174258947 CET	49856	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.174276114 CET	443	49856	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.174902916 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.174937963 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.175004005 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.175833941 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.176016092 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.176018953 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.176032066 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.176414967 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.176426888 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.176764965 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.177366972 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.177423954 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.177814960 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.180455923 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.180510044 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.180558920 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.182035923 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.182099104 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.182147026 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.184976101 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.185002089 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.186079025 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.186309099 CET	49855	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.186314106 CET	443	49855	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.187061071 CET	49858	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.187064886 CET	443	49858	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.188467979 CET	49853	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.188482046 CET	443	49853	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.188713074 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.188771963 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.188816071 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.190329075 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.190376997 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.190427065 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.191148996 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.191184044 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.191262960 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.191417933 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.191428900 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.191735983 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.191770077 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.191826105 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.192028999 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.192042112 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.192934990 CET	49859	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.192946911 CET	443	49859	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.194228888 CET	49860	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.194242001 CET	443	49860	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.194283962 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.196602106 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.196615934 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.196671963 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.196830988 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.196841955 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.197830915 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.197843075 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.197912931 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.198191881 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.198204041 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.202454090 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.202475071 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.202532053 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.202697039 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.202713013 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.203864098 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.203876019 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.203929901 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.204350948 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.204365015 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.204416037 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.204566956 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.204579115 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.204700947 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.204713106 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.206310987 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.206319094 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.206372976 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.206530094 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.206540108 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.207732916 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.207743883 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.207806110 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.207957983 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.207967043 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.223325968 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.224627972 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.227329016 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.254647970 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.254699945 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.254744053 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.254753113 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.254793882 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.255959988 CET	49857	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.255970955 CET	443	49857	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.264659882 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.264684916 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.264761925 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.264938116 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.264950991 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.279936075 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.280025005 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.280066967 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.280637026 CET	49861	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.280642986 CET	443	49861	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.284096003 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.284172058 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.284221888 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.284873962 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.284908056 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.284962893 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.285139084 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.285151005 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.285855055 CET	49862	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.285861015 CET	443	49862	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.292325020 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.292351961 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.292411089 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.292587996 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.292604923 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.302591085 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.302741051 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.302786112 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.302881002 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.302925110 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.302932978 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303275108 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303287983 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303323984 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.303332090 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303383112 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.303781986 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303803921 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303827047 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.303834915 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.303869963 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.309266090 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.309284925 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.309339046 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.309591055 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.309602976 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.312393904 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.312453985 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.312515974 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.312606096 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.313345909 CET	49834	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:17.313354969 CET	443	49834	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:17.318888903 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.318898916 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.318969965 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.319122076 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.319133997 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.635659933 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.635958910 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.635965109 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.636316061 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.636611938 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.636671066 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.636729956 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.651483059 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.651679039 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.651693106 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.652102947 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.652384043 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.652441978 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.652487993 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.654351950 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.654504061 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.654510975 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.655417919 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.655474901 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.655481100 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.655518055 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.655827999 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.655884027 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.655972004 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.655986071 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.660629034 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.660800934 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.660823107 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.661864042 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.661923885 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.661931038 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.661973000 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.662205935 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.662264109 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.662358999 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.662372112 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.683336020 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.687515020 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.687705994 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.687714100 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.688384056 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.688786030 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.688792944 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.688853025 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.688992023 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.688998938 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.689433098 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.689588070 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.689635038 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.689640045 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.689677954 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.689802885 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.689912081 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.689924002 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.689985991 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.690047979 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690176010 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.690186024 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.690218925 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.690263033 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690267086 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.690300941 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690337896 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690355062 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.690639019 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690713882 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.690718889 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.690763950 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.691003084 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.691065073 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.691101074 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.691301107 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.691337109 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.691364050 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.691371918 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.691406965 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.691415071 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.691795111 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.691852093 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.691919088 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.692143917 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.692153931 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.699332952 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.703525066 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.703530073 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.731332064 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.731336117 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.735321999 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.735327005 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.736833096 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.736839056 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.736845970 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.736849070 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.736852884 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.746495962 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.746550083 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.746592045 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.754240990 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.755565882 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.755588055 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.756488085 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.756548882 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.756553888 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.756594896 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.756676912 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.757074118 CET	49867	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.757080078 CET	443	49867	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.757323980 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.757860899 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.757909060 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.757973909 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.758030891 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.758198977 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.758208990 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.759103060 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.759114027 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.759284019 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.759335995 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.759341955 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.759387016 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.759888887 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.759954929 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.760106087 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.760117054 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.760463953 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.761416912 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.761465073 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.761490107 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.761532068 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.761600018 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.761774063 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.761786938 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.762525082 CET	49868	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.762542009 CET	443	49868	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.762972116 CET	49851	443	192.168.2.5	18.245.62.126
Jan 7, 2025 20:03:17.762993097 CET	443	49851	18.245.62.126	192.168.2.5
Jan 7, 2025 20:03:17.765028954 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.765058994 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.765111923 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.765305996 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.765320063 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.776597977 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.776611090 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.776680946 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.776849985 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.776863098 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.780185938 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.780352116 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.780360937 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.781347990 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.781404972 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.782711983 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.782774925 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.783266068 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.783272028 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.783385038 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.783627033 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.783669949 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.783997059 CET	49870	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.784003973 CET	443	49870	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.784388065 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.784454107 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.784490108 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.785634041 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.785722971 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.786920071 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.786936998 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.786998034 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.787148952 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.787161112 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.787338018 CET	49871	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.787353992 CET	443	49871	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.788731098 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.788764954 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.788822889 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.788958073 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.788974047 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.794346094 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:17.794356108 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:17.794404984 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:17.794694901 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:17.794706106 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:17.794961929 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.795015097 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.795056105 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.795386076 CET	49875	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.795391083 CET	443	49875	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.795696974 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.795712948 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.795766115 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.796212912 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.796222925 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.798135042 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.798194885 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.798238039 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.799104929 CET	49876	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.799108982 CET	443	49876	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.799384117 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.799401999 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.799459934 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.800081968 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.800095081 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.800394058 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.800441027 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.800482035 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.800935984 CET	49873	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.800939083 CET	443	49873	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.801029921 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.801031113 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.801270008 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.801285028 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.801332951 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.801523924 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.801616907 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.801656008 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.801743031 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.801752090 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.802608967 CET	49872	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.802622080 CET	443	49872	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.804697037 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.804758072 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.804801941 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.806260109 CET	49869	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.806265116 CET	443	49869	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.808855057 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.808862925 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.808909893 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.809117079 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.809127092 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.810277939 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.810285091 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.810338020 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.810487032 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.810494900 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.830620050 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.830933094 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.830948114 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.831290007 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.831574917 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.831638098 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.831667900 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.831882954 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.862899065 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.862967014 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.863019943 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.863360882 CET	49880	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.863368988 CET	443	49880	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.867671013 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.867724895 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.867777109 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.868074894 CET	49879	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.868081093 CET	443	49879	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.869626045 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.869647980 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.869703054 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.870048046 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:17.870063066 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:17.870285034 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.870290995 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.870342970 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.870594025 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:17.870606899 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:17.870681047 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.870847940 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.870857954 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.871758938 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.871813059 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.872075081 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.872132063 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.872159004 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.879332066 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.879853010 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.881247044 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.881413937 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.881434917 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.881738901 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.881983995 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.882046938 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.882052898 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.907610893 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.912543058 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.912550926 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.912564039 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.912611961 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.912632942 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.912648916 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.912686110 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.913332939 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.913352013 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.927339077 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.930716038 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.961589098 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.980386972 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.980422020 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.980464935 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.980477095 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.980509043 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.980968952 CET	49878	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:17.980988026 CET	443	49878	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:17.999305010 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.999325991 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.999392033 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.999396086 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.999408960 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:17.999433041 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:17.999526978 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000277042 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.000308037 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.000335932 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:18.000344992 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.000381947 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:18.000689030 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000696898 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000730991 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000755072 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000757933 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.000765085 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000783920 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000797033 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.000799894 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.000799894 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.000813007 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.000830889 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.001040936 CET	49884	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.001056910 CET	443	49884	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.001415014 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.001466036 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.001473904 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:18.001501083 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:18.002024889 CET	49874	443	192.168.2.5	16.182.32.137
Jan 7, 2025 20:03:18.002032995 CET	443	49874	16.182.32.137	192.168.2.5
Jan 7, 2025 20:03:18.013598919 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.013654947 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.013705969 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.013712883 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.013765097 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.013777018 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.013869047 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.014326096 CET	49883	443	192.168.2.5	16.15.178.1
Jan 7, 2025 20:03:18.014331102 CET	443	49883	16.15.178.1	192.168.2.5
