Create Interactive Tour

Analysis Report http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT

Overview

General Information

Sample URL:	http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT
Analysis ID:	429144
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Found iframes

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

iexplore.exe (PID: 5116 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4996 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5&co=aHR0cDovL3dlYmFjY2Vzcy5nYXBvcnRzLmNvbTo4MA..&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=r0w700hrwat5
Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5&co=aHR0cDovL3dlYmFjY2Vzcy5nYXBvcnRzLmNvbTo4MA..&hl=en&v=sG0iO6gHcGdWJzjJjW9AY49S&size=invisible&cb=r0w700hrwat5

Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Title: Log In does not match URL
Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Title: Log In does not match URL

Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Has password / email / username input fields
Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: Has password / email / username input fields

Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: No <meta name="author".. found
Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: No <meta name="author".. found
Source: https://www.navis.com/	HTTP Parser: No <meta name="author".. found
Source: https://www.navis.com/	HTTP Parser: No <meta name="author".. found

Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: No <meta name="copyright".. found
Source: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	HTTP Parser: No <meta name="copyright".. found
Source: https://www.navis.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.navis.com/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.201.125.192:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.201.125.192:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.5.192:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.5.192:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.95.105.148:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.95.105.148:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.5.154:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.5.154:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.99:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.99:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.86.117.43:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.86.117.43:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.6.75.166:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.0.129.236:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.0.129.236:443 -> 192.168.2.6:49798 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 882 WEB-CGI calendar access 192.168.2.6:49718 -> 104.26.6.110:80
Source: Traffic	Snort IDS: 882 WEB-CGI calendar access 192.168.2.6:49713 -> 104.26.6.110:80
Source: Traffic	Snort IDS: 882 WEB-CGI calendar access 192.168.2.6:49714 -> 104.26.6.110:80