Jan 7, 2025 20:03:18.032644033 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.032664061 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.032738924 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.033010960 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.033020020 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.221982956 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.223320961 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.223356962 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.223692894 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.223987103 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.224047899 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.224172115 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.226221085 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.226385117 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.226413965 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.226849079 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.227094889 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.227161884 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.227221966 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.236036062 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.236320019 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.236335039 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.236705065 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.236994982 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.237071037 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.237102032 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.247219086 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.247396946 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.247414112 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.248327971 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.248394966 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.248402119 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.248444080 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.248682976 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.248740911 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.248806000 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.248820066 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.268045902 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.268260002 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.268300056 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.268311977 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.268497944 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.268529892 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269263029 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269331932 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.269340992 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269377947 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.269673109 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.269701958 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269735098 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269750118 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.269766092 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.269798994 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.270029068 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.270092010 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.270140886 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.270153999 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.270229101 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.270245075 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.270581961 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.270731926 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.270737886 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.271328926 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.271336079 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.271672010 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.271729946 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.271739006 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.271775007 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.271996975 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.272046089 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.272151947 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.272161007 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.280610085 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.280858040 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.280884027 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.281833887 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.281899929 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.281909943 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.281948090 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.282186985 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.282244921 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.282397032 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.282409906 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.282989979 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.282999992 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.285684109 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.285929918 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.285952091 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.286269903 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.287278891 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.287343979 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.287378073 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.298825026 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.299014091 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.299021006 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.300256014 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.300529957 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.300590992 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.300596952 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.300637007 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.301130056 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.301203966 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.301286936 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.301297903 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.315438032 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.315438032 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.315443039 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.331183910 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.331187010 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.331202984 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.331585884 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.331651926 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.331705093 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.332755089 CET	49885	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.332782030 CET	443	49885	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.335338116 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.335386992 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.335450888 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.335639000 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.335654974 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.335815907 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.335881948 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.335916996 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.336402893 CET	49886	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.336415052 CET	443	49886	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.338222980 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.338247061 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.338299036 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.338464975 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.338473082 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.344486952 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.344551086 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.344661951 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.345221996 CET	49887	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.345227957 CET	443	49887	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.345472097 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.345482111 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.345529079 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.346487045 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.348047018 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.348056078 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.348768950 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.348959923 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.348967075 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.350127935 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.350200891 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.350204945 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.350244045 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.350754023 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.350810051 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.350872993 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.350883007 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.351109028 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.351902962 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.351912022 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.353013039 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.353086948 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.353094101 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.353132010 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.353394032 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.353460073 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.353527069 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.353543997 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.369146109 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.369214058 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.369277000 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.369770050 CET	49888	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.369781017 CET	443	49888	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.371328115 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.371336937 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.371387959 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.371520042 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.371529102 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.380016088 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.380065918 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.380156994 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.380676985 CET	49889	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.380695105 CET	443	49889	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.380804062 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.380852938 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.380896091 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.382364988 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.382411957 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.382463932 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.382632017 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.382647038 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.382971048 CET	49897	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.382981062 CET	443	49897	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.383203983 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.383213997 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.383264065 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.384071112 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.384082079 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.384772062 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.384834051 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.384885073 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.385329962 CET	49898	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.385334015 CET	443	49898	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.386892080 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.386903048 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.386945963 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.387119055 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.387130976 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.393887997 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.393945932 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.393996954 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.394387007 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.394387007 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.394783974 CET	49896	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.394800901 CET	443	49896	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.395025969 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.395039082 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.395086050 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.395946980 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.395956039 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.401896000 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.401957989 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.402009010 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.402519941 CET	49894	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.402530909 CET	443	49894	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.402667999 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.402690887 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.402734995 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.403559923 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.403570890 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.412633896 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.412713051 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.412763119 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.413178921 CET	49899	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.413184881 CET	443	49899	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.413391113 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.413417101 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.413472891 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.414230108 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.414244890 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.460932016 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.461009979 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.461078882 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.464732885 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.464818954 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.464885950 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.507309914 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.547339916 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.547373056 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.548510075 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.548584938 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.589628935 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.624500990 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.624582052 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.624653101 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.624660015 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.625556946 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.625612974 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.639081001 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.639137983 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.639285088 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.639301062 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.642643929 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.642651081 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.682847023 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.683116913 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.683120966 CET	49900	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.683140039 CET	443	49900	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.700181007 CET	49901	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.700203896 CET	443	49901	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.713452101 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.713491917 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.713538885 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.713871002 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.713886023 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.741399050 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.741410017 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.741472006 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.741933107 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.741942883 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.763626099 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771136045 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771146059 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771176100 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771188021 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.771198988 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771209002 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771226883 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771243095 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.771243095 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.771262884 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.771267891 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.771296024 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.793054104 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.798297882 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.799832106 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.799860001 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.800108910 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.800116062 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.800266981 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.800465107 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.800561905 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.800637007 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.800843954 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.800893068 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.801029921 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.801100969 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.808036089 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.808202982 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.808211088 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.808567047 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.809047937 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.809115887 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.809170961 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.824163914 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.824542046 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.824585915 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.827759981 CET	49893	443	192.168.2.5	18.245.62.137
Jan 7, 2025 20:03:18.827776909 CET	443	49893	18.245.62.137	192.168.2.5
Jan 7, 2025 20:03:18.842140913 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.842467070 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.842485905 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.842854977 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.843410969 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.843467951 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.843683004 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.846714973 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.847322941 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.847326040 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.847345114 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.847352982 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.847688913 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.848212957 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.848268986 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.848555088 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.851325035 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.853899002 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.853921890 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.853950024 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.853969097 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.853976011 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.854064941 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.859486103 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.859883070 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.859914064 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.859963894 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.859970093 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.860018015 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.860802889 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.860809088 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.860814095 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.860865116 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.860872030 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.860882044 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.860907078 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.860928059 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.861119986 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.861747980 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.861803055 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.861866951 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.862493038 CET	49902	443	192.168.2.5	3.5.28.76
Jan 7, 2025 20:03:18.862503052 CET	443	49902	3.5.28.76	192.168.2.5
Jan 7, 2025 20:03:18.877506971 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.877754927 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.877774954 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.878613949 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.878664017 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.878724098 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.878731012 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.878762960 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.878796101 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.878809929 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.879055023 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.879106998 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.879163980 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.879173040 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.879688025 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.879734993 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.879740953 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.879765987 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.880062103 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.880110025 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.880150080 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.880157948 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.885327101 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.885488033 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.885494947 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.885792017 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.886167049 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.886209011 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.886272907 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.891320944 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.891330957 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.895436049 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.895687103 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.895704031 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.896716118 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.896781921 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.896787882 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.896826982 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.897754908 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.897823095 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.897874117 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.897885084 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.904846907 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.904922009 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.904961109 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.907325029 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.907700062 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.907799006 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.907835960 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.907844067 CET	49904	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.907851934 CET	443	49904	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.911014080 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.911035061 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.911076069 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.911338091 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.911348104 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.911750078 CET	49905	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.911756039 CET	443	49905	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.914002895 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.914014101 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.914058924 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.914271116 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.914278030 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.915424109 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.915493011 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.915530920 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.915942907 CET	49906	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.915947914 CET	443	49906	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.921783924 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.921801090 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.921844006 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.922028065 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.922039986 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.925896883 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.925935030 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.927328110 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.941278934 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.951404095 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.951549053 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.951586962 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.952591896 CET	49908	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.952599049 CET	443	49908	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.954720974 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.954754114 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.954802990 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.955133915 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.955148935 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.956166029 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.956234932 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.956275940 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.957051992 CET	49909	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.957056999 CET	443	49909	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.957389116 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.957396984 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.957458973 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.958054066 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.958067894 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.973553896 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.973633051 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.973674059 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.974015951 CET	49907	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.974024057 CET	443	49907	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.975604057 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.975630045 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.975672007 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.975837946 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.975851059 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.986669064 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.986740112 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.986778021 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.988445044 CET	49912	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.988455057 CET	443	49912	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.988675117 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.988682032 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.988730907 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.989219904 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.989232063 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.990602016 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.990668058 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.990703106 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.991240978 CET	49910	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.991246939 CET	443	49910	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.992753983 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.992760897 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.992806911 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.992966890 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:18.992978096 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:18.998290062 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.998347998 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.998384953 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.998965979 CET	49911	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.998970032 CET	443	49911	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.999191999 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.999202967 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:18.999245882 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.999766111 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:18.999773979 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.011529922 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.011591911 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.011630058 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.014964104 CET	49913	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.014971972 CET	443	49913	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.015377998 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.015407085 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.015450954 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.015938997 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.015953064 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.203347921 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.203587055 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.203599930 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.204629898 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.204687119 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.204691887 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.204724073 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.206521988 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.206571102 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.206753016 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.206760883 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.230104923 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.230376005 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.230390072 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.231399059 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.231452942 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.231463909 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.231494904 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.232090950 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.232139111 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.232239962 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.232248068 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.253463030 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.280033112 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.317887068 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.317946911 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.317989111 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.320863008 CET	49914	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.320880890 CET	443	49914	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.323677063 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.323709011 