Source: global traffic	HTTP traffic detected: GET /express/secure/today.jsp?Facility=GCT HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tooltip.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/main.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4standard.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4addendum.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/n4client.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/ImageSwap.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/popupWindow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/browserSniff.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/ieEmulation.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/font.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/menu.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/actionbar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/content.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/navPane.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/button.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/table.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/form.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tab.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/header.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/shadow.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/modalDialog.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/calendar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/appointment.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/common.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/globalEvents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/autocomplete.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/lovHandlers.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/getOptions.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/dropShadow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/simplecalendar.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/paging.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/logo.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/s.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/spacer.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/poweredbynavis.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/down.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/up.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCTAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: webaccess.gaports.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /express/index.jsp HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tooltip.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1853-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/main.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1732-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4standard.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"19654-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4addendum.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"9069-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/n4client.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMTIf-None-Match: W/"13807-1524595664000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/font.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"833-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/menu.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2886-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/actionbar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2708-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/navPane.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3126-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/content.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2627-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/button.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3835-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/table.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3121-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/form.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1113-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tab.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2768-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/header.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1517-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/shadow.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"718-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/modalDialog.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"863-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/calendar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2243-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/appointment.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1227-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/ImageSwap.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2128-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/popupWindow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2361-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/browserSniff.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"15400-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/ieEmulation.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"6959-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/common.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"5576-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/globalEvents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3702-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/autocomplete.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"21234-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/lovHandlers.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1695-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/getOptions.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"4948-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/dropShadow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2700-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/simplecalendar.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"18756-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/paging.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"998-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/logo.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Fri, 31 Aug 2018 19:11:15 GMTIf-None-Match: W/"12519-1535742675345"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/s.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/up.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"172-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/down.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"175-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/icons/export.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/icons/pdf.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/spacer.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/poweredbynavis.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/index.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"840-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/about.jsp HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tooltip.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1853-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/main.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1732-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4standard.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"19654-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4addendum.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"9069-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/n4client.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMTIf-None-Match: W/"13807-1524595664000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/font.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"833-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/menu.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2886-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/actionbar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2708-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/content.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2627-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/navPane.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3126-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/button.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3835-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/table.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3121-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/form.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1113-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tab.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2768-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/header.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1517-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/shadow.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"718-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/modalDialog.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"863-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/calendar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2243-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/appointment.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1227-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/ImageSwap.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2128-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/popupWindow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2361-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/browserSniff.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"15400-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/ieEmulation.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"6959-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/common.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"5576-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/globalEvents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3702-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/autocomplete.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"21234-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/lovHandlers.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1695-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/getOptions.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"4948-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/dropShadow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2700-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/simplecalendar.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"18756-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/paging.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"998-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/logo.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Fri, 31 Aug 2018 19:11:15 GMTIf-None-Match: W/"12519-1535742675345"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/s.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/up.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"172-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/down.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"175-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/spacer.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/poweredbynavis.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/about.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"840-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/showNotice.do?report_type=1&GKEY=112 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tooltip.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1853-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/main.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1732-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4standard.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"19654-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4addendum.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"9069-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/n4client.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMTIf-None-Match: W/"13807-1524595664000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/font.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"833-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/menu.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2886-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/actionbar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2708-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/content.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2627-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/navPane.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3126-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/table.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3121-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/button.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3835-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/form.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1113-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tab.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2768-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/header.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1517-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/shadow.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"718-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/modalDialog.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"863-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/calendar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2243-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/appointment.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1227-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/ImageSwap.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2128-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/popupWindow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2361-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/browserSniff.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"15400-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/ieEmulation.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"6959-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/common.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"5576-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/globalEvents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3702-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/autocomplete.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"21234-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/lovHandlers.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1695-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/getOptions.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"4948-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/dropShadow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2700-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/simplecalendar.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"18756-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/paging.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"998-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/logo.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Fri, 31 Aug 2018 19:11:15 GMTIf-None-Match: W/"12519-1535742675345"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/s.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/up.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"172-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/down.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"175-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/icons/export.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"313-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/icons/pdf.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"980-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/spacer.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/poweredbynavis.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"840-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /express/terms.jsp HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comConnection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tooltip.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1853-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/main.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1732-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4standard.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"19654-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/n4addendum.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMTIf-None-Match: W/"9069-1619547716000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/n4client.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMTIf-None-Match: W/"13807-1524595664000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/font.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"833-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/menu.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2886-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/actionbar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2708-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/content.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2627-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/navPane.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3126-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/button.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3835-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/table.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3121-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/form.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1113-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/tab.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2768-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/header.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1517-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/shadow.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"718-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/modalDialog.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"863-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/calendar.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2243-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/css/modules/appointment.css HTTP/1.1Accept: text/css, /Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1227-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/ImageSwap.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2128-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/popupWindow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2361-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/browserSniff.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"15400-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/ieEmulation.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"6959-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/common.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"5576-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/globalEvents.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"3702-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/autocomplete.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"21234-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/lovHandlers.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"1695-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/getOptions.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"4948-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/dropShadow.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"2700-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/includes/simplecalendar.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"18756-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/javascript/paging.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"998-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/skins/gpa/logo.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Fri, 31 Aug 2018 19:11:15 GMTIf-None-Match: W/"12519-1535742675345"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/s.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/up.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"172-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/down.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"175-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/spacer.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"43-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Source: global traffic	HTTP traffic detected: GET /express/images/poweredbynavis.gif HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://webaccess.gaports.com/express/terms.jspAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: webaccess.gaports.comIf-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMTIf-None-Match: W/"840-1619547718000"Connection: Keep-AliveCookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3

Source: unknown

DNS traffic detected: queries for: webaccess.gaports.com

Source: global[1].js.2.dr	String found in binary or memory: http://albertino.eti.br
Source: jquery.matchHeight-min[1].js.2.dr	String found in binary or memory: http://brm.io/jquery-match-height/
Source: popover[1].js.2.dr	String found in binary or memory: http://code.jquery.com/jquery-1.6.4.js
Source: animate[1].css.2.dr	String found in binary or memory: http://daneden.me/animate
Source: allIntegrations[1].js.2.dr	String found in binary or memory: http://developers.hubspot.com/docs/methods/tracking_code_api/tracking_code_overview
Source: global[1].css.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: global[1].js.2.dr	String found in binary or memory: http://getbootstrap.com/javascript/#modals
Source: global[1].js.2.dr	String found in binary or memory: http://github.com/kenwheeler/slick
Source: global[1].js.2.dr	String found in binary or memory: http://github.com/kenwheeler/slick/issues
Source: global[1].js.2.dr	String found in binary or memory: http://james.padolsey.com)
Source: global[1].js.2.dr	String found in binary or memory: http://jfbastien.github.io/papers/Math.signbit.html
Source: global[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: global[1].js.2.dr	String found in binary or memory: http://jsperf.lnkit.com/fast-apply/5
Source: global[1].js.2.dr	String found in binary or memory: http://kenwheeler.github.io
Source: global[1].js.2.dr	String found in binary or memory: http://kenwheeler.github.io/slick
Source: popover[1].js.2.dr	String found in binary or memory: http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascr
Source: animate[1].css.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: simplecalendar[1].js.2.dr	String found in binary or memory: http://tech.irt.org/articles/js052/index.htm
Source: browserSniff[1].js.2.dr	String found in binary or memory: http://tim.dobbelaere.com)
Source: global[1].js.2.dr	String found in binary or memory: http://vodkabears.github.io/vide/
Source: index[1].htm.2.dr	String found in binary or memory: http://webaccess.gaports.com
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/about.jsp
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/about.jspess/index.jsp
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/index.jsp
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/index.jspy.jsp?Facility=GCT~
Source: index[1].htm.2.dr	String found in binary or memory: http://webaccess.gaports.com/express/secure/Today.jsp?Facility=
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/terms.jsp
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/express/terms.jspdo?report_type=1&GKEY=112~
Source: imagestore.dat.2.dr	String found in binary or memory: http://webaccess.gaports.com/favicon.ico~
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/xpress/secure/today.jsp?Facility=GCT
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: http://webaccess.gaports.com/xpress/secure/today.jsp?Facility=GCT.com/express/secure/today.jsp?Facil
Source: KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: browserSniff[1].js.2.dr	String found in binary or memory: http://www.it97.de/javascript/js_tutorial/bstat/browseraol.html
Source: browserSniff[1].js.2.dr	String found in binary or memory: http://www.it97.de/javascript/js_tutorial/bstat/navobj.html
Source: index[1].htm.2.dr	String found in binary or memory: http://www.navis.com
Source: about[1].htm.2.dr	String found in binary or memory: http://www.navis.com/
Source: about[1].htm.2.dr	String found in binary or memory: http://www.navis.com/pr_webaccess.jsp
Source: a738e861168318774f614d60b63625f12599f189[1].dat.2.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: index[1].htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: launch-55dc93f37385.min[1].js.2.dr	String found in binary or memory: https://assets.adobedtm.com/175f7caa2b90/53d2855b9b40/launch-55dc93f37385.js
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=378607
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=449857
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=470258
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.chromium.org/p/chromium/issues/detail?id=589347
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/12359
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.jquery.com/ticket/13378
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=137337
Source: global[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: global[1].js.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: popover[1].js.2.dr	String found in binary or memory: https://caniuse.com/#search=webp
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: global[1].js.2.dr	String found in binary or memory: https://code.google.com/p/v8/issues/detail?id=3509
Source: global[1].js.2.dr	String found in binary or memory: https://code.google.com/p/v8/issues/detail?id=687
Source: global[1].js.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: global[1].js.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: global[1].js.2.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#resolved-values
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD-A.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_bZF3gnD-A.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD-A.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD-A.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhzQ.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0d.woff)
Source: global[1].js.2.dr	String found in binary or memory: https://gist.github.com/BrendanEich/4294d5c212a6d2254703