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.323760033 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.324434996 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.324445963 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.343825102 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.343894958 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.343936920 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.344638109 CET	49917	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.344650984 CET	443	49917	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.345196962 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.345205069 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.345252037 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.346106052 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.346113920 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.370826960 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.371040106 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.371048927 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.371409893 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.371753931 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.371810913 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.371932983 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.383465052 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.383790016 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.383812904 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.384146929 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.384659052 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.384713888 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.384768009 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.384929895 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.385169983 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.385175943 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.385482073 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.385812998 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.385853052 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.385997057 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.415323019 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.431329012 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.431344032 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.440335989 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.440747023 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.440762997 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.441776037 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.441788912 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.441839933 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.441845894 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.441876888 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.441960096 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.441968918 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.442234993 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.442295074 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.442331076 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.442348003 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.442357063 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.442570925 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.442620993 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.442672014 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.450778008 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.450954914 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.450974941 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.451867104 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.451917887 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.451922894 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.451955080 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.452245951 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.452294111 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.452342987 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.452351093 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.452624083 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.452779055 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.452785969 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.453664064 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.453716993 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.453721046 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.453751087 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.454173088 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.454214096 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.454278946 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.454284906 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.458568096 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.458758116 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.458765030 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.459786892 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.459840059 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.459845066 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.459877968 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.460164070 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.460232973 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.460315943 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.460325003 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.476399899 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.476666927 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.476674080 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.477699041 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.477747917 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.477754116 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.477786064 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.478214979 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.478271961 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.478482008 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.478496075 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.479625940 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.479736090 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.479774952 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.480892897 CET	49921	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.480904102 CET	443	49921	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.484524965 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.484548092 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.484602928 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.485008955 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.485017061 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.486655951 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.487323999 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.490341902 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.492322922 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.492377996 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.492429018 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.495851040 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.495908022 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.495949030 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.503950119 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.505861998 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.505877972 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.507966995 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.507972956 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.508708954 CET	49922	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.508724928 CET	443	49922	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.508860111 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.508908987 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.508913040 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.508941889 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.509789944 CET	49923	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.509794950 CET	443	49923	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.510132074 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.510158062 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.510201931 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.510988951 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.511034966 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.511389017 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.511398077 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.511676073 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.511682987 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.512906075 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.512912989 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.512969017 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.513139963 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.513145924 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.521830082 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.551431894 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.551480055 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.551518917 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.551934004 CET	49925	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.551947117 CET	443	49925	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.552108049 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.552161932 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.552196026 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.553805113 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.553824902 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.553872108 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.554009914 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.554435015 CET	49926	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.554440022 CET	443	49926	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.554763079 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.554771900 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.554811954 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.555469036 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.555478096 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.555720091 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.555727005 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.561752081 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.561815977 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.561860085 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.562355995 CET	49930	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.562364101 CET	443	49930	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.562958002 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.563023090 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.563062906 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.564166069 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.564173937 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.564224005 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.564678907 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.564687014 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.565227032 CET	49928	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.565231085 CET	443	49928	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.566977978 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.567001104 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.567051888 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.567320108 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.567327023 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.567791939 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.567861080 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.567898989 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.568972111 CET	49929	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.568975925 CET	443	49929	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.569231987 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.569245100 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.569299936 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.570091009 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.570096970 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.584678888 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.584745884 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.584780931 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.585191965 CET	49932	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.585196972 CET	443	49932	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.585467100 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.585475922 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.585520029 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.585937977 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.585944891 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.619282007 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.619380951 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.619429111 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.619988918 CET	49931	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.620008945 CET	443	49931	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.620387077 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.620423079 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.620479107 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.621025085 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.621033907 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.796576977 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.796804905 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.796845913 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.797190905 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.797465086 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.797570944 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.797584057 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.823013067 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.823215008 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.823226929 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.823595047 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.824034929 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.824112892 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.824212074 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.843333006 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.845525980 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.867332935 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.915515900 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.915589094 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.916620016 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.918013096 CET	49933	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.918030024 CET	443	49933	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.918106079 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.918152094 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.919260979 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.919260979 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.919296980 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.934242964 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.934304953 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.935270071 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.935368061 CET	49934	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.935373068 CET	443	49934	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.937757015 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.937767982 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.937851906 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.938899040 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.938914061 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.954974890 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.955218077 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.955244064 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.955590963 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.956016064 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.956016064 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.956037045 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.956082106 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.979612112 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.979816914 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.979826927 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.980153084 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.980532885 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.980532885 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:19.980592966 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:19.985301971 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.985469103 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.985474110 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.985785007 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.986185074 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.986185074 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:19.986196041 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:19.986236095 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.002578974 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.015255928 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.015472889 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.015487909 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.016383886 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.016477108 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.016484022 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.016705036 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.016887903 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.016887903 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.016902924 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.016947031 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.027236938 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.027443886 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.027450085 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.027750969 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.028105021 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.028105021 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.028146029 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.032780886 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.032780886 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.044421911 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.044640064 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.044647932 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.045551062 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.045660019 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.045667887 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.045878887 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.046051979 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.046051979 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.046060085 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.046101093 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.053174973 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.053365946 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.053373098 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.054366112 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.054446936 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.054454088 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.054665089 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.054821014 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.054821014 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.054871082 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.055655956 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.055821896 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.055830956 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.056709051 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.056780100 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.056787014 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.056993961 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.057147026 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.057147026 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.057153940 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.057193041 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.063915014 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.063946962 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.063951969 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.063978910 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.064148903 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.065861940 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.066067934 CET	49936	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.066070080 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.066076040 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.066082954 CET	443	49936	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.066466093 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.067369938 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.067435980 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.067738056 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.067739964 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.067764044 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.069015980 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.069015980 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.069037914 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.081017017 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.089823961 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.089906931 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.090846062 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.091139078 CET	49937	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.091139078 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.091155052 CET	443	49937	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.091169119 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.091653109 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.091653109 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.091670036 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.095906973 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.095906973 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.095913887 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.095921993 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.097501040 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.097556114 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.098484993 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.099369049 CET	49938	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.099375963 CET	443	49938	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.101063967 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.101073027 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.101281881 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.101281881 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.101294994 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.103420973 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.103621006 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.103643894 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.104542971 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.104629993 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.104639053 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.104877949 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.105053902 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.105053902 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.105062008 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.105101109 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.111361980 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.111361980 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.111368895 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.111370087 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.111375093 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.124854088 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.124895096 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.125673056 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.126950979 CET	49941	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.126951933 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.126960039 CET	443	49941	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.126992941 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.127599001 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.127599001 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.127631903 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.142164946 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.142164946 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.144355059 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.144411087 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.147376060 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.148536921 CET	49942	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.148536921 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.148551941 CET	443	49942	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.148564100 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.149487972 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.149487972 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.149506092 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.154062033 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.154350996 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.155837059 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.155837059 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.157443047 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.157444954 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.157455921 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.157461882 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.157490015 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.157671928 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.157671928 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.157686949 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.163844109 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.163938046 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.168104887 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.168142080 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.168174982 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.171371937 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.176461935 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.176491022 CET	49947	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.176496029 CET	49943	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.176501036 CET	443	49947	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.176508904 CET	443	49943	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.176533937 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.176671982 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.178251982 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.178251982 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.178267002 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.178275108 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.178333998 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.178333998 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.178797007 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.178797007 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.178806067 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.178817034 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.179035902 CET	49945	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.179042101 CET	443	49945	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.183367968 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.183406115 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.186434984 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.186646938 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.186664104 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.205919981 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.218702078 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.218780041 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.219453096 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.219453096 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.220118046 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.220141888 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.221366882 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.221366882 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.221385956 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.379000902 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.379336119 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.379350901 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.379683018 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.380099058 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.380099058 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.380110025 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.380163908 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.419647932 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.419886112 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.419893980 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.420207977 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.420564890 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.420564890 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.420619965 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.422936916 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.469834089 CET	49944	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.469835043 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.469846964 CET	443	49944	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.488146067 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.488197088 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.492372990 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.492372990 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.495372057 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.495390892 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.499609947 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.499609947 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.499634027 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.532073975 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.532141924 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.533196926 CET	49948	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.533211946 CET	443	49948	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.533237934 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.533785105 CET	49951	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.533786058 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.533797979 CET	443	49951	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.533811092 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.533968925 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.535366058 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.535378933 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.538903952 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.539099932 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.539122105 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.539475918 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.539983034 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.540036917 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.540061951 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.540138960 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.553050995 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.553327084 