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/Albejr/jquery-albe-timeline
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/DavidBruant/Map-Set.prototype.toJSON
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/amitguptagwl
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/benjamingr/RexExp.escape
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/3229
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/eslint/eslint/issues/6125
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/facebook/regenerator/issues/274
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/feross/ieee754
Source: global[1].css.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/ljharb/proposal-is-error
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/mathiasbynens/String.prototype.at
Source: popover[1].js.2.dr	String found in binary or memory: https://github.com/moagrius/Color/blob/master/Color.js
Source: animate[1].css.2.dr	String found in binary or memory: https://github.com/nickpettit/glide
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/rwaldron/tc39-notes/blob/master/es6/2014-09/sept-25.md#510-globalasap-for-enqueui
Source: picturefill.min[1].js.2.dr	String found in binary or memory: https://github.com/scottjehl/picturefill/blob/master/Authors.txt;
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/sebmarkbage/ecmascript-string-left-right-trim
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/Array.prototype.includes
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-global
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-object-getownpropertydescriptors
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-object-values-entries
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-promise-finally
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-promise-try
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/tc39/proposal-string-pad-start-end
Source: global[1].js.2.dr, global[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/websockets/ws/pull/645
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/zenparsing/es-observable
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/173
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/280
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/339
Source: global[1].js.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#category-listed
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled
Source: global[1].js.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/syntax.html#attributes-2
Source: global[1].js.2.dr	String found in binary or memory: https://jquery.com/
Source: global[1].js.2.dr	String found in binary or memory: https://jquery.org/license
Source: global[1].js.2.dr	String found in binary or memory: https://jsperf.com/getall-vs-sizzle/2
Source: global[1].js.2.dr	String found in binary or memory: https://jsperf.com/thor-indexof-vs-for/5
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: global[1].js.2.dr	String found in binary or memory: https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-48
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-54
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-57
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-59
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-61
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-64
Source: global[1].js.2.dr	String found in binary or memory: https://promisesaplus.com/#point-75
Source: global[1].js.2.dr	String found in binary or memory: https://raw.github.com/facebook/regenerator/master/LICENSE
Source: global[1].js.2.dr	String found in binary or memory: https://rwaldron.github.io/proposal-math-extensions/
Source: picturefill.min[1].js.2.dr	String found in binary or memory: https://scottjehl.github.io/picturefill/
Source: global[1].js.2.dr	String found in binary or memory: https://sizzlejs.com/
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: analytics[1].js.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/String.prototype.matchAll/
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-toindex
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-map.from
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-map.of
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-set.from
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-set.of
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.from
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.of
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-weakset.from
Source: global[1].js.2.dr	String found in binary or memory: https://tc39.github.io/proposal-setmap-offrom/#sec-weakset.of
Source: global[1].js.2.dr	String found in binary or memory: https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: global[1].js.2.dr	String found in binary or memory: https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: today[1].htm.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5
Source: recaptcha__en[1].js.2.dr, anchor[1].htm.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5&co=aHR0
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: webworker[1].js.2.dr, anchor[1].htm.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js
Source: anchor[1].htm.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/styles__ltr.css
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: https://www.navis.com/
Source: ~DF28BA84602B075A4F.TMP.1.dr	String found in binary or memory: https://www.navis.com/.com/express/terms.jspdo?report_type=1&GKEY=112
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.navis.com/favicon.png#