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.553337097 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.553678989 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.554020882 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.554080009 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.554178953 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.562330008 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.562582016 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.562589884 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.562957048 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.563328028 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.563385963 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.563474894 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.583324909 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.595336914 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.595375061 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.610285044 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.610306025 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.616267920 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.616472960 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.616497040 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.616823912 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.617171049 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.617171049 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.617187977 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.617233992 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.617744923 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.617902994 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.617916107 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.618217945 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.618531942 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.618531942 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.618587017 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.629122019 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.629317999 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.629326105 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.629640102 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.629968882 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.629968882 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.629983902 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.630024910 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.638348103 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.638503075 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.638510942 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.639403105 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.639487028 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.639494896 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.639703989 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.639853954 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.639853954 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.639863968 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.639906883 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.646838903 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.647054911 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.647078991 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.647458076 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.647841930 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.647841930 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.647906065 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.650625944 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.650685072 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.651456118 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.651456118 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.653594017 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.653614998 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.653846979 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.653846979 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.653871059 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.657469034 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.657902956 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.658087969 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.658094883 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.658418894 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.658757925 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.658757925 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.658809900 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.661576033 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.661653042 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.662455082 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.662717104 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.662720919 CET	49953	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.662724972 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.662731886 CET	443	49953	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.663621902 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.663621902 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.663639069 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.672291994 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.672291994 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.682398081 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.682447910 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.683209896 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.683366060 CET	49954	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.683371067 CET	443	49954	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.688116074 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.688116074 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.688122034 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.699767113 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.700093031 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.700103045 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.700989962 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.701075077 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.701081991 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.701288939 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.701451063 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.701451063 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.701505899 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.703248978 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.727994919 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.728044033 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.728894949 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.729136944 CET	49956	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.729139090 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.729147911 CET	443	49956	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.729163885 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.731050968 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.731123924 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.731235981 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.731374979 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.731388092 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.731419086 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.733819008 CET	49955	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.733829975 CET	443	49955	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.734297037 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.739969015 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.740017891 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.740849018 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.742702007 CET	49957	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.742712975 CET	443	49957	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.747476101 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.747529030 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.748208046 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.749878883 CET	49959	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.749881983 CET	443	49959	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.750663042 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.750672102 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.755637884 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.755686045 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.756550074 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.756807089 CET	49960	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.756808996 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.756814003 CET	443	49960	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.756834030 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.758863926 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.759375095 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.759390116 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.783129930 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.783198118 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.784451008 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.784451962 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.787379026 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.787429094 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.789340019 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.790426970 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.790441036 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.798970938 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.798974991 CET	49950	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.798986912 CET	443	49950	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.812165022 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.812231064 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.813082933 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.813350916 CET	49961	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.813354015 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.813359022 CET	443	49961	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.813371897 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.814941883 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.814941883 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.814965963 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.959872961 CET	49952	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.959893942 CET	443	49952	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.974818945 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.975052118 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.975075006 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.975447893 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.975744009 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.975800991 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:20.975878000 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:20.994663954 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.994894028 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.994899988 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.995245934 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.995589972 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:20.995640993 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:20.995738029 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.023325920 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.039328098 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.087301970 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.087378025 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.087446928 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.087702990 CET	49958	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.087718964 CET	443	49958	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.087976933 CET	49967	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.087984085 CET	443	49967	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.103499889 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.103584051 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.103647947 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.104094028 CET	49968	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.104099035 CET	443	49968	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.104371071 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.104408026 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.104470015 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.104974985 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.104990005 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.145317078 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.145574093 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.145584106 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.145909071 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.146213055 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.146270037 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.146347046 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.150719881 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.150935888 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.150949955 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.151288033 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.151566982 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.151622057 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.151701927 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.191329956 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.199323893 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.199630976 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.199841022 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.199868917 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.200192928 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.200459003 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.200520992 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.200571060 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.229813099 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.230015993 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.230029106 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.230355024 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.230616093 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.230669975 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.230707884 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.243341923 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.251054049 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.251250029 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.251276970 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.251589060 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.251866102 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.251916885 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.252000093 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.256825924 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.256901026 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.256949902 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.259524107 CET	49970	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.259532928 CET	443	49970	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.263115883 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.263169050 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.263211012 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.264714003 CET	49969	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.264719009 CET	443	49969	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.270194054 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.270239115 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.270301104 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.270509958 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.270524025 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.271327972 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.275840998 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.276484966 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.276494026 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.276546955 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.277139902 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.277154922 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.293986082 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.294195890 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.294213057 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.295248985 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.295336008 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.295345068 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.295387983 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.295716047 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.295773983 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.295841932 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.295856953 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.299324989 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.309866905 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.309945107 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.310005903 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.310441971 CET	49971	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.310458899 CET	443	49971	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.339662075 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.339728117 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.339781046 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.340312958 CET	49972	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.340325117 CET	443	49972	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.347673893 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.359157085 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.359226942 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.359276056 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.359853029 CET	49973	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.359872103 CET	443	49973	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.406384945 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.406650066 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.406707048 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.406836033 CET	49974	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.406847954 CET	443	49974	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.594510078 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.594748020 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.594774961 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.595134020 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.595530033 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.595587969 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.595664978 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.643333912 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.707472086 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.707541943 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.707588911 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.708364010 CET	49979	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.708385944 CET	443	49979	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.737132072 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.737334967 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.737349987 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.737720013 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.738111019 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.738178015 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.738254070 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.751221895 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.751637936 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.751647949 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.752003908 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.752321005 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.752392054 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.752491951 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.779330969 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.799329996 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.848004103 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.850107908 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.850159883 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.850270033 CET	49982	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.850275040 CET	443	49982	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.861202002 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.861283064 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.861330032 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.861818075 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.861821890 CET	443	49981	54.175.8.220	192.168.2.5
Jan 7, 2025 20:03:21.861830950 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.861864090 CET	49981	443	192.168.2.5	54.175.8.220
Jan 7, 2025 20:03:21.864893913 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.864902973 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:21.864962101 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.865165949 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:21.865176916 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.239645004 CET	443	49744	23.1.237.91	192.168.2.5
Jan 7, 2025 20:03:22.239728928 CET	49744	443	192.168.2.5	23.1.237.91
Jan 7, 2025 20:03:22.355060101 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.355393887 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:22.355412006 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.355746984 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.356036901 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:22.356096983 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.356151104 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:22.399339914 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.466917992 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.467446089 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:22.467483997 CET	443	49987	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:22.467540979 CET	49987	443	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:23.310853004 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:23.310914040 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:23.310982943 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:23.394330025 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:23.394335985 CET	443	49716	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:23.394346952 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:23.394481897 CET	49716	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:36.571384907 CET	49153	49829	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:36.571542025 CET	49829	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:36.571695089 CET	49829	49153	192.168.2.5	54.80.6.128
Jan 7, 2025 20:03:36.576433897 CET	49153	49829	54.80.6.128	192.168.2.5
Jan 7, 2025 20:03:39.071602106 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:39.071661949 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:39.071770906 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:39.149324894 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:39.149401903 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:39.149466038 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:39.394568920 CET	49831	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:39.394592047 CET	443	49831	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:39.394623041 CET	49833	443	192.168.2.5	3.5.25.233
Jan 7, 2025 20:03:39.394640923 CET	443	49833	3.5.25.233	192.168.2.5
Jan 7, 2025 20:03:51.502837896 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:51.502877951 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:51.502952099 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:51.503169060 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:51.503182888 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:52.131134987 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:52.131409883 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:52.131437063 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:52.131721020 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:52.131993055 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:03:52.132071972 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:03:52.173705101 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:04:02.100450993 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:04:02.100521088 CET	443	50148	142.250.184.196	192.168.2.5
Jan 7, 2025 20:04:02.100718975 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:04:03.394568920 CET	50148	443	192.168.2.5	142.250.184.196
Jan 7, 2025 20:04:03.394594908 CET	443	50148	142.250.184.196	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 20:02:46.921930075 CET	53	60096	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:46.928834915 CET	53	55495	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:47.947442055 CET	53	53067	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:51.440686941 CET	62598	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:51.440834045 CET	59563	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:51.449117899 CET	53	59563	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:51.451119900 CET	53	62598	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:52.882280111 CET	51524	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:52.885559082 CET	64310	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:52.932807922 CET	53	64310	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:52.933449984 CET	53	51524	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.740247011 CET	64211	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.740402937 CET	49606	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.740921974 CET	58697	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.741424084 CET	58977	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.757966042 CET	53	58697	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.764162064 CET	60145	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.764389038 CET	62964	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:53.768413067 CET	53	58977	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.771202087 CET	53	49606	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.771859884 CET	53	60145	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.791253090 CET	53	62964	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:53.799191952 CET	53	64211	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:54.473494053 CET	51513	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.473798037 CET	53079	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.494502068 CET	53	51513	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:54.495035887 CET	53	53079	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:54.721993923 CET	51375	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.722132921 CET	57449	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.758542061 CET	53271	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.758713961 CET	60789	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:54.779973984 CET	53	60789	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:54.792268038 CET	53	53271	1.1.1.1	192.168.2.5
Jan 7, 2025 20:02:55.788630962 CET	62641	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:02:55.788917065 CET	59328	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:04.900929928 CET	53	59988	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:15.387953043 CET	53	55689	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:15.389342070 CET	53	50095	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:16.379933119 CET	56589	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:16.380063057 CET	59329	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:16.392143965 CET	53	59329	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:16.408109903 CET	53	56589	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:16.566983938 CET	53	59235	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:17.185455084 CET	60767	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:17.185575962 CET	51102	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:17.203481913 CET	53	60767	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:17.203882933 CET	53	51102	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:17.778759956 CET	63013	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:17.778886080 CET	61082	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:17.790011883 CET	53	63013	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:17.793989897 CET	53	61082	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:18.007417917 CET	52631	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:18.007534981 CET	64596	53	192.168.2.5	1.1.1.1
Jan 7, 2025 20:03:18.024576902 CET	53	64596	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:18.032254934 CET	53	52631	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:23.902753115 CET	53	54410	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:46.825459957 CET	53	62823	1.1.1.1	192.168.2.5
Jan 7, 2025 20:03:46.964015961 CET	53	54536	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 20:02:53.791331053 CET	192.168.2.5	1.1.1.1	c224	(Port unreachable)	Destination Unreachable
Jan 7, 2025 20:02:54.825478077 CET	192.168.2.5	1.1.1.1	c26e	(Port unreachable)	Destination Unreachable
Jan 7, 2025 20:02:55.829492092 CET	192.168.2.5	1.1.1.1	c26e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 20:02:51.440686941 CET	192.168.2.5	1.1.1.1	0x77e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:51.440834045 CET	192.168.2.5	1.1.1.1	0xd9a4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:52.882280111 CET	192.168.2.5	1.1.1.1	0x59a7	Standard query (0)	hallmark.greetingsweb.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:52.885559082 CET	192.168.2.5	1.1.1.1	0xde71	Standard query (0)	hallmark.greetingsweb.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:53.740247011 CET	192.168.2.5	1.1.1.1	0x7abe	Standard query (0)	hallmark.greetingsweb.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.740402937 CET	192.168.2.5	1.1.1.1	0xcf9	Standard query (0)	_49153._https.hallmark.greetingsweb.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:53.740921974 CET	192.168.2.5	1.1.1.1	0x4122	Standard query (0)	tslp.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.741424084 CET	192.168.2.5	1.1.1.1	0x1fae	Standard query (0)	tslp.s3.amazonaws.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:53.764162064 CET	192.168.2.5	1.1.1.1	0xa97f	Standard query (0)	java.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.764389038 CET	192.168.2.5	1.1.1.1	0xa5e8	Standard query (0)	java.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:54.473494053 CET	192.168.2.5	1.1.1.1	0xbc4c	Standard query (0)	tslp.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.473798037 CET	192.168.2.5	1.1.1.1	0x1afa	Standard query (0)	tslp.s3.amazonaws.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:54.721993923 CET	192.168.2.5	1.1.1.1	0xba8e	Standard query (0)	www.java.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.722132921 CET	192.168.2.5	1.1.1.1	0x2377	Standard query (0)	www.java.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:54.758542061 CET	192.168.2.5	1.1.1.1	0xd7a6	Standard query (0)	hallmark.greetingsweb.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.758713961 CET	192.168.2.5	1.1.1.1	0x42ee	Standard query (0)	hallmark.greetingsweb.com	65	IN (0x0001)	false
Jan 7, 2025 20:02:55.788630962 CET	192.168.2.5	1.1.1.1	0x5f67	Standard query (0)	www.java.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:55.788917065 CET	192.168.2.5	1.1.1.1	0xbd5	Standard query (0)	www.java.com	65	IN (0x0001)	false
Jan 7, 2025 20:03:16.379933119 CET	192.168.2.5	1.1.1.1	0x879f	Standard query (0)	d25q7gseii1o1q.cloudfront.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:16.380063057 CET	192.168.2.5	1.1.1.1	0x9119	Standard query (0)	d25q7gseii1o1q.cloudfront.net	65	IN (0x0001)	false
Jan 7, 2025 20:03:17.185455084 CET	192.168.2.5	1.1.1.1	0xc643	Standard query (0)	ts-uploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.185575962 CET	192.168.2.5	1.1.1.1	0x7b05	Standard query (0)	ts-uploads.s3.amazonaws.com	65	IN (0x0001)	false
Jan 7, 2025 20:03:17.778759956 CET	192.168.2.5	1.1.1.1	0x83e6	Standard query (0)	d25q7gseii1o1q.cloudfront.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.778886080 CET	192.168.2.5	1.1.1.1	0xb9bd	Standard query (0)	d25q7gseii1o1q.cloudfront.net	65	IN (0x0001)	false
Jan 7, 2025 20:03:18.007417917 CET	192.168.2.5	1.1.1.1	0x7f9d	Standard query (0)	ts-uploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.007534981 CET	192.168.2.5	1.1.1.1	0x7aed	Standard query (0)	ts-uploads.s3.amazonaws.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 20:02:51.449117899 CET	1.1.1.1	192.168.2.5	0xd9a4	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 7, 2025 20:02:51.451119900 CET	1.1.1.1	192.168.2.5	0x77e6	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:52.932807922 CET	1.1.1.1	192.168.2.5	0xde71	No error (0)	hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:52.933449984 CET	1.1.1.1	192.168.2.5	0x59a7	No error (0)	hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:52.933449984 CET	1.1.1.1	192.168.2.5	0x59a7	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.175.8.220	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:52.933449984 CET	1.1.1.1	192.168.2.5	0x59a7	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.80.6.128	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	tslp.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.233	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.81	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.204.225	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.194.153	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.10.213	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.214.161	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.11.155	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.757966042 CET	1.1.1.1	192.168.2.5	0x4122	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.197.249	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.768413067 CET	1.1.1.1	192.168.2.5	0x1fae	No error (0)	tslp.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.768413067 CET	1.1.1.1	192.168.2.5	0x1fae	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.771202087 CET	1.1.1.1	192.168.2.5	0xcf9	No error (0)	_49153._https.hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.771859884 CET	1.1.1.1	192.168.2.5	0xa97f	No error (0)	java.com		2.23.227.218	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.771859884 CET	1.1.1.1	192.168.2.5	0xa97f	No error (0)	java.com		2.23.227.198	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.799191952 CET	1.1.1.1	192.168.2.5	0x7abe	No error (0)	hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:53.799191952 CET	1.1.1.1	192.168.2.5	0x7abe	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.80.6.128	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:53.799191952 CET	1.1.1.1	192.168.2.5	0x7abe	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.175.8.220	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	tslp.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.178.1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.27.95	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.118.73	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.10.203	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.177.158	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.9.204	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.95.35	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.494502068 CET	1.1.1.1	192.168.2.5	0xbc4c	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.103	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.495035887 CET	1.1.1.1	192.168.2.5	0x1afa	No error (0)	tslp.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.495035887 CET	1.1.1.1	192.168.2.5	0x1afa	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.730628014 CET	1.1.1.1	192.168.2.5	0xba8e	No error (0)	www.java.com	ds-www.java.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.779973984 CET	1.1.1.1	192.168.2.5	0x42ee	No error (0)	hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.792268038 CET	1.1.1.1	192.168.2.5	0xd7a6	No error (0)	hallmark.greetingsweb.com	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:54.792268038 CET	1.1.1.1	192.168.2.5	0xd7a6	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.80.6.128	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.792268038 CET	1.1.1.1	192.168.2.5	0xd7a6	No error (0)	prod-lp-alb-1655798893.us-east-1.elb.amazonaws.com		54.175.8.220	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:02:54.822408915 CET	1.1.1.1	192.168.2.5	0x2377	No error (0)	www.java.com	ds-www.java.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:55.797380924 CET	1.1.1.1	192.168.2.5	0x5f67	No error (0)	www.java.com	ds-www.java.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:02:55.829431057 CET	1.1.1.1	192.168.2.5	0xbd5	No error (0)	www.java.com	ds-www.java.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:16.408109903 CET	1.1.1.1	192.168.2.5	0x879f	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.126	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:16.408109903 CET	1.1.1.1	192.168.2.5	0x879f	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.177	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:16.408109903 CET	1.1.1.1	192.168.2.5	0x879f	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.146	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:16.408109903 CET	1.1.1.1	192.168.2.5	0x879f	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	ts-uploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.32.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.176.111	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.85.100	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.21.159	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.27.21	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.22.165	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.227.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203481913 CET	1.1.1.1	192.168.2.5	0xc643	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.133.201	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203882933 CET	1.1.1.1	192.168.2.5	0x7b05	No error (0)	ts-uploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:17.203882933 CET	1.1.1.1	192.168.2.5	0x7b05	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:17.790011883 CET	1.1.1.1	192.168.2.5	0x83e6	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.790011883 CET	1.1.1.1	192.168.2.5	0x83e6	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.146	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.790011883 CET	1.1.1.1	192.168.2.5	0x83e6	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.177	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:17.790011883 CET	1.1.1.1	192.168.2.5	0x83e6	No error (0)	d25q7gseii1o1q.cloudfront.net		18.245.62.126	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.024576902 CET	1.1.1.1	192.168.2.5	0x7aed	No error (0)	ts-uploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:18.024576902 CET	1.1.1.1	192.168.2.5	0x7aed	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	ts-uploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.76	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.74.204	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.179.22	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.212.121	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.13.196	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.8.131	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.20.39	A (IP address)	IN (0x0001)	false
Jan 7, 2025 20:03:18.032254934 CET	1.1.1.1	192.168.2.5	0x7f9d	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.24.124	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hallmark.greetingsweb.com

https:

tslp.s3.amazonaws.com

d25q7gseii1o1q.cloudfront.net

ts-uploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:53 UTC	689	OUT	GET /2865d1125997389a?l=22 HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:53 UTC	802	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:02:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin ETag: W/"3cba33b4922b091454a65837adb7352b" Cache-Control: max-age=0, private, must-revalidate Set-Cookie: EXFILGUID=65d1199738; path=/ Set-Cookie: link_clicked_65d1199738=1; path=/ X-Request-Id: 0af30091-ffe4-4b3d-a9a3-91451998a564 X-Runtime: 0.021423 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:02:53 UTC	3887	IN	Data Raw: 66 32 38 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 75 72 6c 3d 2f 6c 6f 61 64 5f 74 72 61 69 6e 69 6e 67 3f 67 75 69 64 3d 37 64 36 35 64 31 31 38 31 39 39 37 33 38 65 65 26 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 3d 65 36 64 63 64 62 38 39 2d 61 32 63 39 2d 34 31 65 37 2d 39 66 39 64 2d 63 36 62 31 32 36 37 65 34 35 64 63 22 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 Data Ascii: f28 <html> <head> <title></title> <noscript><meta http-equiv="refresh" content="1;url=/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc"></noscript> </he
2025-01-07 19:02:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	621	OUT	GET /detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:54 UTC	427	IN	HTTP/1.1 200 OK x-amz-id-2: GjWZocxDSAWog7dDlVj+4H6f3WZ9l1Rh0NX+ctjawkmhfTRJgB3bELR09zPua4W2KOcYbT4GTgOUnCktJx7/N6b/CNCVs5k8 x-amz-request-id: ECB9D8ZPSGFKRZ8W Date: Tue, 07 Jan 2025 19:02:55 GMT Last-Modified: Wed, 15 Feb 2017 17:56:07 GMT ETag: "00a513f07603df01e3b99be00f370754" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 50085 Server: AmazonS3 Connection: close
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 76 61 72 20 6a 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 76 65 72 73 69 6f 6e 3a 20 22 30 2e 39 2e 31 22 2c 0a 20 20 20 20 20 20 20 20 6e 61 6d 65 3a 20 22 50 6c 75 67 69 6e 44 65 74 65 63 74 22 2c 0a 20 20 20 20 20 20 20 20 61 64 64 50 6c 75 67 69 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 70 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { var j = { version: "0.9.1", name: "PluginDetect", addPlugin: function(p
2025-01-07 19:02:54 UTC	597	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 63 61 74 46 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 71 2c 20 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 70 20 3d 3d 20 22 66 75 6e 63 74 69 6f 6e 22 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 Data Ascii: } } }, concatFn: function(q, p) { return function() { q(); if (typeof p == "function") { p() }
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 5b 75 5d 20 3d 20 31 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 28 72 2c 20 71 2c 20 70 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 61 6e 64 6c 65 72 57 61 69 74 3a 20 66 75 6e 63 74 69 6f 6e 28 73 2c 20 75 2c 20 72 2c 20 71 2c 20 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 74 68 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: s[u] = 1; s(r, q, p) } } }, handlerWait: function(s, u, r, q, p) { var t = this; return function() {
2025-01-07 19:02:54 UTC	1024	IN	Data Raw: 20 20 20 20 20 20 67 65 74 44 69 76 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 2e 64 69 76 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 74 68 69 73 2e 64 69 76 49 44 29 20 7c 7c 20 6e 75 6c 6c 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 69 74 44 69 76 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 71 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 71 2e 64 69 76 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: getDiv: function() { return this.div \|\| document.getElementById(this.divID) \|\| null }, initDiv: function() { var q = this, p; if (!q.div) {
2025-01-07 19:02:54 UTC	10157	IN	Data Raw: 28 6a 2e 62 72 6f 77 73 65 72 2e 69 73 49 45 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 73 65 74 53 74 79 6c 65 28 71 2c 20 5b 22 64 69 73 70 6c 61 79 22 2c 20 22 6e 6f 6e 65 22 5d 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 63 61 74 63 68 20 28 72 29 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 6d 6f 76 65 4e 6f Data Ascii: (j.browser.isIE) { p.setStyle(q, ["display", "none"]) } try { q.innerHTML = "" } catch (r) {} } }, removeNo
2025-01-07 19:02:54 UTC	5539	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 6a 2e 69 73 44 65 66 69 6e 65 64 28 70 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 20 3d 20 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 69 73 53 74 72 69 6e 67 28 74 29 20 26 26 20 28 2f 5b 5e 5c 73 5d 2f 29 2e 74 65 73 74 28 74 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 72 65 70 6c 61 63 65 28 2f 5c 73 2f 67 2c 20 22 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 47 20 3d 20 6a 2e 6f 70 65 6e 54 61 67 20 2b 20 74 20 2b 20 Data Ascii: } if (!j.isDefined(p)) { p = "" } if (j.isString(t) && (/[^\s]/).test(t)) { t = t.toLowerCase().replace(/\s/g, ""); G = j.openTag + t +

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	612	OUT	GET /detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:54 UTC	427	IN	HTTP/1.1 200 OK x-amz-id-2: p0vpTpNxM8cUsnorIcD6eg+eAfij0R9dVsajWS656c51Pp2Yd3udvStc9lfQieyE1ypibbHJgfH0HH60RZKTu/QN+dxBDQaG x-amz-request-id: ECB6008S4DJ9S1V4 Date: Tue, 07 Jan 2025 19:02:55 GMT Last-Modified: Wed, 15 Feb 2017 14:38:28 GMT ETag: "2bec0061039dc3fb25fc20aaf611d5b9" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 50717 Server: AmazonS3 Connection: close
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 4a 61 76 61 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 50 72 6f 70 65 72 74 79 5f 6e 61 6d 65 73 3a 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 50 72 6f 70 65 72 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Java ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var a = { Property_names: [], Proper
2025-01-07 19:02:54 UTC	597	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 76 65 72 73 69 6f 6e 30 20 3d 20 6a 2e 66 6f 72 6d 61 74 4e 75 6d 28 6a 2e 67 65 74 4e 75 6d 28 70 29 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 76 20 26 26 20 21 71 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 76 65 72 73 69 6f 6e 20 3d 20 6a 2e 66 6f 72 6d 61 74 4e 75 6d 28 6a 2e 67 65 74 4e 75 6d 28 76 29 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 77 20 26 26 20 6a 2e 69 73 53 74 72 69 6e 67 28 77 29 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: } } if (p) { t.version0 = j.formatNum(j.getNum(p)) } if (v && !q) { t.version = j.formatNum(j.getNum(v)) } if (w && j.isString(w)) {
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 20 3d 20 30 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 67 65 74 56 65 72 73 69 6f 6e 44 6f 6e 65 20 3d 20 74 2e 61 70 70 6c 65 74 2e 63 61 6e 5f 49 6e 73 65 72 74 5f 51 75 65 72 79 5f 41 6e 79 28 29 20 3f 20 30 20 3a 20 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 57 65 62 53 74 61 72 74 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 61 73 52 75 6e 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 73 69 6f 6e 3a 20 22 22 2c 0a 20 20 20 20 20 Data Ascii: = 0 } else { t.getVersionDone = t.applet.can_Insert_Query_Any() ? 0 : 1 } } } }, WebStart: { hasRun: 0, version: "",
2025-01-07 19:02:54 UTC	1024	IN	Data Raw: 5d 20 3e 20 33 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 5b 70 20 2d 20 31 5d 20 3d 20 33 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 61 6c 6c 6f 77 65 64 5b 70 5d 20 3d 20 72 5b 70 20 2d 20 31 5d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 61 6c 6c 6f 77 65 64 5b 30 5d 20 3d 20 71 2e 61 6c 6c 6f 77 65 64 5b 33 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 Data Ascii: ] > 3) { r[p - 1] = 3 } q.allowed[p] = r[p - 1] } } q.allowed[0] = q.allowed[3]; }
2025-01-07 19:02:54 UTC	10157	IN	Data Raw: 65 63 74 54 61 67 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 71 20 3d 3d 20 32 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 70 2e 41 70 70 6c 65 74 54 61 67 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 71 20 3d 3d 3d 20 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 63 6f 64 65 62 61 73 65 2e 69 73 44 69 73 61 62 6c 65 64 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ectTag() } if (q == 2) { return p.AppletTag() } if (q === 0) { return j.codebase.isDisabled() }
2025-01-07 19:02:54 UTC	6171	IN	Data Raw: 66 6f 72 20 28 71 20 3d 20 30 3b 20 71 20 3c 20 70 2e 6c 65 6e 67 74 68 3b 20 71 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 70 5b 71 5d 20 26 26 20 70 5b 71 5d 2e 6c 6f 61 64 65 64 20 21 3d 3d 20 6e 75 6c 6c 20 26 26 20 21 70 5b 71 5d 2e 6c 6f 61 64 65 64 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 30 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 71 75 65 72 79 52 65 61 64 79 53 74 61 74 65 3a 20 66 75 6e 63 74 69 6f 6e Data Ascii: for (q = 0; q < p.length; q++) { if (p[q] && p[q].loaded !== null && !p[q].loaded) { return 0 } } return 1 }, queryReadyState: function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	613	OUT	GET /detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:54 UTC	426	IN	HTTP/1.1 200 OK x-amz-id-2: tyScohpBU5taI8MAhyXPfiFP2+tEXdPWm1zPDh7Cin3vb04CtvPztKp5tHzx6i/DP2Sxr5LtPSLSG2kyqkRmQKyjytldZOfN x-amz-request-id: ECB45DG5M6XGEGEY Date: Tue, 07 Jan 2025 19:02:55 GMT Last-Modified: Wed, 15 Feb 2017 03:54:01 GMT ETag: "f9ad9a096894ba248e4a1f73e7eba1be" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 6680 Server: AmazonS3 Connection: close
2025-01-07 19:02:54 UTC	6680	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 46 6c 61 73 68 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 6d 69 6d 65 54 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68 22 2c 0a 20 20 20 20 20 20 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Flash ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var e = { mimeType: "application/x-shockwave-flash",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49720	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	611	OUT	GET /detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:54 UTC	427	IN	HTTP/1.1 200 OK x-amz-id-2: /N2skeURfKLryzVgqexq02rw6c3mQpWgzIVpZnx7APRN8aRLWGdS0/UQBe0BH3bGgbFYkB6aJzTU5NUbEKoOiIEr/QqBbGIj x-amz-request-id: ECBBJQPTD678S8EQ Date: Tue, 07 Jan 2025 19:02:55 GMT Last-Modified: Wed, 15 Feb 2017 14:39:34 GMT ETag: "0d5882d41c8b6e40059c8d9acbcf1518" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 22855 Server: AmazonS3 Connection: close
2025-01-07 19:02:54 UTC	8546	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 41 64 6f 62 65 52 65 61 64 65 72 20 50 44 46 6a 73 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 63 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 4f 54 46 3a 20 6e 75 6c 6c 2c 0a 20 20 20 20 20 20 20 20 73 65 74 50 6c 75 67 69 6e 53 74 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ AdobeReader PDFjs ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX ]/(function() { j = PluginDetect; var c = { OTF: null, setPluginSt
2025-01-07 19:02:54 UTC	14309	IN	Data Raw: 76 20 3d 20 63 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 20 3d 20 6a 2e 44 4f 4d 2e 61 6c 74 48 54 4d 4c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 20 3d 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2c 20 78 2c 20 77 2c 20 74 2c 20 75 20 3d 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 79 2e 69 73 44 69 73 61 62 6c 65 64 28 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 79 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 6a 2e 44 4f 4d 2e 69 66 72 61 6d 65 2e 69 6e Data Ascii: v = c, p = j.DOM.altHTML, r = 1, s, x, w, t, u = 1, q; if (y.isDisabled()) { return y } s = j.DOM.iframe.in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	617	OUT	GET /detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:54 UTC	426	IN	HTTP/1.1 200 OK x-amz-id-2: bkvuxaDHOKRzwZ2SMGBQLTvqfl8wp/JB10COGh+C+SaFzaSjTUINeYVKVsXt0Ldf8qrO1Lwk3aZtEa1v7QrkYCb7x3TsUMGA x-amz-request-id: ECB8MB4Z8B4BSCZM Date: Tue, 07 Jan 2025 19:02:55 GMT Last-Modified: Wed, 15 Feb 2017 14:41:05 GMT ETag: "ee73f2f47d51116dc40b85a6b57eaf20" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 6999 Server: AmazonS3 Connection: close
2025-01-07 19:02:54 UTC	6999	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 51 75 69 63 6b 54 69 6d 65 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 73 65 74 50 6c 75 67 69 6e 53 74 61 74 75 73 3a 20 66 75 6e 63 74 69 6f 6e 28 71 2c 20 70 2c 20 73 29 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ QuickTime ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var i = { setPluginStatus: function(q, p, s) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49715	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	656	OUT	GET /assets/ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:02:54 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:02:54 GMT Content-Type: application/javascript Content-Length: 92629 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:47 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:02:54 UTC	15998	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 39 2e 31 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 32 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 2f 2f 40 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 6a 71 75 65 72 79 2e 6d 69 6e 2e 6d 61 70 0a 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 74 79 70 65 6f 66 20 74 2c 6f 3d 65 2e 64 6f 63 75 6d 65 6e 74 2c 61 3d 65 2e 6c 6f 63 61 74 69 6f 6e 2c 73 3d 65 2e 6a 51 75 65 72 79 2c 75 3d 65 2e 24 2c 6c 3d 7b 7d 2c 63 3d 5b 5d 2c 70 3d 22 31 2e 39 2e 31 22 2c 66 3d 63 2e 63 6f 6e 63 61 74 2c 64 3d 63 2e 70 75 73 68 2c 68 3d 63 2e 73 6c 69 63 65 2c 67 3d 63 2e 69 6e 64 65 78 4f Data Ascii: /! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license//@ sourceMappingURL=jquery.min.map/(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexO
2025-01-07 19:02:54 UTC	16379	IN	Data Raw: 61 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 57 28 65 2c 6e 2c 72 29 7b 69 66 28 72 3d 3d 3d 74 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 69 3d 22 64 61 74 61 2d 22 2b 6e 2e 72 65 70 6c 61 63 65 28 42 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 72 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 69 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 72 29 7b 74 72 79 7b 72 3d 22 74 72 75 65 22 3d 3d 3d 72 3f 21 30 3a 22 66 61 6c 73 65 22 3d 3d 3d 72 3f 21 31 3a 22 6e 75 6c 6c 22 3d 3d 3d 72 3f 6e 75 6c 6c 3a 2b 72 2b 22 22 3d 3d 3d 72 3f 2b 72 3a 4f 2e 74 65 73 74 28 72 29 3f 62 2e 70 61 72 73 65 4a 53 4f 4e 28 72 29 3a 72 7d 63 61 74 63 68 28 6f 29 7b 7d 62 2e 64 61 74 Data Ascii: a(this,e)})}});function W(e,n,r){if(r===t&&1===e.nodeType){var i="data-"+n.replace(B,"-$1").toLowerCase();if(r=e.getAttribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r?!1:"null"===r?null:+r+""===r?+r:O.test(r)?b.parseJSON(r):r}catch(o){}b.dat
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 62 2e 6e 6f 64 65 4e 61 6d 65 28 74 68 69 73 2c 22 66 6f 72 6d 22 29 3f 21 31 3a 28 62 2e 65 76 65 6e 74 2e 61 64 64 28 74 68 69 73 2c 22 63 6c 69 63 6b 2e 5f 73 75 62 6d 69 74 20 6b 65 79 70 72 65 73 73 2e 5f 73 75 62 6d 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 74 61 72 67 65 74 2c 72 3d 62 2e 6e 6f 64 65 4e 61 6d 65 28 6e 2c 22 69 6e 70 75 74 22 29 7c 7c 62 2e 6e 6f 64 65 4e 61 6d 65 28 6e 2c 22 62 75 74 74 6f 6e 22 29 3f 6e 2e 66 6f 72 6d 3a 74 3b 72 26 26 21 62 2e 5f 64 61 74 61 28 72 2c 22 73 75 62 6d 69 74 42 75 62 62 6c 65 73 22 29 26 26 28 62 2e 65 76 65 6e 74 2e 61 64 64 28 72 2c 22 73 75 62 6d 69 74 2e 5f 73 75 62 6d 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 5f 73 75 62 6d 69 Data Ascii: ){return b.nodeName(this,"form")?!1:(b.event.add(this,"click._submit keypress._submit",function(e){var n=e.target,r=b.nodeName(n,"input")\|\|b.nodeName(n,"button")?n.form:t;r&&!b._data(r,"submitBubbles")&&(b.event.add(r,"submit._submit",function(e){e._submi
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 3b 29 65 2e 70 75 73 68 28 72 29 3b 72 65 74 75 72 6e 20 65 7d 29 7d 7d 3b 66 6f 72 28 6e 20 69 6e 7b 72 61 64 69 6f 3a 21 30 2c 63 68 65 63 6b 62 6f 78 3a 21 30 2c 66 69 6c 65 3a 21 30 2c 70 61 73 73 77 6f 72 64 3a 21 30 2c 69 6d 61 67 65 3a 21 30 7d 29 69 2e 70 73 65 75 64 6f 73 5b 6e 5d 3d 6c 74 28 6e 29 3b 66 6f 72 28 6e 20 69 6e 7b 73 75 62 6d 69 74 3a 21 30 2c 72 65 73 65 74 3a 21 30 7d 29 69 2e 70 73 65 75 64 6f 73 5b 6e 5d 3d 63 74 28 6e 29 3b 66 75 6e 63 74 69 6f 6e 20 66 74 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 45 5b 65 2b 22 20 22 5d 3b 69 66 28 63 29 72 65 74 75 72 6e 20 74 3f 30 3a 63 2e 73 6c 69 63 65 28 30 29 3b 73 3d 65 2c 75 3d 5b 5d 2c 6c 3d 69 2e 70 72 65 46 69 6c 74 65 72 3b 77 68 69 6c 65 28 73 Data Ascii: ;)e.push(r);return e})}};for(n in{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})i.pseudos[n]=lt(n);for(n in{submit:!0,reset:!0})i.pseudos[n]=ct(n);function ft(e,t){var n,r,o,a,s,u,l,c=E[e+" "];if(c)return t?0:c.slice(0);s=e,u=[],l=i.preFilter;while(s
2025-01-07 19:02:54 UTC	16384	IN	Data Raw: 2a 29 24 22 2c 22 69 22 29 2c 59 74 3d 52 65 67 45 78 70 28 22 5e 28 22 2b 78 2b 22 29 28 3f 21 70 78 29 5b 61 2d 7a 25 5d 2b 24 22 2c 22 69 22 29 2c 4a 74 3d 52 65 67 45 78 70 28 22 5e 28 5b 2b 2d 5d 29 3d 28 22 2b 78 2b 22 29 22 2c 22 69 22 29 2c 47 74 3d 7b 42 4f 44 59 3a 22 62 6c 6f 63 6b 22 7d 2c 51 74 3d 7b 70 6f 73 69 74 69 6f 6e 3a 22 61 62 73 6f 6c 75 74 65 22 2c 76 69 73 69 62 69 6c 69 74 79 3a 22 68 69 64 64 65 6e 22 2c 64 69 73 70 6c 61 79 3a 22 62 6c 6f 63 6b 22 7d 2c 4b 74 3d 7b 6c 65 74 74 65 72 53 70 61 63 69 6e 67 3a 30 2c 66 6f 6e 74 57 65 69 67 68 74 3a 34 30 30 7d 2c 5a 74 3d 5b 22 54 6f 70 22 2c 22 52 69 67 68 74 22 2c 22 42 6f 74 74 6f 6d 22 2c 22 4c 65 66 74 22 5d 2c 65 6e 3d 5b 22 57 65 62 6b 69 74 22 2c 22 4f 22 2c 22 4d 6f 7a 22 Data Ascii: *)$","i"),Yt=RegExp("^("+x+")(?!px)[a-z%]+$","i"),Jt=RegExp("^([+-])=("+x+")","i"),Gt={BODY:"block"},Qt={position:"absolute",visibility:"hidden",display:"block"},Kt={letterSpacing:0,fontWeight:400},Zt=["Top","Right","Bottom","Left"],en=["Webkit","O","Moz"
2025-01-07 19:02:54 UTC	11100	IN	Data Raw: 21 52 6e 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 52 6e 2c 52 6e 3d 62 2e 73 75 70 70 6f 72 74 2e 61 6a 61 78 3d 21 21 52 6e 2c 52 6e 26 26 62 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 21 6e 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 62 2e 73 75 70 70 6f 72 74 2e 63 6f 72 73 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 29 7b 76 61 72 20 61 2c 73 2c 75 3d 6e 2e 78 68 72 28 29 3b 69 66 28 6e 2e 75 73 65 72 6e 61 6d 65 3f 75 2e 6f 70 65 6e 28 6e 2e 74 79 70 65 2c 6e 2e 75 72 6c 2c 6e 2e 61 73 79 6e 63 2c 6e 2e 75 73 65 72 6e 61 6d 65 2c 6e 2e 70 61 73 73 77 6f 72 64 29 3a 75 2e 6f 70 65 6e 28 6e 2e 74 79 70 65 2c 6e 2e 75 72 6c 2c 6e 2e Data Ascii: !Rn&&"withCredentials"in Rn,Rn=b.support.ajax=!!Rn,Rn&&b.ajaxTransport(function(n){if(!n.crossDomain\|\|b.support.cors){var r;return{send:function(i,o){var a,s,u=n.xhr();if(n.username?u.open(n.type,n.url,n.async,n.username,n.password):u.open(n.type,n.url,n.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:54 UTC	639	OUT	GET /assets/all.js?g=65d1199738 HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:02:55 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:02:54 GMT Content-Type: application/javascript Content-Length: 28356 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:02:55 UTC	15998	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 7c 7c 20 28 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 3d 20 22 22 29 2c 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 65 72 72 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 65 2c 20 69 29 20 7b 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f 74 6f 5f 63 6f 6e 73 6f 6c 65 28 69 29 2c 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 2b 20 22 2f 6c 6f 67 3f 69 64 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 74 72 61 63 6b 69 6e 67 5f 69 64 29 20 2b 20 22 26 73 65 76 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 Data Ascii: (function() {window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e)
2025-01-07 19:02:55 UTC	12358	IN	Data Raw: 43 48 20 46 4f 52 20 6e 61 6d 65 22 29 2c 20 74 20 26 26 20 28 6f 20 26 26 20 28 69 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 20 3d 20 22 31 70 78 20 73 6f 6c 69 64 20 72 65 64 22 29 2c 20 0a 31 20 3c 20 24 2e 74 72 69 6d 28 69 2e 76 61 6c 75 65 29 29 29 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 64 20 65 6e 74 65 72 65 64 20 69 73 20 74 72 75 65 22 29 2c 20 0a 21 28 72 20 3d 20 31 29 3b 0a 7d 20 65 6c 73 65 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 65 64 20 65 6e 74 65 72 65 64 20 69 73 20 66 61 6c 73 65 22 29 3b 0a 7d 29 3b 0a 7d 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f Data Ascii: CH FOR name"), t && (o && (i.style.border = "1px solid red"), 1 < $.trim(i.value))) return window.log_message("checkPassword: password entered is true"), !(r = 1);} else window.log_message("checkPassword: passwored entered is false");});}window.log_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49725	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	618	OUT	GET /detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	426	IN	HTTP/1.1 200 OK x-amz-id-2: 82PMpwcQMH0mMeJDQV3nooojgJKUJrKlmc83uG7kzpkieFnaBztKX8UuaPf5F6pf+MhrR8rnvEEXe4KnJjIAOjpqMvG944LD x-amz-request-id: TDNZNQZ7RDJ1PE7N Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 14:45:02 GMT ETag: "3d7be656672c16a34806c13388410325" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 9775 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	9775	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 52 65 61 6c 50 6c 61 79 65 72 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 6e 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 6d 69 6d 65 54 79 70 65 3a 20 5b 22 61 75 64 69 6f 2f 78 2d 70 6e 2d 72 65 61 6c 61 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ RealPlayer ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var n = { mimeType: ["audio/x-pn-reala

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49726	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	619	OUT	GET /detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	426	IN	HTTP/1.1 200 OK x-amz-id-2: f6sEx1KHjbypkwHmxJEtDcmy0pY2gHoBMzlcg6U2K2BzgiPoRAly1URr1RjUCPRuLS2ZrJuHTqI2CRhbzJKKAsCC8AfMFI4N x-amz-request-id: TDNMJC23KTEMHV5N Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 18:00:03 GMT ETag: "e6dd596d2bc204ea573b868b92028c26" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 4234 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	4234	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 53 69 6c 76 65 72 6c 69 67 68 74 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 77 69 6e 64 6f 77 2e 64 65 74 65 63 74 6f 72 3b 0a 20 20 20 20 76 61 72 20 68 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 67 65 74 56 65 72 73 69 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Silverlight ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = window.detector; var h = { getVersion: function() {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	428	OUT	GET /detect/flash.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	438	IN	HTTP/1.1 200 OK x-amz-id-2: 0boGZpj9DQowPHrZtVgHDhONvlCZx2hk1TLJhnrz363+BJu3wXxLeBpCyBN5GnCXd+/2vU2XfNE2xxa4z3rnf06rtduDSmxIXknzfm444vw= x-amz-request-id: TDNN8BCXGR1MBYNJ Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 03:54:01 GMT ETag: "f9ad9a096894ba248e4a1f73e7eba1be" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 6680 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	6680	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 46 6c 61 73 68 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 6d 69 6d 65 54 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68 22 2c 0a 20 20 20 20 20 20 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Flash ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var e = { mimeType: "application/x-shockwave-flash",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	432	OUT	GET /detect/quicktime.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	438	IN	HTTP/1.1 200 OK x-amz-id-2: XO5MVF61Hem6CNFpAB742LndNtN0whhZQinwVIyusbMNs/u5GzKWax6rdUDkrilZoNmtFlIvN3XUJd0DuMPcYfsutpVrdAtozmd96y6rx/8= x-amz-request-id: TDNMDSVG8XN511N5 Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 14:41:05 GMT ETag: "ee73f2f47d51116dc40b85a6b57eaf20" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 6999 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	6999	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 51 75 69 63 6b 54 69 6d 65 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 73 65 74 50 6c 75 67 69 6e 53 74 61 74 75 73 3a 20 66 75 6e 63 74 69 6f 6e 28 71 2c 20 70 2c 20 73 29 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ QuickTime ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var i = { setPluginStatus: function(q, p, s) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49729	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	436	OUT	GET /detect/plugin_detect.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	439	IN	HTTP/1.1 200 OK x-amz-id-2: CgSZ1GDkOaJb5wLyopoTuse+xcKJ1fJm5pbRLkVb338/R5TWJWFX/kwMzt4A/Uvc++QZVNra5ca0h7gEOI9oSRw3CCslL7EVf49Y7en4428= x-amz-request-id: TDNRS75GDJS7QFKW Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 17:56:07 GMT ETag: "00a513f07603df01e3b99be00f370754" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 50085 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 76 61 72 20 6a 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 76 65 72 73 69 6f 6e 3a 20 22 30 2e 39 2e 31 22 2c 0a 20 20 20 20 20 20 20 20 6e 61 6d 65 3a 20 22 50 6c 75 67 69 6e 44 65 74 65 63 74 22 2c 0a 20 20 20 20 20 20 20 20 61 64 64 50 6c 75 67 69 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 70 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ ][ isMinVersion getVersion hasMimeType getInfo ][ AllowActiveX BetterIE ]/(function() { var j = { version: "0.9.1", name: "PluginDetect", addPlugin: function(p