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.201.125.192:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.201.125.192:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.5.192:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.5.192:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.95.105.148:443 -> 192.168.2.6:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.95.105.148:443 -> 192.168.2.6:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.5.154:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.5.154:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.99:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.99:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.86.117.43:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.86.117.43:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.6.75.166:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.0.129.236:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.0.129.236:443 -> 192.168.2.6:49798 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@3/139@17/11

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CF7C2D6C-C4C1-11EB-90E5-ECF4BB2D2496}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9C1055103331DFD4.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
webaccess.gaports.com	0%	Virustotal	Browse
sni1gl.wpc.gammacdn.net	0%	Virustotal	Browse
a.b0e8.com	0%	Virustotal	Browse
cdn.bc0a.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.of	0%	Avira URL Cloud	safe
http://webaccess.gaports.com/favicon.ico	0%	Avira URL Cloud	safe
https://promisesaplus.com/#point-75	0%	URL Reputation	safe
https://promisesaplus.com/#point-75	0%	URL Reputation	safe
https://promisesaplus.com/#point-75	0%	URL Reputation	safe
http://webaccess.gaports.com	0%	Avira URL Cloud	safe
http://albertino.eti.br	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-setmap-offrom/#sec-map.from	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://jfbastien.github.io/papers/Math.signbit.html	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-toindex	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten	0%	Avira URL Cloud	safe
https://promisesaplus.com/#point-64	0%	URL Reputation	safe
https://promisesaplus.com/#point-64	0%	URL Reputation	safe
https://promisesaplus.com/#point-64	0%	URL Reputation	safe
https://tc39.github.io/proposal-setmap-offrom/#sec-set.of	0%	Avira URL Cloud	safe
https://promisesaplus.com/#point-61	0%	URL Reputation	safe
https://promisesaplus.com/#point-61	0%	URL Reputation	safe
https://promisesaplus.com/#point-61	0%	URL Reputation	safe
https://tc39.github.io/proposal-setmap-offrom/#sec-weakset.of	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.from	0%	Avira URL Cloud	safe
http://kenwheeler.github.io	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://rwaldron.github.io/proposal-math-extensions/	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
http://www.it97.de/javascript/js_tutorial/bstat/browseraol.html	0%	Avira URL Cloud	safe
https://tc39.github.io/String.prototype.matchAll/	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-setmap-offrom/#sec-map.of	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray	0%	Avira URL Cloud	safe
http://tim.dobbelaere.com)	0%	Avira URL Cloud	safe
http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascr	0%	URL Reputation	safe
http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascr	0%	URL Reputation	safe
http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascr	0%	URL Reputation	safe
http://james.padolsey.com)	0%	Avira URL Cloud	safe
http://www.it97.de/javascript/js_tutorial/bstat/navobj.html	0%	Avira URL Cloud	safe
http://brm.io/jquery-match-height/	0%	URL Reputation	safe
http://brm.io/jquery-match-height/	0%	URL Reputation	safe
http://brm.io/jquery-match-height/	0%	URL Reputation	safe
http://vodkabears.github.io/vide/	0%	Avira URL Cloud	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://webaccess.gaports.com/	0%	Avira URL Cloud	safe
https://tc39.github.io/proposal-setmap-offrom/	0%	Avira URL Cloud	safe
http://kenwheeler.github.io/slick	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webaccess.gaports.com	104.26.6.110	true	true	0%, Virustotal, Browse	unknown
sni1gl.wpc.gammacdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
a.b0e8.com	34.95.105.148	true	false	0%, Virustotal, Browse	unknown
cdn.bc0a.com	35.201.125.192	true	false	0%, Virustotal, Browse	unknown
cdn.b0e8.com	35.190.5.192	true	false		unknown
prod-east-stats-tap-alb-627711272.us-east-1.elb.amazonaws.com	54.86.117.43	true	false		high
stats.l.doubleclick.net	142.251.5.154	true	false		high
a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com	52.0.129.236	true	false		high
cdnjs.cloudflare.com	104.16.19.94	true	false		high
www.google.co.uk	172.217.19.99	true	false		unknown
prod-east-pipedream-alb-988701200.us-east-1.elb.amazonaws.com	52.6.75.166	true	false		high
fast.wistia.com	unknown	unknown	false		high
assets.adobedtm.com	unknown	unknown	false		high
www.navis.com	unknown	unknown	false		high
stats.g.doubleclick.net	unknown	unknown	false		high
embed-fastly.wistia.com	unknown	unknown	false		high
pipedream.wistia.com	unknown	unknown	false		high
dc.services.visualstudio.com	unknown	unknown	false		high
marvel-b2-cdn.bc0a.com	unknown	unknown	false		unknown
dl.episerver.net	unknown	unknown	false		high
fg8vvsvnieiv3ej16jby.litix.io	unknown	unknown	false		unknown
distillery.wistia.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://webaccess.gaports.com/favicon.ico	true	Avira URL Cloud: safe	unknown