2025-01-07 19:02:55 UTC	585	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 63 61 74 46 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 71 2c 20 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 70 20 3d 3d 20 22 66 75 6e 63 74 69 6f 6e 22 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 Data Ascii: } } }, concatFn: function(q, p) { return function() { q(); if (typeof p == "function") { p() }
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 73 5b 75 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 5b 75 5d 20 3d 20 31 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 28 72 2c 20 71 2c 20 70 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 61 6e 64 6c 65 72 57 61 69 74 3a 20 66 75 6e 63 74 69 6f 6e 28 73 2c 20 75 2c 20 72 2c 20 71 2c 20 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 74 68 69 73 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: s[u]) { s[u] = 1; s(r, q, p) } } }, handlerWait: function(s, u, r, q, p) { var t = this; return function() {
2025-01-07 19:02:55 UTC	1024	IN	Data Raw: 20 35 30 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 65 74 44 69 76 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 68 69 73 2e 64 69 76 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 74 68 69 73 2e 64 69 76 49 44 29 20 7c 7c 20 6e 75 6c 6c 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 69 74 44 69 76 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 71 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 71 2e 64 69 76 29 20 7b 0a 20 20 20 20 20 Data Ascii: 500, getDiv: function() { return this.div \|\| document.getElementById(this.divID) \|\| null }, initDiv: function() { var q = this, p; if (!q.div) {
2025-01-07 19:02:55 UTC	10157	IN	Data Raw: 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 62 72 6f 77 73 65 72 2e 69 73 49 45 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 73 65 74 53 74 79 6c 65 28 71 2c 20 5b 22 64 69 73 70 6c 61 79 22 2c 20 22 6e 6f 6e 65 22 5d 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 63 61 74 63 68 20 28 72 29 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 Data Ascii: if (j.browser.isIE) { p.setStyle(q, ["display", "none"]) } try { q.innerHTML = "" } catch (r) {} } },
2025-01-07 19:02:55 UTC	5551	IN	Data Raw: 63 75 6d 65 6e 74 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 6a 2e 69 73 44 65 66 69 6e 65 64 28 70 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 20 3d 20 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6a 2e 69 73 53 74 72 69 6e 67 28 74 29 20 26 26 20 28 2f 5b 5e 5c 73 5d 2f 29 2e 74 65 73 74 28 74 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 72 65 70 6c 61 63 65 28 2f 5c 73 2f 67 2c 20 22 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 47 20 3d 20 6a 2e 6f 70 Data Ascii: cument } if (!j.isDefined(p)) { p = "" } if (j.isString(t) && (/[^\s]/).test(t)) { t = t.toLowerCase().replace(/\s/g, ""); G = j.op

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49730	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	427	OUT	GET /detect/java.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	439	IN	HTTP/1.1 200 OK x-amz-id-2: lIXlJ5xZ4HOaF5PWcI1/JsbTDqi1tg0JBccIRVwb4GOrdnuYn+lV2KxGJPuYOgSJISqV/LiN4ovypnj65zH5DtBehAbmYoW/mHaZ5j+1ayQ= x-amz-request-id: TDNHXH6TMQ2GFGGX Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 14:38:28 GMT ETag: "2bec0061039dc3fb25fc20aaf611d5b9" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 50717 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 4a 61 76 61 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 50 72 6f 70 65 72 74 79 5f 6e 61 6d 65 73 3a 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 50 72 6f 70 65 72 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Java ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var a = { Property_names: [], Proper
2025-01-07 19:02:55 UTC	585	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 70 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 76 65 72 73 69 6f 6e 30 20 3d 20 6a 2e 66 6f 72 6d 61 74 4e 75 6d 28 6a 2e 67 65 74 4e 75 6d 28 70 29 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 76 20 26 26 20 21 71 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 76 65 72 73 69 6f 6e 20 3d 20 6a 2e 66 6f 72 6d 61 74 4e 75 6d 28 6a 2e 67 65 74 4e 75 6d 28 76 29 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 77 20 26 26 20 6a 2e 69 73 53 74 72 69 6e 67 28 77 29 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: } } if (p) { t.version0 = j.formatNum(j.getNum(p)) } if (v && !q) { t.version = j.formatNum(j.getNum(v)) } if (w && j.isString(w)) {
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 74 56 65 72 73 69 6f 6e 44 6f 6e 65 20 3d 20 30 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 67 65 74 56 65 72 73 69 6f 6e 44 6f 6e 65 20 3d 20 74 2e 61 70 70 6c 65 74 2e 63 61 6e 5f 49 6e 73 65 72 74 5f 51 75 65 72 79 5f 41 6e 79 28 29 20 3f 20 30 20 3a 20 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 57 65 62 53 74 61 72 74 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 61 73 52 75 6e 3a 20 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 73 69 6f Data Ascii: tVersionDone = 0 } else { t.getVersionDone = t.applet.can_Insert_Query_Any() ? 0 : 1 } } } }, WebStart: { hasRun: 0, versio
2025-01-07 19:02:55 UTC	1024	IN	Data Raw: 20 69 66 20 28 72 5b 70 20 2d 20 31 5d 20 3e 20 33 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 5b 70 20 2d 20 31 5d 20 3d 20 33 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 61 6c 6c 6f 77 65 64 5b 70 5d 20 3d 20 72 5b 70 20 2d 20 31 5d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 2e 61 6c 6c 6f 77 65 64 5b 30 5d 20 3d 20 71 2e 61 6c 6c 6f 77 65 64 5b 33 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: if (r[p - 1] > 3) { r[p - 1] = 3 } q.allowed[p] = r[p - 1] } } q.allowed[0] = q.allowed[3];
2025-01-07 19:02:55 UTC	10157	IN	Data Raw: 73 45 6e 61 62 6c 65 64 2e 6f 62 6a 65 63 74 54 61 67 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 71 20 3d 3d 20 32 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 70 2e 41 70 70 6c 65 74 54 61 67 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 71 20 3d 3d 3d 20 30 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 6a 2e 63 6f 64 65 62 61 73 65 2e 69 73 44 69 73 61 62 6c 65 64 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d Data Ascii: sEnabled.objectTag() } if (q == 2) { return p.AppletTag() } if (q === 0) { return j.codebase.isDisabled() }
2025-01-07 19:02:55 UTC	6183	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 71 20 3d 20 30 3b 20 71 20 3c 20 70 2e 6c 65 6e 67 74 68 3b 20 71 2b 2b 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 70 5b 71 5d 20 26 26 20 70 5b 71 5d 2e 6c 6f 61 64 65 64 20 21 3d 3d 20 6e 75 6c 6c 20 26 26 20 21 70 5b 71 5d 2e 6c 6f 61 64 65 64 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 30 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 31 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 71 75 65 72 79 52 65 61 64 79 53 74 61 Data Ascii: for (q = 0; q < p.length; q++) { if (p[q] && p[q].loaded !== null && !p[q].loaded) { return 0 } } return 1 }, queryReadySta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49731	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	426	OUT	GET /detect/pdf.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	439	IN	HTTP/1.1 200 OK x-amz-id-2: X8F6Unf6OLjgYJoEDSCd2HUJTCh/xOeX5hkiFXULrH9oDLVI95YthrcZ+7f1QcEqXW8Cj79bVVspwShN9lmYUGJ0rV//crDVOlXAwcaXKjE= x-amz-request-id: TDNS7HENNJ1CE760 Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 14:39:34 GMT ETag: "0d5882d41c8b6e40059c8d9acbcf1518" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 22855 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	8534	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 41 64 6f 62 65 52 65 61 64 65 72 20 50 44 46 6a 73 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 63 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 4f 54 46 3a 20 6e 75 6c 6c 2c 0a 20 20 20 20 20 20 20 20 73 65 74 50 6c 75 67 69 6e 53 74 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ AdobeReader PDFjs ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX ]/(function() { j = PluginDetect; var c = { OTF: null, setPluginSt
2025-01-07 19:02:55 UTC	14321	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 76 20 3d 20 63 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 20 3d 20 6a 2e 44 4f 4d 2e 61 6c 74 48 54 4d 4c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 20 3d 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2c 20 78 2c 20 77 2c 20 74 2c 20 75 20 3d 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 71 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 79 2e 69 73 44 69 73 61 62 6c 65 64 28 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 79 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 6a 2e 44 Data Ascii: v = c, p = j.DOM.altHTML, r = 1, s, x, w, t, u = 1, q; if (y.isDisabled()) { return y } s = j.D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49733	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	449	OUT	GET /assets/ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:02:55 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:02:55 GMT Content-Type: application/javascript Content-Length: 92629 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:02:55 UTC	15998	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 39 2e 31 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 32 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 2f 2f 40 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 6a 71 75 65 72 79 2e 6d 69 6e 2e 6d 61 70 0a 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 74 79 70 65 6f 66 20 74 2c 6f 3d 65 2e 64 6f 63 75 6d 65 6e 74 2c 61 3d 65 2e 6c 6f 63 61 74 69 6f 6e 2c 73 3d 65 2e 6a 51 75 65 72 79 2c 75 3d 65 2e 24 2c 6c 3d 7b 7d 2c 63 3d 5b 5d 2c 70 3d 22 31 2e 39 2e 31 22 2c 66 3d 63 2e 63 6f 6e 63 61 74 2c 64 3d 63 2e 70 75 73 68 2c 68 3d 63 2e 73 6c 69 63 65 2c 67 3d 63 2e 69 6e 64 65 78 4f Data Ascii: /! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license//@ sourceMappingURL=jquery.min.map/(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexO
2025-01-07 19:02:55 UTC	16379	IN	Data Raw: 61 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 57 28 65 2c 6e 2c 72 29 7b 69 66 28 72 3d 3d 3d 74 26 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 69 3d 22 64 61 74 61 2d 22 2b 6e 2e 72 65 70 6c 61 63 65 28 42 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 72 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 69 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 72 29 7b 74 72 79 7b 72 3d 22 74 72 75 65 22 3d 3d 3d 72 3f 21 30 3a 22 66 61 6c 73 65 22 3d 3d 3d 72 3f 21 31 3a 22 6e 75 6c 6c 22 3d 3d 3d 72 3f 6e 75 6c 6c 3a 2b 72 2b 22 22 3d 3d 3d 72 3f 2b 72 3a 4f 2e 74 65 73 74 28 72 29 3f 62 2e 70 61 72 73 65 4a 53 4f 4e 28 72 29 3a 72 7d 63 61 74 63 68 28 6f 29 7b 7d 62 2e 64 61 74 Data Ascii: a(this,e)})}});function W(e,n,r){if(r===t&&1===e.nodeType){var i="data-"+n.replace(B,"-$1").toLowerCase();if(r=e.getAttribute(i),"string"==typeof r){try{r="true"===r?!0:"false"===r?!1:"null"===r?null:+r+""===r?+r:O.test(r)?b.parseJSON(r):r}catch(o){}b.dat
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 62 2e 6e 6f 64 65 4e 61 6d 65 28 74 68 69 73 2c 22 66 6f 72 6d 22 29 3f 21 31 3a 28 62 2e 65 76 65 6e 74 2e 61 64 64 28 74 68 69 73 2c 22 63 6c 69 63 6b 2e 5f 73 75 62 6d 69 74 20 6b 65 79 70 72 65 73 73 2e 5f 73 75 62 6d 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 74 61 72 67 65 74 2c 72 3d 62 2e 6e 6f 64 65 4e 61 6d 65 28 6e 2c 22 69 6e 70 75 74 22 29 7c 7c 62 2e 6e 6f 64 65 4e 61 6d 65 28 6e 2c 22 62 75 74 74 6f 6e 22 29 3f 6e 2e 66 6f 72 6d 3a 74 3b 72 26 26 21 62 2e 5f 64 61 74 61 28 72 2c 22 73 75 62 6d 69 74 42 75 62 62 6c 65 73 22 29 26 26 28 62 2e 65 76 65 6e 74 2e 61 64 64 28 72 2c 22 73 75 62 6d 69 74 2e 5f 73 75 62 6d 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 5f 73 75 62 6d 69 Data Ascii: ){return b.nodeName(this,"form")?!1:(b.event.add(this,"click._submit keypress._submit",function(e){var n=e.target,r=b.nodeName(n,"input")\|\|b.nodeName(n,"button")?n.form:t;r&&!b._data(r,"submitBubbles")&&(b.event.add(r,"submit._submit",function(e){e._submi
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 3b 29 65 2e 70 75 73 68 28 72 29 3b 72 65 74 75 72 6e 20 65 7d 29 7d 7d 3b 66 6f 72 28 6e 20 69 6e 7b 72 61 64 69 6f 3a 21 30 2c 63 68 65 63 6b 62 6f 78 3a 21 30 2c 66 69 6c 65 3a 21 30 2c 70 61 73 73 77 6f 72 64 3a 21 30 2c 69 6d 61 67 65 3a 21 30 7d 29 69 2e 70 73 65 75 64 6f 73 5b 6e 5d 3d 6c 74 28 6e 29 3b 66 6f 72 28 6e 20 69 6e 7b 73 75 62 6d 69 74 3a 21 30 2c 72 65 73 65 74 3a 21 30 7d 29 69 2e 70 73 65 75 64 6f 73 5b 6e 5d 3d 63 74 28 6e 29 3b 66 75 6e 63 74 69 6f 6e 20 66 74 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 45 5b 65 2b 22 20 22 5d 3b 69 66 28 63 29 72 65 74 75 72 6e 20 74 3f 30 3a 63 2e 73 6c 69 63 65 28 30 29 3b 73 3d 65 2c 75 3d 5b 5d 2c 6c 3d 69 2e 70 72 65 46 69 6c 74 65 72 3b 77 68 69 6c 65 28 73 Data Ascii: ;)e.push(r);return e})}};for(n in{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})i.pseudos[n]=lt(n);for(n in{submit:!0,reset:!0})i.pseudos[n]=ct(n);function ft(e,t){var n,r,o,a,s,u,l,c=E[e+" "];if(c)return t?0:c.slice(0);s=e,u=[],l=i.preFilter;while(s
2025-01-07 19:02:55 UTC	16384	IN	Data Raw: 2a 29 24 22 2c 22 69 22 29 2c 59 74 3d 52 65 67 45 78 70 28 22 5e 28 22 2b 78 2b 22 29 28 3f 21 70 78 29 5b 61 2d 7a 25 5d 2b 24 22 2c 22 69 22 29 2c 4a 74 3d 52 65 67 45 78 70 28 22 5e 28 5b 2b 2d 5d 29 3d 28 22 2b 78 2b 22 29 22 2c 22 69 22 29 2c 47 74 3d 7b 42 4f 44 59 3a 22 62 6c 6f 63 6b 22 7d 2c 51 74 3d 7b 70 6f 73 69 74 69 6f 6e 3a 22 61 62 73 6f 6c 75 74 65 22 2c 76 69 73 69 62 69 6c 69 74 79 3a 22 68 69 64 64 65 6e 22 2c 64 69 73 70 6c 61 79 3a 22 62 6c 6f 63 6b 22 7d 2c 4b 74 3d 7b 6c 65 74 74 65 72 53 70 61 63 69 6e 67 3a 30 2c 66 6f 6e 74 57 65 69 67 68 74 3a 34 30 30 7d 2c 5a 74 3d 5b 22 54 6f 70 22 2c 22 52 69 67 68 74 22 2c 22 42 6f 74 74 6f 6d 22 2c 22 4c 65 66 74 22 5d 2c 65 6e 3d 5b 22 57 65 62 6b 69 74 22 2c 22 4f 22 2c 22 4d 6f 7a 22 Data Ascii: *)$","i"),Yt=RegExp("^("+x+")(?!px)[a-z%]+$","i"),Jt=RegExp("^([+-])=("+x+")","i"),Gt={BODY:"block"},Qt={position:"absolute",visibility:"hidden",display:"block"},Kt={letterSpacing:0,fontWeight:400},Zt=["Top","Right","Bottom","Left"],en=["Webkit","O","Moz"
2025-01-07 19:02:55 UTC	11100	IN	Data Raw: 21 52 6e 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 52 6e 2c 52 6e 3d 62 2e 73 75 70 70 6f 72 74 2e 61 6a 61 78 3d 21 21 52 6e 2c 52 6e 26 26 62 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 21 6e 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 62 2e 73 75 70 70 6f 72 74 2e 63 6f 72 73 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 29 7b 76 61 72 20 61 2c 73 2c 75 3d 6e 2e 78 68 72 28 29 3b 69 66 28 6e 2e 75 73 65 72 6e 61 6d 65 3f 75 2e 6f 70 65 6e 28 6e 2e 74 79 70 65 2c 6e 2e 75 72 6c 2c 6e 2e 61 73 79 6e 63 2c 6e 2e 75 73 65 72 6e 61 6d 65 2c 6e 2e 70 61 73 73 77 6f 72 64 29 3a 75 2e 6f 70 65 6e 28 6e 2e 74 79 70 65 2c 6e 2e 75 72 6c 2c 6e 2e Data Ascii: !Rn&&"withCredentials"in Rn,Rn=b.support.ajax=!!Rn,Rn&&b.ajaxTransport(function(n){if(!n.crossDomain\|\|b.support.cors){var r;return{send:function(i,o){var a,s,u=n.xhr();if(n.username?u.open(n.type,n.url,n.async,n.username,n.password):u.open(n.type,n.url,n.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49735	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	433	OUT	GET /detect/realplayer.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	438	IN	HTTP/1.1 200 OK x-amz-id-2: d6CIZsa3vUtVZmFP6V9UDLXQfZAyo27BhNGxELVSKOZSXiiJ2/vrrubajWuGbKheBfj+aR39Tl9bYGlaDE8AEmbY1ILs2X6drIy1S44QV08= x-amz-request-id: TDNH1GKMA4CMEEXG Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 14:45:02 GMT ETag: "3d7be656672c16a34806c13388410325" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 9775 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	9775	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 52 65 61 6c 50 6c 61 79 65 72 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 6e 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 6d 69 6d 65 54 79 70 65 3a 20 5b 22 61 75 64 69 6f 2f 78 2d 70 6e 2d 72 65 61 6c 61 Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ RealPlayer ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var n = { mimeType: ["audio/x-pn-reala

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49736	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	434	OUT	GET /detect/silverlight.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:02:55 UTC	438	IN	HTTP/1.1 200 OK x-amz-id-2: yZ1MDf+Zg1XVcZpcMzbha27Ekd1db1oHcMHo2Ycxe0DDR+YszbX4WiQq+AS3PbgIsWXmCQfqj4Um68+cXI5jSnPVIVRy6prxcXikn9rgva8= x-amz-request-id: TDNSSWYJ1662YGKA Date: Tue, 07 Jan 2025 19:02:56 GMT Last-Modified: Wed, 15 Feb 2017 18:00:03 GMT ETag: "e6dd596d2bc204ea573b868b92028c26" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 4234 Server: AmazonS3 Connection: close
2025-01-07 19:02:55 UTC	4234	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 53 69 6c 76 65 72 6c 69 67 68 74 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 77 69 6e 64 6f 77 2e 64 65 74 65 63 74 6f 72 3b 0a 20 20 20 20 76 61 72 20 68 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 67 65 74 56 65 72 73 69 6f 6e 3a 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ Silverlight ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = window.detector; var h = { getVersion: function() {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49734	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:02:55 UTC	432	OUT	GET /assets/all.js?g=65d1199738 HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:02:55 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:02:55 GMT Content-Type: application/javascript Content-Length: 28356 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:02:55 UTC	15998	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 7c 7c 20 28 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 3d 20 22 22 29 2c 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 65 72 72 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 65 2c 20 69 29 20 7b 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f 74 6f 5f 63 6f 6e 73 6f 6c 65 28 69 29 2c 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 2b 20 22 2f 6c 6f 67 3f 69 64 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 74 72 61 63 6b 69 6e 67 5f 69 64 29 20 2b 20 22 26 73 65 76 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 Data Ascii: (function() {window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e)
2025-01-07 19:02:56 UTC	12358	IN	Data Raw: 43 48 20 46 4f 52 20 6e 61 6d 65 22 29 2c 20 74 20 26 26 20 28 6f 20 26 26 20 28 69 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 20 3d 20 22 31 70 78 20 73 6f 6c 69 64 20 72 65 64 22 29 2c 20 0a 31 20 3c 20 24 2e 74 72 69 6d 28 69 2e 76 61 6c 75 65 29 29 29 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 64 20 65 6e 74 65 72 65 64 20 69 73 20 74 72 75 65 22 29 2c 20 0a 21 28 72 20 3d 20 31 29 3b 0a 7d 20 65 6c 73 65 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 65 64 20 65 6e 74 65 72 65 64 20 69 73 20 66 61 6c 73 65 22 29 3b 0a 7d 29 3b 0a 7d 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f Data Ascii: CH FOR name"), t && (o && (i.style.border = "1px solid red"), 1 < $.trim(i.value))) return window.log_message("checkPassword: password entered is true"), !(r = 1);} else window.log_message("checkPassword: passwored entered is false");});}window.log_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49805	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	792	OUT	POST /secure/browser_post HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive Content-Length: 1902 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://hallmark.greetingsweb.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	1902	OUT	Data Raw: 74 6f 6b 65 6e 3d 25 37 42 25 32 32 67 75 69 64 25 32 32 25 33 41 25 32 32 36 35 64 31 31 39 39 37 33 38 25 32 32 25 32 43 25 32 32 70 72 6f 70 65 72 74 79 25 32 32 25 33 41 25 32 32 61 6c 6c 49 6e 66 6f 25 32 32 25 32 43 25 32 32 76 61 6c 75 65 25 32 32 25 33 41 25 37 42 25 32 32 62 72 6f 77 73 65 72 5f 64 65 74 61 69 6c 73 25 32 32 25 33 41 25 37 42 25 32 32 62 72 6f 77 73 65 72 25 32 32 25 33 41 25 32 32 43 68 72 6f 6d 65 25 32 32 25 32 43 25 32 32 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 25 32 32 25 33 41 25 32 32 31 31 37 2e 30 2e 30 2e 30 25 32 32 25 32 43 25 32 32 6f 73 25 32 32 25 33 41 25 32 32 57 69 6e 64 6f 77 73 25 32 32 25 32 43 25 32 32 6f 73 5f 76 65 72 73 69 6f 6e 25 32 32 25 33 41 25 32 32 31 30 25 32 32 25 32 43 25 32 32 68 61 73 4c Data Ascii: token=%7B%22guid%22%3A%2265d1199738%22%2C%22property%22%3A%22allInfo%22%2C%22value%22%3A%7B%22browser_details%22%3A%7B%22browser%22%3A%22Chrome%22%2C%22browser_version%22%3A%22117.0.0.0%22%2C%22os%22%3A%22Windows%22%2C%22os_version%22%3A%2210%22%2C%22hasL
2025-01-07 19:03:14 UTC	656	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Cache-Control: no-cache X-Request-Id: a53b19f2-bb6f-4d43-a3d5-8ac2a8d5a0ee X-Runtime: 0.007681 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49809	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	794	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: e60871ff-4f4f-416a-8c13-fb2e38bd5bcd X-Runtime: 0.001739 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49810	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	796	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 67043625-44ef-493a-aba0-86feb612fe24 X-Runtime: 0.001751 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49807	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	792	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: d11f75fd-81e5-4eb4-908b-e5ba4789fe7d X-Runtime: 0.001768 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49808	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	791	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 59ed0b50-f03b-4af1-9f5f-9cbbde4ae4eb X-Runtime: 0.001995 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49806	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	796	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:14 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: dc24f0f7-4e7d-40c8-924a-5549ac8b29a1 X-Runtime: 0.001859 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49803	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:14 UTC	426	OUT	GET /detect/wmp.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:14 UTC	438	IN	HTTP/1.1 200 OK x-amz-id-2: yOhUGqfyVpYNdhpEszmcj7VVcKY0CKitw/D26QeafsquAME1+JU7vigyjIGc6vYLWdfGEbpqmKXTeBJNsPFqMGcuXmyJr3e28r+KDF0JJcE= x-amz-request-id: 58MX2YXFP1VFPAMH Date: Tue, 07 Jan 2025 19:03:15 GMT Last-Modified: Wed, 15 Feb 2017 15:07:14 GMT ETag: "ffd2cc77bb64d40beeb5d561fffe1f79" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/javascript Content-Length: 5941 Server: AmazonS3 Connection: close
2025-01-07 19:03:14 UTC	5941	IN	Data Raw: 2f 2a 0a 50 6c 75 67 69 6e 44 65 74 65 63 74 20 76 30 2e 39 2e 31 0a 77 77 77 2e 70 69 6e 6c 61 64 79 2e 6e 65 74 2f 50 6c 75 67 69 6e 44 65 74 65 63 74 2f 6c 69 63 65 6e 73 65 2f 0a 5b 20 57 69 6e 64 6f 77 73 4d 65 64 69 61 50 6c 61 79 65 72 20 5d 0a 5b 20 69 73 4d 69 6e 56 65 72 73 69 6f 6e 20 67 65 74 56 65 72 73 69 6f 6e 20 68 61 73 4d 69 6d 65 54 79 70 65 20 67 65 74 49 6e 66 6f 20 6f 6e 44 65 74 65 63 74 69 6f 6e 44 6f 6e 65 20 5d 0a 5b 20 41 6c 6c 6f 77 41 63 74 69 76 65 58 20 42 65 74 74 65 72 49 45 20 5d 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 6a 20 3d 20 50 6c 75 67 69 6e 44 65 74 65 63 74 3b 0a 20 20 20 20 76 61 72 20 6f 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 73 65 74 50 6c 75 67 69 6e 53 74 61 74 75 73 3a 20 66 75 6e Data Ascii: /PluginDetect v0.9.1www.pinlady.net/PluginDetect/license/[ WindowsMediaPlayer ][ isMinVersion getVersion hasMimeType getInfo onDetectionDone ][ AllowActiveX BetterIE ]/(function() { j = PluginDetect; var o = { setPluginStatus: fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49814	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	425	OUT	GET /secure/browser_post HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	372	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2511 Connection: close Vary: Accept-Encoding X-Request-Id: 78173096-1c4d-401b-82da-30c77a8cb4f3 X-Runtime: 0.000859 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server
2025-01-07 19:03:15 UTC	2511	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 74 65 73 74 5f 6d 6f 64 65 20 3d 20 74 72 75 65 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 0a 20 20 20 20 20 20 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><html> <head> <script>window.test_mode = true;</script> <title> The page cannot be found </title> <meta http-equiv="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49816	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	527	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5699e909-4c6c-4d92-9650-4ad9cec9a6cb X-Runtime: 0.002111 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49818	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	529	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ccf41115-5816-47ab-a951-6078e5f5ffef X-Runtime: 0.002048 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49824	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	524	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ce5ba71b-da8e-46d6-afdb-b3d2b8600717 X-Runtime: 0.001759 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49821	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	525	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ae229173-0338-42e1-a74d-413030efe86f X-Runtime: 0.002160 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49822	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	529	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: e8b68b96-023c-42c1-930c-51f61ff4531b X-Runtime: 0.002092 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49813	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	885	OUT	GET /load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	713	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin ETag: W/"f7f854f645c5b7b561dd19805c0e8ae7" Cache-Control: max-age=0, private, must-revalidate X-Request-Id: 90468368-512e-4274-80bf-52a651446bda X-Runtime: 0.012269 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	8260	IN	Data Raw: 32 30 33 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 20 64 61 74 61 2d 74 65 78 74 3d 22 74 69 74 6c 65 22 3e 59 6f 75 20 68 61 76 65 20 62 65 65 6e 20 50 68 69 73 68 65 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 Data Ascii: 203c<!doctype html><html lang="en"><head><meta charset="UTF-8" /><title data-text="title">You have been Phished!</title><link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700" rel="stylesheet" type="text/css" /><link href="https://t
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49819	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	787	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: f70f4e79-d8ea-40ff-871a-487fdaa2221d X-Runtime: 0.001625 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49820	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	790	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49817	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	791	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:15 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 12aa01da-c003-43e2-9478-d3ef4093070a X-Runtime: 0.002198 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49815	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	790	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49823	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	787	OUT	GET /trace?id=65d1199738&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/2865d1125997389a?l=22 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49830	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	723	OUT	GET /assets/ajax/libs/jquery/1.11.0/jquery.min.js HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:16 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: application/javascript Content-Length: 96381 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:03:16 UTC	15998	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 31 31 2e 30 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e Data Ascii: /! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a win
2025-01-07 19:03:16 UTC	16379	IN	Data Raw: 62 3d 5b 5d 2c 63 3d 5b 5d 2c 64 3d 67 28 61 2e 72 65 70 6c 61 63 65 28 50 2c 22 24 31 22 29 29 3b 72 65 74 75 72 6e 20 64 5b 73 5d 3f 66 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 65 29 7b 76 61 72 20 66 2c 67 3d 64 28 61 2c 6e 75 6c 6c 2c 65 2c 5b 5d 29 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 28 66 3d 67 5b 68 5d 29 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c 2c 66 2c 63 29 2c 21 63 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 66 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 64 62 28 61 2c 62 29 2e 6c 65 6e 67 74 68 3e Data Ascii: b=[],c=[],d=g(a.replace(P,"$1"));return d[s]?fb(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),!c.pop()}}),has:fb(function(a){return function(b){return db(a,b).length>
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 20 62 3f 28 66 3d 67 5b 62 5d 2c 6e 75 6c 6c 3d 3d 66 26 26 28 66 3d 67 5b 6e 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 5d 29 29 3a 66 3d 67 2c 66 0a 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 28 61 2c 62 2c 63 29 7b 69 66 28 6e 2e 61 63 63 65 70 74 44 61 74 61 28 61 29 29 7b 76 61 72 20 64 2c 65 2c 66 3d 61 2e 6e 6f 64 65 54 79 70 65 2c 67 3d 66 3f 6e 2e 63 61 63 68 65 3a 61 2c 68 3d 66 3f 61 5b 6e 2e 65 78 70 61 6e 64 6f 5d 3a 6e 2e 65 78 70 61 6e 64 6f 3b 69 66 28 67 5b 68 5d 29 7b 69 66 28 62 26 26 28 64 3d 63 3f 67 5b 68 5d 3a 67 5b 68 5d 2e 64 61 74 61 29 29 7b 6e 2e 69 73 41 72 72 61 79 28 62 29 3f 62 3d 62 2e 63 6f 6e 63 61 74 28 6e 2e 6d 61 70 28 62 2c 6e 2e 63 61 6d 65 6c 43 61 73 65 29 29 3a 62 20 69 6e 20 64 3f 62 3d 5b 62 5d 3a 28 62 3d 6e 2e 63 61 6d Data Ascii: b?(f=g[b],null==f&&(f=g[n.camelCase(b)])):f=g,f}}function S(a,b,c){if(n.acceptData(a)){var d,e,f=a.nodeType,g=f?n.cache:a,h=f?a[n.expando]:n.expando;if(g[h]){if(b&&(d=c?g[h]:g[h].data)){n.isArray(b)?b=b.concat(n.map(b,n.camelCase)):b in d?b=[b]:(b=n.cam
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 21 3d 3d 4c 3f 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 62 7c 7c 22 2a 22 29 3a 76 6f 69 64 20 30 3b 69 66 28 21 66 29 66 6f 72 28 66 3d 5b 5d 2c 63 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 7c 7c 61 3b 6e 75 6c 6c 21 3d 28 64 3d 63 5b 65 5d 29 3b 65 2b 2b 29 21 62 7c 7c 6e 2e 6e 6f 64 65 4e 61 6d 65 28 64 2c 62 29 3f 66 2e 70 75 73 68 28 64 29 3a 6e 2e 6d 65 72 67 65 28 66 2c 76 62 28 64 2c 62 29 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 62 7c 7c 62 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 28 61 2c 62 29 3f 6e 2e 6d 65 72 67 65 28 5b 61 5d 2c 66 29 3a 66 7d 66 75 6e 63 74 69 6f 6e 20 77 62 28 61 29 7b 58 2e 74 65 73 74 28 61 2e 74 79 70 65 29 26 26 28 61 2e 64 65 66 61 75 6c 74 43 Data Ascii: a.querySelectorAll!==L?a.querySelectorAll(b\|\|"*"):void 0;if(!f)for(f=[],c=a.childNodes\|\|a;null!=(d=c[e]);e++)!b\|\|n.nodeName(d,b)?f.push(d):n.merge(f,vb(d,b));return void 0===b\|\|b&&n.nodeName(a,b)?n.merge([a],f):f}function wb(a){X.test(a.type)&&(a.defaultC
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 74 68 69 73 2e 65 61 73 69 6e 67 5d 28 61 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 2a 61 2c 30 2c 31 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 29 3a 61 2c 74 68 69 73 2e 6e 6f 77 3d 28 74 68 69 73 2e 65 6e 64 2d 74 68 69 73 2e 73 74 61 72 74 29 2a 62 2b 74 68 69 73 2e 73 74 61 72 74 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 74 65 70 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 74 65 70 2e 63 61 6c 6c 28 74 68 69 73 2e 65 6c 65 6d 2c 74 68 69 73 2e 6e 6f 77 2c 74 68 69 73 29 2c 63 26 26 63 2e 73 65 74 3f 63 2e 73 65 74 28 74 68 69 73 29 3a 24 62 2e 70 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 73 65 74 28 74 68 69 73 29 2c 74 68 69 73 7d 7d 2c 24 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 Data Ascii: this.easing](a,this.options.durationa,0,1,this.options.duration):a,this.now=(this.end-this.start)b+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),c&&c.set?c.set(this):$b.propHooks._default.set(this),this}},$b.prototype.ini