https://www.navis.com/	false		high
http://webaccess.gaports.com/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.of	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://www.navis.com/favicon.png#	imagestore.dat.2.dr	false		high
https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	global[1].js.2.dr	false		high
http://github.com/kenwheeler/slick	global[1].js.2.dr	false		high
https://promisesaplus.com/#point-75	global[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://webaccess.gaports.com	index[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/rwaldron/tc39-notes/blob/master/es6/2014-09/sept-25.md#510-globalasap-for-enqueui	global[1].js.2.dr	false		high
https://github.com/tc39/proposal-string-pad-start-end	global[1].js.2.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled	global[1].js.2.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=29084	global[1].js.2.dr	false		high
https://github.com/tc39/proposal-object-getownpropertydescriptors	global[1].js.2.dr	false		high
https://github.com/eslint/eslint/issues/6125	global[1].js.2.dr	false		high
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled	global[1].js.2.dr	false		high
http://albertino.eti.br	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	picturefill.min[1].js.2.dr	false		high
https://caniuse.com/#search=webp	popover[1].js.2.dr	false		high
http://code.jquery.com/jquery-1.6.4.js	popover[1].js.2.dr	false		high
https://tc39.github.io/proposal-setmap-offrom/#sec-map.from	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	global[1].js.2.dr	false		high
http://www.videolan.org/x264.html	a738e861168318774f614d60b63625f12599f189[1].dat.2.dr	false		high
http://getbootstrap.com)	global[1].css.2.dr	false	Avira URL Cloud: safe	low
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	global[1].js.2.dr	false		high
http://jfbastien.github.io/papers/Math.signbit.html	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/ecma262/#sec-toindex	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	global[1].js.2.dr	false		high
https://bugs.jquery.com/ticket/13378	global[1].js.2.dr	false		high
https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatten	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://promisesaplus.com/#point-64	global[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tc39.github.io/proposal-setmap-offrom/#sec-set.of	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/tc39/proposal-promise-finally	global[1].js.2.dr	false		high
https://www.navis.com/	~DF28BA84602B075A4F.TMP.1.dr	false		high
https://github.com/nickpettit/glide	animate[1].css.2.dr	false		high
https://promisesaplus.com/#point-61	global[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://tc39.github.io/proposal-setmap-offrom/#sec-weakset.of	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/proposal-setmap-offrom/#sec-weakmap.from	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
http://kenwheeler.github.io	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
http://tech.irt.org/articles/js052/index.htm	simplecalendar[1].js.2.dr	false		high
https://github.com/moagrius/Color/blob/master/Color.js	popover[1].js.2.dr	false		high
https://jsperf.com/getall-vs-sizzle/2	global[1].js.2.dr	false		high
https://tc39.github.io/proposal-flatMap/#sec-Array.prototype.flatMap	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	gtm[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/CSS/display	global[1].js.2.dr	false		high
https://rwaldron.github.io/proposal-math-extensions/	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/ljharb/proposal-is-error	global[1].js.2.dr	false		high
https://jquery.com/	global[1].js.2.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.it97.de/javascript/js_tutorial/bstat/browseraol.html	browserSniff[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/String.prototype.matchAll/	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/proposal-setmap-offrom/#sec-map.of	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	global[1].js.2.dr, global[1].css.2.dr	false		high
https://github.com/mathiasbynens/String.prototype.at	global[1].js.2.dr	false		high
https://tc39.github.io/proposal-flatMap/#sec-FlattenIntoArray	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/tc39/proposal-global	global[1].js.2.dr	false		high
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume	global[1].js.2.dr	false		high
https://github.com/jquery/sizzle/pull/225	global[1].js.2.dr	false		high
https://html.spec.whatwg.org/multipage/infrastructure.html#strip-and-collapse-whitespace	global[1].js.2.dr	false		high
https://sizzlejs.com/	global[1].js.2.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=449857	global[1].js.2.dr	false		high
http://tim.dobbelaere.com)	browserSniff[1].js.2.dr	false	Avira URL Cloud: safe	low
http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascr	popover[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Albejr/jquery-albe-timeline	global[1].js.2.dr	false		high
http://james.padolsey.com)	global[1].js.2.dr	false	Avira URL Cloud: safe	low
https://bugs.webkit.org/show_bug.cgi?id=136851	global[1].js.2.dr	false		high
http://jquery.org/license	global[1].js.2.dr	false		high
https://github.com/websockets/ws/pull/645	global[1].js.2.dr	false		high
https://github.com/facebook/regenerator/issues/274	global[1].js.2.dr	false		high
https://jsperf.com/thor-indexof-vs-for/5	global[1].js.2.dr	false		high
https://bugs.jquery.com/ticket/12359	global[1].js.2.dr	false		high