2025-01-07 19:03:16 UTC	14852	IN	Data Raw: 26 26 28 63 3d 62 2c 62 3d 22 2a 22 29 3b 76 61 72 20 64 2c 65 3d 30 2c 66 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 6d 61 74 63 68 28 46 29 7c 7c 5b 5d 3b 69 66 28 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 63 29 29 77 68 69 6c 65 28 64 3d 66 5b 65 2b 2b 5d 29 22 2b 22 3d 3d 3d 64 2e 63 68 61 72 41 74 28 30 29 3f 28 64 3d 64 2e 73 6c 69 63 65 28 31 29 7c 7c 22 2a 22 2c 28 61 5b 64 5d 3d 61 5b 64 5d 7c 7c 5b 5d 29 2e 75 6e 73 68 69 66 74 28 63 29 29 3a 28 61 5b 64 5d 3d 61 5b 64 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 63 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 63 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 7d 2c 66 3d 61 3d 3d 3d 4a 63 3b 66 75 6e 63 74 69 6f 6e 20 67 28 68 29 7b 76 61 72 20 69 3b 72 65 74 75 72 6e 20 65 5b 68 5d 3d 21 30 2c 6e 2e Data Ascii: &&(c=b,b="");var d,e=0,f=b.toLowerCase().match(F)\|\|[];if(n.isFunction(c))while(d=f[e++])"+"===d.charAt(0)?(d=d.slice(1)\|\|"",(a[d]=a[d]\|\|[]).unshift(c)):(a[d]=a[d]\|\|[]).push(c)}}function Nc(a,b,c,d){var e={},f=a===Jc;function g(h){var i;return e[h]=!0,n.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49835	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:15 UTC	760	OUT	GET /assets/all.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:16 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:15 GMT Content-Type: application/javascript Content-Length: 28356 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:03:16 UTC	15998	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 7c 7c 20 28 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 3d 20 22 22 29 2c 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 65 72 72 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 65 2c 20 69 29 20 7b 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f 74 6f 5f 63 6f 6e 73 6f 6c 65 28 69 29 2c 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 2b 20 22 2f 6c 6f 67 3f 69 64 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 74 72 61 63 6b 69 6e 67 5f 69 64 29 20 2b 20 22 26 73 65 76 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 Data Ascii: (function() {window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e)
2025-01-07 19:03:16 UTC	12358	IN	Data Raw: 43 48 20 46 4f 52 20 6e 61 6d 65 22 29 2c 20 74 20 26 26 20 28 6f 20 26 26 20 28 69 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 20 3d 20 22 31 70 78 20 73 6f 6c 69 64 20 72 65 64 22 29 2c 20 0a 31 20 3c 20 24 2e 74 72 69 6d 28 69 2e 76 61 6c 75 65 29 29 29 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 64 20 65 6e 74 65 72 65 64 20 69 73 20 74 72 75 65 22 29 2c 20 0a 21 28 72 20 3d 20 31 29 3b 0a 7d 20 65 6c 73 65 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 65 64 20 65 6e 74 65 72 65 64 20 69 73 20 66 61 6c 73 65 22 29 3b 0a 7d 29 3b 0a 7d 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f Data Ascii: CH FOR name"), t && (o && (i.style.border = "1px solid red"), 1 < $.trim(i.value))) return window.log_message("checkPassword: password entered is true"), !(r = 1);} else window.log_message("checkPassword: passwored entered is false");});}window.log_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49842	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:16 UTC	372	OUT	GET /languages/language.18071.js HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:16 UTC	511	IN	HTTP/1.1 200 OK x-amz-id-2: emuB0UZR88EDQIgOWDlpmttGoHyoQNIuAWcwH4+ZLFdjYOWeAuL/vkWmqIbDgyVHR/MSYs58VWsUxyz33JW01z3hJ+CmVIMVv0jubh7i484= x-amz-request-id: X4NKQW184049KY0Q Date: Tue, 07 Jan 2025 19:03:17 GMT Last-Modified: Fri, 26 Aug 2022 14:07:38 GMT ETag: "8b9a9d305bd69c962b600c08f3c69edf" x-amz-server-side-encryption: AES256 x-amz-version-id: U_kpSjDDW4npfowvZPZnd2_aKVkUaKPA Accept-Ranges: bytes Content-Type: application/javascript Content-Length: 8207 Server: AmazonS3 Connection: close
2025-01-07 19:03:16 UTC	8207	IN	Data Raw: 6a 51 75 65 72 79 2e 73 75 70 70 6f 72 74 2e 63 6f 72 73 20 3d 20 74 72 75 65 3b 0a 0a 77 69 6e 64 6f 77 2e 75 70 64 61 74 65 50 61 67 65 20 3d 20 66 75 6e 63 74 69 6f 6e 28 6c 61 6e 67 75 61 67 65 2c 20 64 61 74 61 29 20 7b 0a 20 20 76 61 72 20 64 69 72 65 63 74 69 6f 6e 20 3d 20 64 61 74 61 2e 64 69 72 20 7c 7c 20 22 6c 74 72 22 3b 0a 20 20 76 61 72 20 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 20 3d 20 77 69 6e 64 6f 77 2e 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 20 7c 7c 20 22 25 43 4f 4d 50 41 4e 59 25 22 3b 0a 20 20 76 61 72 20 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 5f 70 6f 73 73 65 73 73 69 76 65 20 3d 20 77 69 6e 64 6f 77 2e 63 6f 6d 70 61 6e 79 5f 6e 61 6d 65 5f 70 6f 73 73 65 73 73 69 76 65 20 7c 7c 20 22 25 43 4f 4d 50 41 4e 59 27 73 25 22 3b 0a 0a 20 20 24 Data Ascii: jQuery.support.cors = true;window.updatePage = function(language, data) { var direction = data.dir \|\| "ltr"; var company_name = window.company_name \|\| "%COMPANY%"; var company_name_possessive = window.company_name_possessive \|\| "%COMPANY's%"; $

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49843	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:16 UTC	366	OUT	GET /assets/js/training.js HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:16 UTC	510	IN	HTTP/1.1 200 OK x-amz-id-2: LVgJIY/dnLPvyFcnZdDNiqzi4XNCCq3z/a27Eca0QhrWj9D5d4pC6SBRgyrYYzvZtvqI3JCAQ0thqOztOsdUfzAzvEZONX/qRUr7FhuAB8c= x-amz-request-id: X4NGHBBH0BT6A2KG Date: Tue, 07 Jan 2025 19:03:17 GMT Last-Modified: Fri, 26 Aug 2022 14:07:38 GMT ETag: "029ab28ca3c245dc425e3f3f6599d480" x-amz-server-side-encryption: AES256 x-amz-version-id: 6KvPBARKn9Wl5VW3Hl_LtK2bIq68QrGH Accept-Ranges: bytes Content-Type: application/javascript Content-Length: 352 Server: AmazonS3 Connection: close
2025-01-07 19:03:16 UTC	352	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 24 28 27 23 74 72 61 69 6e 69 6e 67 2d 66 6f 72 6d 27 29 2e 70 72 6f 70 28 27 61 63 74 69 6f 6e 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 69 2c 20 76 61 6c 29 20 7b 0a 20 20 20 20 76 61 72 20 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 20 3d 20 6e 65 77 20 52 65 67 45 78 70 28 27 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 3d 28 5b 5e 26 23 5d 2a 29 27 29 2e 65 78 65 63 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 0a 20 20 20 20 69 66 20 28 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 20 3d 3d 3d 20 6e 75 6c 6c 29 20 7b 0a 20 20 20 20 20 20 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 20 3d 20 22 22 3b 0a 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a Data Ascii: $(document).ready(function () { $('#training-form').prop('action', function (i, val) { var correlation_id = new RegExp('correlation_id=([^&#]*)').exec(window.location.href); if (correlation_id === null) { correlation_id = ""; } else {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49832	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:16 UTC	873	OUT	GET /trace?id=undefined&msg=window.tracking_id%20is%20not%20set%2C%20let%27s%20get%20it&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:16 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: c5515e7a-d206-4f69-a944-c3e02f5d29c9 X-Runtime: 0.001801 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49846	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:16 UTC	487	OUT	GET /assets/all.js?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:16 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:16 GMT Content-Type: application/javascript Content-Length: 28356 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:03:16 UTC	15998	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 7c 7c 20 28 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 3d 20 22 22 29 2c 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 65 72 72 6f 72 20 3d 20 66 75 6e 63 74 69 6f 6e 28 65 2c 20 69 29 20 7b 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f 74 6f 5f 63 6f 6e 73 6f 6c 65 28 69 29 2c 20 6e 65 77 20 49 6d 61 67 65 28 29 2e 73 72 63 20 3d 20 77 69 6e 64 6f 77 2e 62 61 73 65 5f 70 6f 73 74 5f 75 72 6c 20 2b 20 22 2f 6c 6f 67 3f 69 64 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 74 72 61 63 6b 69 6e 67 5f 69 64 29 20 2b 20 22 26 73 65 76 3d 22 20 2b 20 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 29 Data Ascii: (function() {window.base_post_url \|\| (window.base_post_url = ""), window.log_error = function(e, i) {window.log_to_console(i), new Image().src = window.base_post_url + "/log?id=" + encodeURIComponent(window.tracking_id) + "&sev=" + encodeURIComponent(e)
2025-01-07 19:03:16 UTC	12358	IN	Data Raw: 43 48 20 46 4f 52 20 6e 61 6d 65 22 29 2c 20 74 20 26 26 20 28 6f 20 26 26 20 28 69 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 20 3d 20 22 31 70 78 20 73 6f 6c 69 64 20 72 65 64 22 29 2c 20 0a 31 20 3c 20 24 2e 74 72 69 6d 28 69 2e 76 61 6c 75 65 29 29 29 20 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 64 20 65 6e 74 65 72 65 64 20 69 73 20 74 72 75 65 22 29 2c 20 0a 21 28 72 20 3d 20 31 29 3b 0a 7d 20 65 6c 73 65 20 77 69 6e 64 6f 77 2e 6c 6f 67 5f 6d 65 73 73 61 67 65 28 22 63 68 65 63 6b 50 61 73 73 77 6f 72 64 3a 20 70 61 73 73 77 6f 72 65 64 20 65 6e 74 65 72 65 64 20 69 73 20 66 61 6c 73 65 22 29 3b 0a 7d 29 3b 0a 7d 0a 77 69 6e 64 6f 77 2e 6c 6f 67 5f Data Ascii: CH FOR name"), t && (o && (i.style.border = "1px solid red"), 1 < $.trim(i.value))) return window.log_message("checkPassword: password entered is true"), !(r = 1);} else window.log_message("checkPassword: passwored entered is false");});}window.log_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49845	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:16 UTC	450	OUT	GET /assets/ajax/libs/jquery/1.11.0/jquery.min.js HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:16 UTC	386	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:16 GMT Content-Type: application/javascript Content-Length: 96381 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT Vary: Accept-Encoding Server: ThreatSim-Web-Server Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Accept-Ranges: bytes
2025-01-07 19:03:16 UTC	15998	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 31 31 2e 30 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e Data Ascii: /! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a win
2025-01-07 19:03:16 UTC	16379	IN	Data Raw: 62 3d 5b 5d 2c 63 3d 5b 5d 2c 64 3d 67 28 61 2e 72 65 70 6c 61 63 65 28 50 2c 22 24 31 22 29 29 3b 72 65 74 75 72 6e 20 64 5b 73 5d 3f 66 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 65 29 7b 76 61 72 20 66 2c 67 3d 64 28 61 2c 6e 75 6c 6c 2c 65 2c 5b 5d 29 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 28 66 3d 67 5b 68 5d 29 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c 2c 66 2c 63 29 2c 21 63 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 66 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 64 62 28 61 2c 62 29 2e 6c 65 6e 67 74 68 3e Data Ascii: b=[],c=[],d=g(a.replace(P,"$1"));return d[s]?fb(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),!c.pop()}}),has:fb(function(a){return function(b){return db(a,b).length>
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 20 62 3f 28 66 3d 67 5b 62 5d 2c 6e 75 6c 6c 3d 3d 66 26 26 28 66 3d 67 5b 6e 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 5d 29 29 3a 66 3d 67 2c 66 0a 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 28 61 2c 62 2c 63 29 7b 69 66 28 6e 2e 61 63 63 65 70 74 44 61 74 61 28 61 29 29 7b 76 61 72 20 64 2c 65 2c 66 3d 61 2e 6e 6f 64 65 54 79 70 65 2c 67 3d 66 3f 6e 2e 63 61 63 68 65 3a 61 2c 68 3d 66 3f 61 5b 6e 2e 65 78 70 61 6e 64 6f 5d 3a 6e 2e 65 78 70 61 6e 64 6f 3b 69 66 28 67 5b 68 5d 29 7b 69 66 28 62 26 26 28 64 3d 63 3f 67 5b 68 5d 3a 67 5b 68 5d 2e 64 61 74 61 29 29 7b 6e 2e 69 73 41 72 72 61 79 28 62 29 3f 62 3d 62 2e 63 6f 6e 63 61 74 28 6e 2e 6d 61 70 28 62 2c 6e 2e 63 61 6d 65 6c 43 61 73 65 29 29 3a 62 20 69 6e 20 64 3f 62 3d 5b 62 5d 3a 28 62 3d 6e 2e 63 61 6d Data Ascii: b?(f=g[b],null==f&&(f=g[n.camelCase(b)])):f=g,f}}function S(a,b,c){if(n.acceptData(a)){var d,e,f=a.nodeType,g=f?n.cache:a,h=f?a[n.expando]:n.expando;if(g[h]){if(b&&(d=c?g[h]:g[h].data)){n.isArray(b)?b=b.concat(n.map(b,n.camelCase)):b in d?b=[b]:(b=n.cam
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 21 3d 3d 4c 3f 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 62 7c 7c 22 2a 22 29 3a 76 6f 69 64 20 30 3b 69 66 28 21 66 29 66 6f 72 28 66 3d 5b 5d 2c 63 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 7c 7c 61 3b 6e 75 6c 6c 21 3d 28 64 3d 63 5b 65 5d 29 3b 65 2b 2b 29 21 62 7c 7c 6e 2e 6e 6f 64 65 4e 61 6d 65 28 64 2c 62 29 3f 66 2e 70 75 73 68 28 64 29 3a 6e 2e 6d 65 72 67 65 28 66 2c 76 62 28 64 2c 62 29 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 62 7c 7c 62 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 28 61 2c 62 29 3f 6e 2e 6d 65 72 67 65 28 5b 61 5d 2c 66 29 3a 66 7d 66 75 6e 63 74 69 6f 6e 20 77 62 28 61 29 7b 58 2e 74 65 73 74 28 61 2e 74 79 70 65 29 26 26 28 61 2e 64 65 66 61 75 6c 74 43 Data Ascii: a.querySelectorAll!==L?a.querySelectorAll(b\|\|"*"):void 0;if(!f)for(f=[],c=a.childNodes\|\|a;null!=(d=c[e]);e++)!b\|\|n.nodeName(d,b)?f.push(d):n.merge(f,vb(d,b));return void 0===b\|\|b&&n.nodeName(a,b)?n.merge([a],f):f}function wb(a){X.test(a.type)&&(a.defaultC
2025-01-07 19:03:16 UTC	16384	IN	Data Raw: 74 68 69 73 2e 65 61 73 69 6e 67 5d 28 61 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 2a 61 2c 30 2c 31 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 29 3a 61 2c 74 68 69 73 2e 6e 6f 77 3d 28 74 68 69 73 2e 65 6e 64 2d 74 68 69 73 2e 73 74 61 72 74 29 2a 62 2b 74 68 69 73 2e 73 74 61 72 74 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 74 65 70 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 74 65 70 2e 63 61 6c 6c 28 74 68 69 73 2e 65 6c 65 6d 2c 74 68 69 73 2e 6e 6f 77 2c 74 68 69 73 29 2c 63 26 26 63 2e 73 65 74 3f 63 2e 73 65 74 28 74 68 69 73 29 3a 24 62 2e 70 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 73 65 74 28 74 68 69 73 29 2c 74 68 69 73 7d 7d 2c 24 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 Data Ascii: this.easing](a,this.options.durationa,0,1,this.options.duration):a,this.now=(this.end-this.start)b+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),c&&c.set?c.set(this):$b.propHooks._default.set(this),this}},$b.prototype.ini
2025-01-07 19:03:16 UTC	14852	IN	Data Raw: 26 26 28 63 3d 62 2c 62 3d 22 2a 22 29 3b 76 61 72 20 64 2c 65 3d 30 2c 66 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 6d 61 74 63 68 28 46 29 7c 7c 5b 5d 3b 69 66 28 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 63 29 29 77 68 69 6c 65 28 64 3d 66 5b 65 2b 2b 5d 29 22 2b 22 3d 3d 3d 64 2e 63 68 61 72 41 74 28 30 29 3f 28 64 3d 64 2e 73 6c 69 63 65 28 31 29 7c 7c 22 2a 22 2c 28 61 5b 64 5d 3d 61 5b 64 5d 7c 7c 5b 5d 29 2e 75 6e 73 68 69 66 74 28 63 29 29 3a 28 61 5b 64 5d 3d 61 5b 64 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 63 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 63 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 7d 2c 66 3d 61 3d 3d 3d 4a 63 3b 66 75 6e 63 74 69 6f 6e 20 67 28 68 29 7b 76 61 72 20 69 3b 72 65 74 75 72 6e 20 65 5b 68 5d 3d 21 30 2c 6e 2e Data Ascii: &&(c=b,b="");var d,e=0,f=b.toLowerCase().match(F)\|\|[];if(n.isFunction(c))while(d=f[e++])"+"===d.charAt(0)?(d=d.slice(1)\|\|"",(a[d]=a[d]\|\|[]).unshift(c)):(a[d]=a[d]\|\|[]).push(c)}}function Nc(a,b,c,d){var e={},f=a===Jc;function g(h){var i;return e[h]=!0,n.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49853	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	385	OUT	GET /training/production/314/hooks-a3eab7.png HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	498	IN	HTTP/1.1 200 OK x-amz-id-2: 0GWLu3++5Ar7vYiHZ/NxefYnDbLb+GXudG4DEHvxbidXEppkJi92a15yNV35/c6dbxK3tSoUtv5FoCQevplm7dONSG+7LyAlxQG1PXWLKSc= x-amz-request-id: K4DPNKMDBHJ013WX Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Fri, 26 Aug 2022 14:07:48 GMT ETag: "3e598c505586e70346fa62d104dd540f" x-amz-server-side-encryption: AES256 x-amz-version-id: .YGCnRqbXkaDTSLNT7EWxvKvKu.lg1.r Accept-Ranges: bytes Content-Type: image/png Content-Length: 5003 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	5003	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 bc 00 00 00 e8 08 06 00 00 00 55 56 8e 4a 00 00 13 52 49 44 41 54 78 5e ec dd 01 84 de 75 1c c7 f1 ef b3 9d ba 5c d9 d4 31 b5 a4 42 6c 52 87 b2 62 11 64 49 db 14 ee 94 30 83 0e ad 41 0c 52 85 55 14 a2 c3 01 55 40 49 a2 15 49 a3 5c 83 6e d7 15 a2 41 8b a4 e9 54 a4 ab 62 3d 7d f0 cc e5 ef 31 bb 2b f2 ff 3f af 17 5f df f9 79 8c e7 f1 66 bf e7 f6 e7 7a fd 7e bf ba a0 d7 eb d5 7a cc 2e af 6c ce 3a 9a d9 93 39 95 39 3c 3f 35 f9 7d 75 12 e7 3a df 54 a3 eb fe cc 91 cc 54 66 3a f3 4c 75 19 23 1f fc 8e c6 c1 f5 35 22 04 ef bd 23 78 10 3c 08 1e 04 0f 82 07 c1 83 e0 41 f0 20 78 10 3c 08 1e c6 7a bd 5e 4d ec bc 67 67 0e f6 67 2e ae 96 ca 7b a8 86 bf 32 0b bf 7e f9 de f1 7f f9 f7 5e 97 35 9d b9 a4 ba a3 9f 39 99 Data Ascii: PNGIHDRUVJRIDATx^u\1BlRbdI0ARUU@II\nATb=}1+?_yfz~z.l:99<?5}u:TTf:Lu#5"#x<A x<z^Mggg.{2~^59

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49856	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	929	OUT	GET /training_screenshot?guid=65d1199738&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	713	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin ETag: W/"502f480f6b9f7e634a7c16adde4bd7a0" Cache-Control: max-age=0, private, must-revalidate X-Request-Id: 3b22b76d-c529-4710-b63d-357498dcb57b X-Runtime: 0.005491 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	1915	IN	Data Raw: 37 37 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 20 34 30 70 78 20 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 22 3e 0a 3c 74 61 62 Data Ascii: 774<!DOCTYPE html><html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title></title><meta charset="UTF-8"></head><body style="margin: 40px 0;font-family: Arial, Helvetica, sans-serif;font-size: 18px;"><tab
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49858	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	835	OUT	GET /trace?id=unknown&msg=get-id%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5ba6e644-3619-48b4-bd82-2082ee1f2bb1 X-Runtime: 0.001750 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49855	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	870	OUT	GET /trace?id=unknown&msg=did%20not%20find%20guid%20in%20last%20part%20of%20location&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 441dd455-4de1-42af-b1c0-cfeebe89cc76 X-Runtime: 0.002028 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49860	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	857	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=embeddedhtmlemail%20id%20exists%20with%20environment%20%3D%20production HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	642	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ccb911ca-3336-4022-978f-b4e0177338f5 X-Runtime: 0.001981 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49859	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	811	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=Loading%20embedded%20html HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	642	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: aa5be345-3d71-44df-b554-a035894c2974 X-Runtime: 0.002080 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49857	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	657	OUT	GET /training/embedded/translations/url/en-us.json HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://hallmark.greetingsweb.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	667	IN	HTTP/1.1 200 OK x-amz-id-2: mt1dLpCG9jVBVX7upDHvOD393rN97HZdaDMd2qr/HfygJpPaEy4AROXO2hk+2Mj0pBPuIrPQqK7xdw/GCWRkyttZ4UwOtliy x-amz-request-id: K4DMGWM1TX906S56 Date: Tue, 07 Jan 2025 19:03:18 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 3000 Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method Last-Modified: Thu, 22 Aug 2024 15:53:58 GMT ETag: "5b4ab6ebb4b3b8082f88ea8f0c539b63" x-amz-server-side-encryption: AES256 x-amz-version-id: ar5uW9uXca2zsUcF5bYxp.j9ntTE4_hN Accept-Ranges: bytes Content-Type: application/json Content-Length: 1900 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	1900	IN	Data Raw: 7b 0a 20 20 22 72 65 70 6c 61 63 65 6d 65 6e 74 73 22 3a 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 22 59 6f 75 20 68 61 76 65 20 62 65 65 6e 20 50 68 69 73 68 65 64 21 22 2c 0a 20 20 20 20 22 68 31 22 3a 22 4f 4f 50 53 21 22 2c 0a 20 20 20 20 22 68 32 22 3a 22 59 6f 75 20 66 65 6c 6c 20 66 6f 72 20 61 20 3c 73 74 72 6f 6e 67 3e 70 68 69 73 68 21 3c 2f 73 74 72 6f 6e 67 3e 22 2c 0a 20 20 20 20 22 70 30 22 3a 22 44 6f 20 6e 6f 74 20 77 6f 72 72 79 2c 20 74 68 69 73 20 77 61 73 20 61 6e 20 61 70 70 72 6f 76 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 6d 75 6c 61 74 69 6f 6e 20 72 75 6e 20 62 79 20 25 43 4f 4d 50 41 4e 59 25 2e 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 57 65 20 61 72 65 20 68 65 72 65 20 74 6f 20 68 65 6c 70 2e 3c 2f 73 74 72 6f 6e 67 3e 22 2c 0a Data Ascii: { "replacements":{ "title":"You have been Phished!", "h1":"OOPS!", "h2":"You fell for a <strong>phish!</strong>", "p0":"Do not worry, this was an approved phishing simulation run by %COMPANY%.<br> <strong>We are here to help.</strong>",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49851	18.245.62.126	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	616	OUT	GET /training/fish/mail.png HTTP/1.1 Host: d25q7gseii1o1q.cloudfront.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://tslp.s3.amazonaws.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	446	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 926 Connection: close Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Fri, 30 May 2014 15:01:28 GMT ETag: "3c506b80d78539262795c9ba59a0631a" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 6ce3814cb60a4c907ac701e60e4c1e5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P5 X-Amz-Cf-Id: qKiKcUav8zPTRQoKRQKbcotp_vgUeXiLXaOPrRmT7uTaqLzkBlY2TA==
2025-01-07 19:03:17 UTC	926	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 04 03 00 00 00 a5 2c e4 b4 00 00 00 1e 50 4c 54 45 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 60 a3 b5 82 00 00 00 0a 74 52 4e 53 00 01 02 03 04 05 06 07 08 09 d5 46 a7 58 00 00 03 25 49 44 41 54 78 5e 75 91 3b 6f 1b 57 14 84 e7 ae f8 3a dd bd 34 1d ea 76 4b 3a 92 b5 1d 25 c4 30 d8 ad 05 1b c9 76 a4 13 20 66 47 23 76 10 76 64 5e f0 76 2b 45 0d bb 73 96 4b 2d e7 df 06 4e aa 00 4e ff 0d 66 f0 0d 1c 99 bb b6 1b 47 a7 be c7 ca 5d 7e 2f 7c 22 56 2e b0 d8 9e 73 73 f1 e9 69 df d5 1d fa b8 02 41 46 03 28 06 89 47 a0 0b 71 88 da f5 1b b3 f2 33 90 d8 3d ae f0 dd 30 89 eb f0 bb fa 32 bd 2a ec de 45 1c bf f1 b5 5f 76 dc 79 eb e9 a6 f4 98 b0 df 38 d7 Data Ascii: PNGIHDR00,PLTE`tRNSFX%IDATx^u;oW:4vK:%0v fG#vvd^v+EsK-NNfG]~/\|"V.ssiAF(Gq3=02*E_vy8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49861	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	818	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=logo_object%20does%20not%20exist HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	642	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: e6a718dc-9259-455c-a4e5-1829dac180ed X-Runtime: 0.002047 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49862	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	540	OUT	GET /trace?id=undefined&msg=window.tracking_id%20is%20not%20set%2C%20let%27s%20get%20it&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 6419fe07-032c-4860-963c-2eed938d975c X-Runtime: 0.001553 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49834	3.5.25.233	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	643	OUT	GET /training/production/314/hallmarkfooterlogo-d4ab56.png HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	448	IN	HTTP/1.1 200 OK x-amz-id-2: LeT4JFgAW+71Jk0YfLKFHlSR2SJgv4zFLwEHY5ZM/ZCkIytSWyWeqNqLo/WI7H1j6V/atVNLNHSGbyCe+WFczZl8YjIFRu85 x-amz-request-id: K4DK1H6SP00NXCVR Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Mon, 04 Feb 2019 20:08:28 GMT ETag: "6537c0a611df91c8d5a7468afca9415d" x-amz-version-id: Sl7iSA8GlhgfMO_xx_OrRTXnzFYwnf_I Accept-Ranges: bytes Content-Type: image/png Content-Length: 4105 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	4105	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 22 08 06 00 00 00 f1 9c ef 3c 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDRN"<pHYsOiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49867	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	866	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: cfb6493f-6bfe-4d8f-a4ff-f64ef3bec6f2 X-Runtime: 0.001871 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49868	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	868	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 6e72e1d8-7b30-4e41-85d6-30bc70220a6f X-Runtime: 0.001796 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49870	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	864	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 06a28c95-62f3-497a-a4ad-9b8e9c4b64e3 X-Runtime: 0.001699 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49871	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	863	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 27ce56a5-ce4d-4933-9ecc-cd03c829fe02 X-Runtime: 0.002026 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49873	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	537	OUT	GET /trace?id=unknown&msg=did%20not%20find%20guid%20in%20last%20part%20of%20location&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 0b9b72a6-2cfd-41da-863c-789993895e21 X-Runtime: 0.002639 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49875	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	502	OUT	GET /trace?id=unknown&msg=get-id%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 9816d150-1754-459b-b75e-c75b04ca90bc X-Runtime: 0.001459 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49876	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	478	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=Loading%20embedded%20html HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	656	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Cache-Control: no-cache X-Request-Id: ce892493-522a-497c-82c7-cc67259b0860 X-Runtime: 0.002771 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49872	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	524	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=embeddedhtmlemail%20id%20exists%20with%20environment%20%3D%20production HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	656	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Cache-Control: no-cache X-Request-Id: 3a1ea7a8-3b23-4089-8f40-9afdfd65c595 X-Runtime: 0.001987 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49869	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	868	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 861a875c-5e1c-4b62-95fc-c0dafaa58af7 X-Runtime: 0.001931 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49880	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	485	OUT	GET /log?id=65d1199738&campaign_guid=3476ad5eaa&msg=logo_object%20does%20not%20exist HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	656	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: image/gif; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Cache-Control: no-cache X-Request-Id: 249e3b90-484f-47cb-900f-a9bf5189916e X-Runtime: 0.001818 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49879	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	859	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:17 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: a92c7048-120d-4db8-bd1a-3988d8b4b172 X-Runtime: 0.001654 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49874	16.182.32.137	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	640	OUT	GET /training/production/13913/clights-c61e57.png HTTP/1.1 Host: ts-uploads.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	467	IN	HTTP/1.1 200 OK x-amz-id-2: pqcK2mD+zYEiS9+4F9J79TtNRoqoFrZqbaUwOSmliTjjsJgWMXTEtWUk2nAZdwMwlod3Fvt06Iw= x-amz-request-id: K4DZEYBBPVMWNY5K Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Fri, 22 Jul 2022 20:26:05 GMT ETag: "4355e91abddbb81c9e7450ff38d049cf" x-amz-server-side-encryption: AES256 x-amz-version-id: BsPRPdWnX53CHOIwwy2IByEom_QZHtLg Accept-Ranges: bytes Content-Type: image/png Content-Length: 52551 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 5c 00 00 00 e3 08 06 00 00 00 91 91 15 f9 00 00 80 00 49 44 41 54 78 da ec bd 77 7c 14 d5 f7 ff 1f a4 a5 6d ef d9 f4 1e d2 e8 bd f7 de a4 4b 15 01 bb be 15 50 40 04 41 45 05 15 b0 02 22 f0 46 11 90 de ed a0 80 20 bd 13 6a 28 a1 a4 57 78 7f 7e 9f ef fb f3 fa 9d 3b 9b 85 65 d9 4d 36 c9 86 7a fe 78 3e 66 76 77 b2 3b d9 bd 33 73 9f 73 ce 3d d7 e3 e6 cd 9b 60 18 86 61 18 86 61 18 86 61 dc 8f 07 7f 09 0c c3 30 0c c3 30 0c c3 30 2c 5c 0c c3 30 0c c3 30 0c c3 30 2c 5c 0c c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 b0 70 31 0c Data Ascii: PNGIHDR\IDATxw\|mKP@AE"F j(Wx~;eM6zx>fvw;3ss=`aaa000,\000,\000000000000000000000p1
2025-01-07 19:03:17 UTC	557	IN	Data Raw: 9f 3b 8d 03 7f fd 81 9d 9b d7 63 d3 a2 6f b0 f4 d3 19 98 fd f2 8b 78 bb 77 77 bc d4 ac 1e 89 59 02 86 57 8f c2 53 51 41 e8 1b e2 87 de e1 66 f4 0c d2 a3 47 80 1e 4f 9a 75 e8 65 36 a1 4f b0 3f fa 47 84 60 70 4c 18 86 d7 88 c7 a8 86 75 f1 42 f3 fa 78 bd 43 2b bc d1 b5 03 de e9 d7 1b ef 0d ea 87 f7 86 0e c0 fb 83 9e c2 87 c3 06 e3 e3 11 c3 30 73 d4 08 cc 7a 7e 14 3e 7d ee 19 4c 7f 66 08 c6 75 69 87 67 c5 c4 e6 c1 81 68 41 72 56 93 7e cf 70 12 b7 40 9d 9a f0 43 b0 29 18 89 89 f5 30 74 e8 48 2c 5b f6 23 92 cf 5f 70 bd ed 96 a3 68 89 68 d3 b9 d3 67 f0 ec c8 91 f0 13 65 bb 55 2a a9 bd a9 b5 62 2a 0c 23 89 96 4e 2a cb 2d 4a 2d ab e9 7f 31 90 74 85 06 06 61 ef 9e 03 77 0a 97 33 c4 e7 d1 be ee df bb 17 af bf fa 1a 62 a3 a2 60 12 69 a9 d4 d1 e9 48 ed f1 b5 1a d5 b1 Data Ascii: ;coxwwYWSQAfGOue6O?G`pLuBxC+0sz~>}LfuighArV~p@C)0tH,[#_phhgeUb#N*-J-1taw3b`iH
2025-01-07 19:03:17 UTC	16384	IN	Data Raw: 01 2a bc bd 02 55 26 ae 44 85 fe d3 e0 d1 74 24 2a d4 eb 8f 4a b5 bb a0 6a 4c 03 54 8d ae 07 6f ff 68 04 47 d6 82 26 ba 29 2a fb c7 e3 d9 77 67 63 f7 e5 2c 4b 05 c4 2b 96 48 db 81 c2 28 d7 61 9b 28 d7 89 62 c6 72 15 37 2f 17 8f e3 ba 07 05 08 1c cc ed 93 75 fd 3a 8e fc fe 2b 36 cf 9a 89 59 7d 9f c4 1b 71 d1 18 66 d0 a1 93 dc 07 cd e9 82 5f 8b 04 2c 92 08 a0 13 b9 4e 41 9d 04 8d 1a 51 51 11 e8 d8 a1 03 c6 8e 1e 8b e5 cb 57 60 db b6 3f a9 33 9d 6c a9 2e e6 a8 13 2c 26 43 cc c8 44 c7 8e 5d 48 ac c4 e4 9e 85 c2 45 1d 50 31 5f 88 24 61 d2 dc 33 0a c8 a5 89 b6 d5 d2 c4 dc 7a 0d 5d 24 b4 2a 18 0d 7e 68 dd a6 03 da 77 ec 8a a6 cd 5a 21 26 2e 51 1a d3 14 40 cf 07 ea fd 10 6a f4 47 b5 e0 60 d4 8a 89 41 cd f0 68 c4 04 04 21 56 a7 43 2d 7a ef 56 d4 61 19 ac f4 c6 db Data Ascii: U&Dt$JjLTohG&)wgc,K+H(a(br7/u:+6Y}qf_,NAQQW`?3l.,&CD]HEP1_$a3z]$~hwZ!&.Q@jG`Ah!VC-zVa
2025-01-07 19:03:17 UTC	1024	IN	Data Raw: 51 ac 0a 3e 51 cd 62 cd 48 87 7c 3b 03 ae 2c 9c f8 f1 39 28 72 56 10 6e b5 e1 40 eb 01 45 e9 da 7f 90 7e 4e ad 4d 70 b4 3a 71 fd fc bb 21 3f a2 59 0a 59 71 06 fb dc f3 dd 0a d7 59 b7 9d 8f 79 45 8b 94 d7 63 af eb 56 b9 bc 1b 0b dd b6 c2 02 a1 ad b0 c4 05 5c a2 ad 30 90 1c 57 6d 83 1b b8 02 c9 71 59 85 ad 30 74 1d a6 c0 d5 9e 7a 78 b1 ad d0 a8 3c c3 57 96 cb c8 5a e8 0b ba 56 f8 00 2f 0e 5f 46 23 3e 47 0f 5a ec 6b ae f4 a1 6c 19 59 09 8d 9a 09 7d a9 5b 6c aa 4c da 09 3b a3 30 c3 19 b6 13 06 a6 6e 19 59 09 ad c0 16 01 91 93 80 ab f0 91 27 f0 4b 74 9c a2 6e 2d d7 ea de 37 68 0a d7 56 05 b2 64 34 c8 36 a5 a5 90 01 57 85 76 3f 53 bf 0a 35 d8 62 cf 5f cd 14 af a4 34 54 ff e3 75 05 b8 5c d0 c5 d5 2e 3d 74 b1 f7 26 56 c6 1b 59 0b fd a9 5c 81 96 67 84 81 2b 34 76 Data Ascii: Q>QbH\|;,9(rVn@E~NMp:q!?YYqYyEcV\0WmqY0tzx<WZV/_F#>GZklY}[lL;0nY'Ktn-7hVd46Wv?S5b_4Tu\.=t&VY\g+4v
2025-01-07 19:03:17 UTC	10157	IN	Data Raw: 52 05 4c 3c eb e0 3d f3 5b a2 9d 90 37 13 32 3b 21 53 9e e6 97 2c c1 5d 2f de af 34 0a ca 67 26 ab c0 75 3d 07 ae 4c 3c 3c ff 09 82 ad 22 5c bd e4 5e c4 be 3f 10 8f 15 bc 8c 6b 37 ff 01 f7 97 fd 05 c3 3e 3c 01 f2 03 da 2e 2e 96 f9 62 a0 36 3d 5d ad 85 3f 4e 5d 7c fc cc 3b cf 2a c0 c5 d4 34 f6 ba ec f5 45 5b a1 08 5c 62 5b a1 be 1e 3e 64 c0 15 6e 2a ec ba c0 d5 11 b6 42 5f 59 2e 5f d6 42 ab d0 65 a4 76 89 e0 25 8e 0b ac f4 c3 41 cb c0 42 e8 4f d9 d2 c3 96 5f 75 4b d8 bd d5 11 ea 56 18 b8 da 69 27 b4 a2 6e 89 56 42 9e db e2 d5 ef 06 b0 c5 80 a8 f6 fb 1f b1 74 f0 08 2c a0 8b 52 a6 50 6d d1 a6 48 53 b2 58 15 f7 81 de 71 c0 b8 14 e0 f8 54 60 6a 2e 1c e9 29 a8 12 f6 75 6d d1 00 6d 1d 53 b9 64 3b f2 07 0f 43 e3 bc 79 04 73 4b 8c a1 8b 17 69 e8 f3 5c 66 05 1a 26 Data Ascii: RL<=[72;!S,]/4g&u=L<<"\^?k7><..b6=]?N]\|;4E[\b[>dnB_Y._Bev%ABO_uKVi'nVBt,RPmHSXqT`j.)ummSd;CysKi\f&
2025-01-07 19:03:17 UTC	8045	IN	Data Raw: 4b c0 56 47 03 57 20 4d 85 66 39 2e 7f b6 42 ab 2a 97 00 5d d5 ef 7f 80 35 fd 06 60 b5 a6 72 6d d1 54 ae dd 71 04 5a 4f 4e 81 23 31 12 4d 8f 4e 41 6d cf 4c 45 dd da a9 c1 d6 fa c8 08 ec 7a e8 21 b7 62 c6 61 4b bf ec 58 5f 96 e1 6b ff 96 59 7e 2b d0 c2 8c 30 70 59 28 75 09 16 b8 7c 34 15 9a e5 b8 98 ca c5 6c 7a 6b 35 5b e1 1a dd 02 64 43 95 4b 80 ae d9 0b 51 73 c2 99 d8 2b 45 29 e7 60 ad 36 f5 0a 78 25 60 df 99 7f 40 e3 d3 7f 42 ed 1d 7f c7 81 d3 27 28 c0 c5 94 b0 fd f4 fc dd b6 74 ec f9 e3 2b f4 b5 57 98 ab 5b 6b b4 fc d6 3a 41 dd 32 ca 6f f1 c2 8c 8a ed 9e 95 f0 bb 2a 75 3b b8 b4 4a 78 0e 5c 5d a1 a1 30 58 e0 72 b6 33 cf d5 0e e8 32 cc 76 99 82 d7 36 4f 00 0b 68 b6 f9 81 2c 4f d0 32 b7 10 86 00 b6 42 ac 6e 85 12 b8 ac 94 67 b0 d1 97 67 a8 d0 a5 02 97 d8 Data Ascii: KVGW Mf9.B]5`rmTqZON#1MNAmLEz!baKX_kY~+0pY(u\|4lzk5[dCKQs+E)`6x%`@B'(t+W[k:A2ou;Jx\]0Xr32v6Oh,O2Bngg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49878	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	390	OUT	GET /training/embedded/translations/url/en-us.json HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	505	IN	HTTP/1.1 200 OK x-amz-id-2: UN9uTLVNILNBOfJ50UiI+hH9JOwtjLIJZFZggpIyT2gsI1mJY4i+oq+6FsiB9hiRjSxDtziiGcdEWvFhwYOpRMmhB6pNLxN6UczxEzrybys= x-amz-request-id: K4DW79KYAB5F40SP Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Thu, 22 Aug 2024 15:53:58 GMT ETag: "5b4ab6ebb4b3b8082f88ea8f0c539b63" x-amz-server-side-encryption: AES256 x-amz-version-id: ar5uW9uXca2zsUcF5bYxp.j9ntTE4_hN Accept-Ranges: bytes Content-Type: application/json Content-Length: 1900 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	1900	IN	Data Raw: 7b 0a 20 20 22 72 65 70 6c 61 63 65 6d 65 6e 74 73 22 3a 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 22 59 6f 75 20 68 61 76 65 20 62 65 65 6e 20 50 68 69 73 68 65 64 21 22 2c 0a 20 20 20 20 22 68 31 22 3a 22 4f 4f 50 53 21 22 2c 0a 20 20 20 20 22 68 32 22 3a 22 59 6f 75 20 66 65 6c 6c 20 66 6f 72 20 61 20 3c 73 74 72 6f 6e 67 3e 70 68 69 73 68 21 3c 2f 73 74 72 6f 6e 67 3e 22 2c 0a 20 20 20 20 22 70 30 22 3a 22 44 6f 20 6e 6f 74 20 77 6f 72 72 79 2c 20 74 68 69 73 20 77 61 73 20 61 6e 20 61 70 70 72 6f 76 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 6d 75 6c 61 74 69 6f 6e 20 72 75 6e 20 62 79 20 25 43 4f 4d 50 41 4e 59 25 2e 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 57 65 20 61 72 65 20 68 65 72 65 20 74 6f 20 68 65 6c 70 2e 3c 2f 73 74 72 6f 6e 67 3e 22 2c 0a Data Ascii: { "replacements":{ "title":"You have been Phished!", "h1":"OOPS!", "h2":"You fell for a <strong>phish!</strong>", "p0":"Do not worry, this was an approved phishing simulation run by %COMPANY%.<br> <strong>We are here to help.</strong>",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49884	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	388	OUT	GET /training/production/314/hallmark-2102f5.png HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:17 UTC	461	IN	HTTP/1.1 200 OK x-amz-id-2: kGorK1vkWNYIicT3gePIqdSqz119WOgbr2Qe4eX+XO/9/BydbqpZoqZV8mt/3AVsYfWBX4mANlPilSNutiSYAiBs1JXGZ8GikTa7TdG0Xdc= x-amz-request-id: K4DM346PTHKPGMQQ Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Mon, 04 Feb 2019 17:21:41 GMT ETag: "766ae556ea87c2848ed1234cd766c982" x-amz-version-id: jqFPhTK1cB8ERuJDi6iuzlBvC3K42.eK Accept-Ranges: bytes Content-Type: image/png Content-Length: 13208 Server: AmazonS3 Connection: close
2025-01-07 19:03:17 UTC	13208	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 ba 00 00 00 4b 08 06 00 00 00 c7 c0 9d 4d 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 05 1c 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRKMpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49883	16.15.178.1	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:17 UTC	398	OUT	GET /training/production/314/hallmarkfooterlogo-d4ab56.png HTTP/1.1 Host: tslp.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:18 UTC	460	IN	HTTP/1.1 200 OK x-amz-id-2: 2OztHsztxyo6/o0lazk3tPWZ5gz+MZKZvtOyMaSs5YWcKdqbpF177U9tei/5NXIYtdQs66oB6rUstxFTVdCAcnzDjjV8qVPJwVkB1hDNvd8= x-amz-request-id: K4DZP978GCCPNQ1J Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Mon, 04 Feb 2019 20:08:28 GMT ETag: "6537c0a611df91c8d5a7468afca9415d" x-amz-version-id: Sl7iSA8GlhgfMO_xx_OrRTXnzFYwnf_I Accept-Ranges: bytes Content-Type: image/png Content-Length: 4105 Server: AmazonS3 Connection: close
2025-01-07 19:03:18 UTC	4105	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 22 08 06 00 00 00 f1 9c ef 3c 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDRN"<pHYsOiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49885	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	862	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 271c25bf-a19d-4fd4-ba47-d60e110d20c0 X-Runtime: 0.001771 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49886	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	863	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: bac4d8a6-c3ac-4c41-a631-2f54d0c3fb43 X-Runtime: 0.002037 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49887	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	533	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20localStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: eea12ba6-7b5f-4d35-8cca-e525f452fc97 X-Runtime: 0.001789 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49888	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	862	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 71faf74e-488b-449c-8b3b-14be3c0ede6f X-Runtime: 0.001715 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49898	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	859	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 4e23d9eb-9005-4257-8a66-f9c90b07d029 X-Runtime: 0.008739 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49889	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	860	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: d9e8f260-7556-49bf-b244-3bea6cba8ce1 X-Runtime: 0.001507 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49897	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	535	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20sessionStorage%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 0a7ae13a-c87d-4dc7-8924-01cf75edc95d X-Runtime: 0.001905 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49896	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	531	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20hasCookies%20%3D%20true&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 037aa85e-f66b-491f-9ff8-8b4b9ca4c1fa X-Runtime: 0.002226 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49894	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	530	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser%20%3D%20Chrome&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 28ead2a3-b7c5-46fe-a09a-e5d9de9ea15b X-Runtime: 0.001957 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49899	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	535	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20browser_version%20%3D%20117&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 163665e0-e906-4c1b-98e7-156188aeff3f X-Runtime: 0.001711 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49901	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	526	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os%20%3D%20Windows&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 178890db-e032-43db-8164-3db9b1be0379 X-Runtime: 0.002129 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49900	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	862	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: d3b610a4-c9b8-4537-943b-eb5830e604d9 X-Runtime: 0.001606 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49893	18.245.62.137	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	375	OUT	GET /training/fish/mail.png HTTP/1.1 Host: d25q7gseii1o1q.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:18 UTC	453	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 926 Connection: close Date: Tue, 07 Jan 2025 19:03:18 GMT Last-Modified: Fri, 30 May 2014 15:01:28 GMT ETag: "3c506b80d78539262795c9ba59a0631a" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 a51af242bb87a51c6b17ed13ee788db8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P5 X-Amz-Cf-Id: JTSTRRNSL5kRP62K4PlR4pzzmfuASYFP_tckfT-4OMdsYYh1dKITiw== Age: 1
2025-01-07 19:03:18 UTC	926	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 04 03 00 00 00 a5 2c e4 b4 00 00 00 1e 50 4c 54 45 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 60 a3 b5 82 00 00 00 0a 74 52 4e 53 00 01 02 03 04 05 06 07 08 09 d5 46 a7 58 00 00 03 25 49 44 41 54 78 5e 75 91 3b 6f 1b 57 14 84 e7 ae f8 3a dd bd 34 1d ea 76 4b 3a 92 b5 1d 25 c4 30 d8 ad 05 1b c9 76 a4 13 20 66 47 23 76 10 76 64 5e f0 76 2b 45 0d bb 73 96 4b 2d e7 df 06 4e aa 00 4e ff 0d 66 f0 0d 1c 99 bb b6 1b 47 a7 be c7 ca 5d 7e 2f 7c 22 56 2e b0 d8 9e 73 73 f1 e9 69 df d5 1d fa b8 02 41 46 03 28 06 89 47 a0 0b 71 88 da f5 1b b3 f2 33 90 d8 3d ae f0 dd 30 89 eb f0 bb fa 32 bd 2a ec de 45 1c bf f1 b5 5f 76 dc 79 eb e9 a6 f4 98 b0 df 38 d7 Data Ascii: PNGIHDR00,PLTE`tRNSFX%IDATx^u;oW:4vK:%0v fG#vvd^v+EsK-NNfG]~/\|"V.ssiAF(Gq3=02*E_vy8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49902	3.5.28.76	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	395	OUT	GET /training/production/13913/clights-c61e57.png HTTP/1.1 Host: ts-uploads.s3.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 19:03:18 UTC	499	IN	HTTP/1.1 200 OK x-amz-id-2: jaeGkdPVM7mTxiVa3JE+2W5REiIh3iYu4fwSHKoDADE+Jhu+kC+bU98LL2eJxPj9AE3A4ujPcj5CQHKF56tzOpnaqGVPSV33HfpVEy+6lFI= x-amz-request-id: W49W6T0WNHAPWNW4 Date: Tue, 07 Jan 2025 19:03:19 GMT Last-Modified: Fri, 22 Jul 2022 20:26:05 GMT ETag: "4355e91abddbb81c9e7450ff38d049cf" x-amz-server-side-encryption: AES256 x-amz-version-id: BsPRPdWnX53CHOIwwy2IByEom_QZHtLg Accept-Ranges: bytes Content-Type: image/png Content-Length: 52551 Server: AmazonS3 Connection: close
2025-01-07 19:03:18 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 5c 00 00 00 e3 08 06 00 00 00 91 91 15 f9 00 00 80 00 49 44 41 54 78 da ec bd 77 7c 14 d5 f7 ff 1f a4 a5 6d ef d9 f4 1e d2 e8 bd f7 de a4 4b 15 01 bb be 15 50 40 04 41 45 05 15 b0 02 22 f0 46 11 90 de ed a0 80 20 bd 13 6a 28 a1 a4 57 78 7f 7e 9f ef fb f3 fa 9d 3b 9b 85 65 d9 4d 36 c9 86 7a fe 78 3e 66 76 77 b2 3b d9 bd 33 73 9f 73 ce 3d d7 e3 e6 cd 9b 60 18 86 61 18 86 61 18 86 61 dc 8f 07 7f 09 0c c3 30 0c c3 30 0c c3 30 2c 5c 0c c3 30 0c c3 30 0c c3 30 2c 5c 0c c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c 0b 17 c3 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 c2 c5 30 0c c3 30 0c c3 30 0c c3 b0 70 31 0c Data Ascii: PNGIHDR\IDATxw\|mKP@AE"F j(Wx~;eM6zx>fvw;3ss=`aaa000,\000,\000000000000000000000p1
2025-01-07 19:03:18 UTC	525	IN	Data Raw: 9f 3b 8d 03 7f fd 81 9d 9b d7 63 d3 a2 6f b0 f4 d3 19 98 fd f2 8b 78 bb 77 77 bc d4 ac 1e 89 59 02 86 57 8f c2 53 51 41 e8 1b e2 87 de e1 66 f4 0c d2 a3 47 80 1e 4f 9a 75 e8 65 36 a1 4f b0 3f fa 47 84 60 70 4c 18 86 d7 88 c7 a8 86 75 f1 42 f3 fa 78 bd 43 2b bc d1 b5 03 de e9 d7 1b ef 0d ea 87 f7 86 0e c0 fb 83 9e c2 87 c3 06 e3 e3 11 c3 30 73 d4 08 cc 7a 7e 14 3e 7d ee 19 4c 7f 66 08 c6 75 69 87 67 c5 c4 e6 c1 81 68 41 72 56 93 7e cf 70 12 b7 40 9d 9a f0 43 b0 29 18 89 89 f5 30 74 e8 48 2c 5b f6 23 92 cf 5f 70 bd ed 96 a3 68 89 68 d3 b9 d3 67 f0 ec c8 91 f0 13 65 bb 55 2a a9 bd a9 b5 62 2a 0c 23 89 96 4e 2a cb 2d 4a 2d ab e9 7f 31 90 74 85 06 06 61 ef 9e 03 77 0a 97 33 c4 e7 d1 be ee df bb 17 af bf fa 1a 62 a3 a2 60 12 69 a9 d4 d1 e9 48 ed f1 b5 1a d5 b1 Data Ascii: ;coxwwYWSQAfGOue6O?G`pLuBxC+0sz~>}LfuighArV~p@C)0tH,[#_phhgeUb#N*-J-1taw3b`iH
2025-01-07 19:03:18 UTC	16384	IN	Data Raw: 7d 5f 12 2e 92 ad 90 67 e0 11 49 c2 15 dd 1f 1e 09 43 e1 51 fb 69 54 a8 3d 00 e6 c6 43 a0 7e 79 01 2a bc bd 02 55 26 ae 44 85 fe d3 e0 d1 74 24 2a d4 eb 8f 4a b5 bb a0 6a 4c 03 54 8d ae 07 6f ff 68 04 47 d6 82 26 ba 29 2a fb c7 e3 d9 77 67 63 f7 e5 2c 4b 05 c4 2b 96 48 db 81 c2 28 d7 61 9b 28 d7 89 62 c6 72 15 37 2f 17 8f e3 ba 07 05 08 1c cc ed 93 75 fd 3a 8e fc fe 2b 36 cf 9a 89 59 7d 9f c4 1b 71 d1 18 66 d0 a1 93 dc 07 cd e9 82 5f 8b 04 2c 92 08 a0 13 b9 4e 41 9d 04 8d 1a 51 51 11 e8 d8 a1 03 c6 8e 1e 8b e5 cb 57 60 db b6 3f a9 33 9d 6c a9 2e e6 a8 13 2c 26 43 cc c8 44 c7 8e 5d 48 ac c4 e4 9e 85 c2 45 1d 50 31 5f 88 24 61 d2 dc 33 0a c8 a5 89 b6 d5 d2 c4 dc 7a 0d 5d 24 b4 2a 18 0d 7e 68 dd a6 03 da 77 ec 8a a6 cd 5a 21 26 2e 51 1a d3 14 40 cf 07 ea fd Data Ascii: }_.gICQiT=C~yU&Dt$JjLTohG&)wgc,K+H(a(br7/u:+6Y}qf_,NAQQW`?3l.,&CD]HEP1_$a3z]$~hwZ!&.Q@
2025-01-07 19:03:18 UTC	1024	IN	Data Raw: b6 56 98 51 e9 55 07 6f b6 7b 8b d9 f1 8c ca 32 78 0d bc b7 ba b5 14 f3 8b 17 e3 8f ef 3e 87 88 51 ac 0a 3e 51 cd 62 cd 48 87 7c 3b 03 ae 2c 9c f8 f1 39 28 72 56 10 6e b5 e1 40 eb 01 45 e9 da 7f 90 7e 4e ad 4d 70 b4 3a 71 fd fc bb 21 3f a2 59 0a 59 71 06 fb dc f3 dd 0a d7 59 b7 9d 8f 79 45 8b 94 d7 63 af eb 56 b9 bc 1b 0b dd b6 c2 02 a1 ad b0 c4 05 5c a2 ad 30 90 1c 57 6d 83 1b b8 02 c9 71 59 85 ad 30 74 1d a6 c0 d5 9e 7a 78 b1 ad d0 a8 3c c3 57 96 cb c8 5a e8 0b ba 56 f8 00 2f 0e 5f 46 23 3e 47 0f 5a ec 6b ae f4 a1 6c 19 59 09 8d 9a 09 7d a9 5b 6c aa 4c da 09 3b a3 30 c3 19 b6 13 06 a6 6e 19 59 09 ad c0 16 01 91 93 80 ab f0 91 27 f0 4b 74 9c a2 6e 2d d7 ea de 37 68 0a d7 56 05 b2 64 34 c8 36 a5 a5 90 01 57 85 76 3f 53 bf 0a 35 d8 62 cf 5f cd 14 af a4 34 Data Ascii: VQUo{2x>Q>QbH\|;,9(rVn@E~NMp:q!?YYqYyEcV\0WmqY0tzx<WZV/_F#>GZklY}[lL;0nY'Ktn-7hVd46Wv?S5b_4
2025-01-07 19:03:18 UTC	10157	IN	Data Raw: 5a ca f8 b1 13 1a 15 66 b8 80 6b 87 27 70 29 b0 15 6c 25 7c e8 0b 33 8c 32 5c a1 6c 28 f4 04 ae 52 05 4c 3c eb e0 3d f3 5b a2 9d 90 37 13 32 3b 21 53 9e e6 97 2c c1 5d 2f de af 34 0a ca 67 26 ab c0 75 3d 07 ae 4c 3c 3c ff 09 82 ad 22 5c bd e4 5e c4 be 3f 10 8f 15 bc 8c 6b 37 ff 01 f7 97 fd 05 c3 3e 3c 01 f2 03 da 2e 2e 96 f9 62 a0 36 3d 5d ad 85 3f 4e 5d 7c fc cc 3b cf 2a c0 c5 d4 34 f6 ba ec f5 45 5b a1 08 5c 62 5b a1 be 1e 3e 64 c0 15 6e 2a ec ba c0 d5 11 b6 42 5f 59 2e 5f d6 42 ab d0 65 a4 76 89 e0 25 8e 0b ac f4 c3 41 cb c0 42 e8 4f d9 d2 c3 96 5f 75 4b d8 bd d5 11 ea 56 18 b8 da 69 27 b4 a2 6e 89 56 42 9e db e2 d5 ef 06 b0 c5 80 a8 f6 fb 1f b1 74 f0 08 2c a0 8b 52 a6 50 6d d1 a6 48 53 b2 58 15 f7 81 de 71 c0 b8 14 e0 f8 54 60 6a 2e 1c e9 29 a8 12 f6 Data Ascii: Zfk'p)l%\|32\l(RL<=[72;!S,]/4g&u=L<<"\^?k7><..b6=]?N]\|;4E[\b[>dnB_Y._Bev%ABO_uKVi'nVBt,RPmHSXqT`j.)
2025-01-07 19:03:18 UTC	8077	IN	Data Raw: 5f d0 d5 5e 8b a1 1e bc ac a8 5e be 20 cc df 98 7d 1d 23 35 4b 0f 5a 46 59 2d bd aa 15 8c 8d b0 4b c0 56 47 03 57 20 4d 85 66 39 2e 7f b6 42 ab 2a 97 00 5d d5 ef 7f 80 35 fd 06 60 b5 a6 72 6d d1 54 ae dd 71 04 5a 4f 4e 81 23 31 12 4d 8f 4e 41 6d cf 4c 45 dd da a9 c1 d6 fa c8 08 ec 7a e8 21 b7 62 c6 61 4b bf ec 58 5f 96 e1 6b ff 96 59 7e 2b d0 c2 8c 30 70 59 28 75 09 16 b8 7c 34 15 9a e5 b8 98 ca c5 6c 7a 6b 35 5b e1 1a dd 02 64 43 95 4b 80 ae d9 0b 51 73 c2 99 d8 2b 45 29 e7 60 ad 36 f5 0a 78 25 60 df 99 7f 40 e3 d3 7f 42 ed 1d 7f c7 81 d3 27 28 c0 c5 94 b0 fd f4 fc dd b6 74 ec f9 e3 2b f4 b5 57 98 ab 5b 6b b4 fc d6 3a 41 dd 32 ca 6f f1 c2 8c 8a ed 9e 95 f0 bb 2a 75 3b b8 b4 4a 78 0e 5c 5d a1 a1 30 58 e0 72 b6 33 cf d5 0e e8 32 cc 76 99 82 d7 36 4f 00 0b Data Ascii: _^^ }#5KZFY-KVGW Mf9.B]5`rmTqZON#1MNAmLEz!baKX_kY~+0pY(u\|4lzk5[dCKQs+E)`6x%`@B'(t+W[k:A2ou;Jx\]0Xr32v6O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49904	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	871	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 3e0caf11-f29c-4f69-a86d-93b21bd518d3 X-Runtime: 0.002813 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49905	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	873	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 26a5bb95-8b69-4837-86cd-0556e7bb8975 X-Runtime: 0.001999 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49906	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	529	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20os_version%20%3D%2010&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5a086c39-21d9-43a0-8332-0fa70b496939 X-Runtime: 0.001424 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49908	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	881	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: fa21f0de-4e0b-4279-8ed9-0d6f0d7c062b X-Runtime: 0.001985 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49909	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	530	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20language%20%3D%20en-US&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: cba13aed-1635-4b12-88d4-8e45c2f8504f X-Runtime: 0.002378 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49907	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	873	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 15e06d7a-57e4-4714-a803-43f4282b98d1 X-Runtime: 0.001400 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49912	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	529	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20colorDepth%20%3D%2024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 2c0da6fa-cfa9-496a-9993-3bf9ccb29aa4 X-Runtime: 0.002045 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49910	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	876	OUT	GET /trace?id=7d65d118199738ee&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 60140aff-768d-4864-92e8-3bfc935aa7b2 X-Runtime: 0.002259 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49911	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	527	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20height%20%3D%201024&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:18 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: f5087c0d-051b-4d48-8cde-43c029f73517 X-Runtime: 0.001618 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49913	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:18 UTC	526	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20width%20%3D%201280&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 16394708-9e0b-42f6-959f-310d50d2f47a X-Runtime: 0.001634 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49914	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	862	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20pinlady&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 56b0b95d-a0e9-4ab3-beb1-0f4b3ca441c1 X-Runtime: 0.001760 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49917	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	529	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: b471c2c1-212f-4699-8282-d31a2a953864 X-Runtime: 0.001796 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49921	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	852	OUT	GET /trace?id=7d65d118199738ee&msg=java_version_pl%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 925af031-0c18-472f-908d-a271346c0e77 X-Runtime: 0.001883 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49923	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	538	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chrome%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 03734233-d639-4a0d-9f0a-d75fa749a22c X-Runtime: 0.001765 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49922	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	865	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20deployJava&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5c3480bc-2522-4ad6-a8fa-7e39476a2e7a X-Runtime: 0.001937 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49925	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	854	OUT	GET /trace?id=7d65d118199738ee&msg=java_version_jres%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: de9fdf51-f299-4924-bba7-7183320a3e8d X-Runtime: 0.002049 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49926	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	540	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Chromium%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 3e2327b3-3688-48f0-a4e2-ca7bdd2279b1 X-Runtime: 0.001993 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49928	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	851	OUT	GET /trace?id=7d65d118199738ee&msg=java_version%20%3D%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 86301619-c7b0-425c-8827-35f0f1d45256 X-Runtime: 0.001743 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49930	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	846	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20flash%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: b4d56deb-30d2-4f0a-beaf-0824e4004863 X-Runtime: 0.001678 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49929	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	548	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20Microsoft%20Edge%20PDF%20Viewer&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: b055398f-bbe1-4f10-b01a-5b39ada5b6f2 X-Runtime: 0.001340 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49932	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	540	OUT	GET /trace?id=7d65d118199738ee&msg=BrowserDetect%20-%20plugin%20WebKit%20built-in%20PDF&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: d6ba814f-876e-4217-bd9b-8df1d257d30e X-Runtime: 0.001882 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49931	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	543	OUT	GET /trace?id=7d65d118199738ee&msg=Chrome%20browser%2C%20using%20more%20detailed%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 550e9727-ecc9-4cab-ab90-3bf4fe2ad4aa X-Runtime: 0.001578 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49933	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	842	OUT	GET /trace?id=7d65d118199738ee&msg=flash%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ba03c678-25b4-4dbf-87e0-0cd2cc5c7d13 X-Runtime: 0.002005 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49934	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	529	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20pinlady&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:19 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 9a328160-795a-4a05-ad3c-9a757714cfb9 X-Runtime: 0.002020 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49936	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	844	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20pdf%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: c497ad0e-4ea7-49c2-881f-b2aabaee0b72 X-Runtime: 0.001854 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49937	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	519	OUT	GET /trace?id=7d65d118199738ee&msg=java_version_pl%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 10f1f414-fb5c-48d9-9388-22efce32c77b X-Runtime: 0.002076 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49938	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:19 UTC	863	OUT	GET /trace?id=7d65d118199738ee&msg=Could%20not%20find%20AdobeReader%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5be02af7-be87-4f04-9902-20399cd3f88d X-Runtime: 0.002101 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49941	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	840	OUT	GET /trace?id=7d65d118199738ee&msg=pdf%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5a8f7350-5868-4258-aaf9-aa8633bfeb9f X-Runtime: 0.001847 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49942	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	532	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Java%20version%20from%20deployJava&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: f9914e57-4c67-4168-b4d6-e2003207fde0 X-Runtime: 0.001883 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49944	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	850	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20quicktime%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 0dac5e92-4f97-4b7a-9e32-2e556e1e51dc X-Runtime: 0.001654 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49947	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	521	OUT	GET /trace?id=7d65d118199738ee&msg=java_version_jres%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: cd3e88ba-e3ae-4c4a-9495-770da741c307 X-Runtime: 0.001883 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49943	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	846	OUT	GET /trace?id=7d65d118199738ee&msg=quicktime%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 7e9b65a0-3cd8-47a5-bb57-069cfbcbb4b6 X-Runtime: 0.001969 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49945	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	513	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20flash%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 819f836c-d290-4789-bb25-1d77d0ca132a X-Runtime: 0.001250 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49948	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	518	OUT	GET /trace?id=7d65d118199738ee&msg=java_version%20%3D%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 37e4b5b3-d455-4a99-838e-a24392d8aa5f X-Runtime: 0.001555 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49950	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	851	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20RealPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 1dcff2cd-d5a5-4bb5-bb7a-f5f1cbbd4505 X-Runtime: 0.001711 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49951	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	509	OUT	GET /trace?id=7d65d118199738ee&msg=flash%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: a011e02b-5444-4d5b-97fc-bbf928045029 X-Runtime: 0.001811 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49952	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	847	OUT	GET /trace?id=7d65d118199738ee&msg=realplayer%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: ea3a576e-0aff-40f9-9513-bbcba4c46665 X-Runtime: 0.002087 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49953	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	511	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20pdf%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 96119a00-9e47-49bc-b152-441a60706bf3 X-Runtime: 0.001859 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49954	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	852	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Silverlight%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 2a5b4295-a2e3-4e72-bd0a-6cd7c520b47d X-Runtime: 0.001772 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49955	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	848	OUT	GET /trace?id=7d65d118199738ee&msg=silverlight%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 8f5414c3-c21a-4b60-ba6f-1b3e142287dc X-Runtime: 0.001989 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49956	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	530	OUT	GET /trace?id=7d65d118199738ee&msg=Could%20not%20find%20AdobeReader%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 94743d6b-45ba-4a9c-8cce-f025303bcfee X-Runtime: 0.002188 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49957	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	859	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20WindowsMediaPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 1cfa3565-bea6-4a23-ae2c-78cb66907e54 X-Runtime: 0.001770 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49959	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	840	OUT	GET /trace?id=7d65d118199738ee&msg=wmp%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: b9173d06-d65f-4b32-b28d-a42b0a5ac94f X-Runtime: 0.001378 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49960	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	507	OUT	GET /trace?id=7d65d118199738ee&msg=pdf%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: c4425fa3-ca04-4fff-9ac4-6ed952d779d8 X-Runtime: 0.001856 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49958	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	517	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20quicktime%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 5230472a-9aa7-4918-ac55-d764bac4efad X-Runtime: 0.001923 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49961	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	513	OUT	GET /trace?id=7d65d118199738ee&msg=quicktime%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:20 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 2b7be7d3-4ee0-459c-b14e-0065e7f9ea5a X-Runtime: 0.002283 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49967	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	850	OUT	GET /trace?id=7d65d118199738ee&msg=training_page_no_browser_post&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: e7708953-2f48-4149-b3cb-56c02a7f48d2 X-Runtime: 0.001973 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49968	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:20 UTC	518	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20RealPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 979afd20-1010-4dc0-8589-fa94726e18d3 X-Runtime: 0.002054 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49970	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	514	OUT	GET /trace?id=7d65d118199738ee&msg=realplayer%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 88e322de-d71b-4d54-87b4-898b4d0c28a6 X-Runtime: 0.002344 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49969	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	850	OUT	GET /trace?id=7d65d118199738ee&msg=redirect_url%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 0842b1d2-ea80-41ea-b5d7-a2bf36955d3e X-Runtime: 0.001509 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49971	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	519	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20Silverlight%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 10611c6b-cd57-474a-baab-c19e5fa102f5 X-Runtime: 0.001847 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49972	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	515	OUT	GET /trace?id=7d65d118199738ee&msg=silverlight%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 0e53090f-5d8a-4da4-9047-13f4559f44bc X-Runtime: 0.001966 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49973	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	526	OUT	GET /trace?id=7d65d118199738ee&msg=Loading%20WindowsMediaPlayer%20version&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 00cab1f8-0088-49f0-b947-505d77a5b524 X-Runtime: 0.001909 X-Host-Info: lw-prod-us-i-02537b8c7edd28edd X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49974	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	507	OUT	GET /trace?id=7d65d118199738ee&msg=wmp%20%3D%20unknown&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: de269465-5fb9-48b7-bcb5-f49ad13d6cd9 X-Runtime: 0.001957 X-Host-Info: lw-prod-us-i-0d22eddbb0a9eafb5 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49979	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	517	OUT	GET /trace?id=7d65d118199738ee&msg=training_page_no_browser_post&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: c568af39-9d0d-47f9-99c5-9d1e5917e049 X-Runtime: 0.001452 X-Host-Info: lw-prod-us-i-0836334fc2fbeda37 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49982	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	517	OUT	GET /trace?id=7d65d118199738ee&msg=redirect_url%20is%20undefined&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	627	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache X-Request-Id: 7fc71a6e-520c-4ff1-a032-dc40f8375172 X-Runtime: 0.001985 X-Host-Info: lw-prod-us-i-02444e3bed79f9e00 X-Host-Info: ; 6dde951ff7d320bbada6b4ff0582e1395970a1ce Server: ThreatSim-Web-Server Access-Control-Allow-Origin: *
2025-01-07 19:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49981	54.175.8.220	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:21 UTC	750	OUT	GET /favicon.ico HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:21 UTC	272	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:21 GMT Content-Type: image/x-icon Content-Length: 0 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:47 GMT ETag: "67588373-0" Server: ThreatSim-Web-Server Access-Control-Allow-Origin: * Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49987	54.80.6.128	443	3568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 19:03:22 UTC	417	OUT	GET /favicon.ico HTTP/1.1 Host: hallmark.greetingsweb.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: EXFILGUID=65d1199738; link_clicked_65d1199738=1
2025-01-07 19:03:22 UTC	272	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 19:03:22 GMT Content-Type: image/x-icon Content-Length: 0 Connection: close Last-Modified: Tue, 10 Dec 2024 18:07:48 GMT ETag: "67588374-0" Server: ThreatSim-Web-Server Access-Control-Allow-Origin: * Accept-Ranges: bytes

Target ID:	0
Start time:	14:02:42
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:02:46
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2212,i,9266091377051850730,3308463755355501370,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:02:52
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hallmark.greetingsweb.com/2865d1125997389a?l=22"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	HTTP Parser: No favicon
Source: https://hallmark.greetingsweb.com/load_training?guid=7d65d118199738ee&correlation_id=e6dcdb89-a2c9-41e7-9f9d-c6b1267e45dc	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hallmark.greetingsweb.com
Source: global traffic	DNS traffic detected: DNS query: _49153._https.hallmark.greetingsweb.com
Source: global traffic	DNS traffic detected: DNS query: tslp.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: java.com
Source: global traffic	DNS traffic detected: DNS query: www.java.com
Source: global traffic	DNS traffic detected: DNS query: d25q7gseii1o1q.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: ts-uploads.s3.amazonaws.com

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://hallmark.greetingsweb.com/2865d1125997389a?l=22

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Windows Analysis Report
https://hallmark.greetingsweb.com/2865d1125997389a?l=22