http://www.it97.de/javascript/js_tutorial/bstat/navobj.html	browserSniff[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/DavidBruant/Map-Set.prototype.toJSON	global[1].js.2.dr	false		high
http://getbootstrap.com/javascript/#modals	global[1].js.2.dr	false		high
http://brm.io/jquery-match-height/	jquery.matchHeight-min[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	global[1].js.2.dr	false		high
https://github.com/zloirock/core-js/issues/280	global[1].js.2.dr	false		high
https://raw.github.com/facebook/regenerator/master/LICENSE	global[1].js.2.dr	false		high
https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a	global[1].js.2.dr	false		high
https://drafts.csswg.org/cssom/#common-serializing-idioms	global[1].js.2.dr	false		high
http://vodkabears.github.io/vide/	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zenparsing/es-observable	global[1].js.2.dr	false		high
https://gist.github.com/BrendanEich/4294d5c212a6d2254703	global[1].js.2.dr	false		high
https://github.com/jquery/jquery/pull/557)	global[1].js.2.dr	false		high
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	global[1].js.2.dr	false		high
http://daneden.me/animate	animate[1].css.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/zloirock/core-js/issues/339	global[1].js.2.dr	false		high
https://github.com/tc39/proposal-object-values-entries	global[1].js.2.dr	false		high
http://github.com/kenwheeler/slick/issues	global[1].js.2.dr	false		high
https://github.com/zloirock/core-js/issues/173	global[1].js.2.dr	false		high
http://www.navis.com/pr_webaccess.jsp	about[1].htm.2.dr	false		high
https://github.com/amitguptagwl	global[1].js.2.dr	false		high
http://www.navis.com/	about[1].htm.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr	false		high
https://github.com/tc39/Array.prototype.includes	global[1].js.2.dr	false		high
https://tc39.github.io/proposal-setmap-offrom/	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://drafts.csswg.org/cssom/#resolved-values	global[1].js.2.dr	false		high
http://kenwheeler.github.io/slick	global[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://bugs.chromium.org/p/chromium/issues/detail?id=589347	global[1].js.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
35.190.5.192	cdn.b0e8.com	United States	15169	GOOGLEUS	false
35.201.125.192	cdn.bc0a.com	United States	15169	GOOGLEUS	false
52.0.129.236	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
34.95.105.148	a.b0e8.com	United States	15169	GOOGLEUS	false
142.251.5.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
104.26.6.110	webaccess.gaports.com	United States	13335	CLOUDFLARENETUS	true
152.199.21.175	sni1gl.wpc.gammacdn.net	United States	15133	EDGECASTUS	false
172.217.19.99	www.google.co.uk	United States	15169	GOOGLEUS	false
54.86.117.43	prod-east-stats-tap-alb-627711272.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
52.6.75.166	prod-east-pipedream-alb-988701200.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.16.19.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	429144
Start date:	03.06.2021
Start time:	16:16:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@3/139@17/11
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: http://webaccess.gaports.com/ Browsing link: http://webaccess.gaports.com/express/about.jsp Browsing link: http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112 Browsing link: http://webaccess.gaports.com/express/terms.jsp Browsing link: http://www.navis.com/
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.42.151.234, 168.61.161.212, 52.147.198.201, 104.43.193.48, 88.221.62.148, 142.250.201.196, 142.250.180.234, 172.217.16.99, 172.217.20.3, 13.64.90.137, 20.82.209.183, 152.199.19.161, 104.16.64.41, 104.16.63.41, 142.250.201.202, 184.30.20.234, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 104.18.19.118, 104.18.18.118, 172.217.19.104, 172.217.19.110, 40.114.241.141, 151.101.2.133, 151.101.66.133, 151.101.130.133, 151.101.194.133, 205.185.216.10, 205.185.216.42, 52.155.217.156, 20.54.26.129, 92.122.213.194, 92.122.213.247, 184.30.20.56 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, www.navis.com.cdn.cloudflare.net, cn-assets.adobedtm.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, e11290.dspg.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, www.google.com, dualstack.f4.shared.global.fastly.net, watson.telemetry.microsoft.com, www.gstatic.com, au-bg-shim.trafficmanager.net, www.google-analytics.com, fonts.googleapis.com, fs.microsoft.com, ajax.googleapis.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, d.sni.global.fastly.net, skypedataprdcolcus15.cloudapp.net, az416426.vo.msecnd.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, cs9.wpc.v0cdn.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, weu-breeziest-in.cloudapp.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, go.microsoft.com, www.googletagmanager.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, dl.episerver.net.cdn.cloudflare.net, www-googletagmanager.l.google.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, cds.d2s7q6s2.hwcdn.net, skypedataprdcoleus16.cloudapp.net, e7808.dscg.akamaiedge.net, go.microsoft.com.edgekey.net, dc.trafficmanager.net, dc.applicationinsights.microsoft.com, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\EQAWN5DV\webaccess.gaports[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.60769803854195
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFws5YgWHqJQAqVcobhAiE8YLVt7dgAJDxAatCCoA/jWg3Q9qSeVWFA:JFK1rUFqgDeAqVcwGiELVZZJiah/q2Qi
MD5:	370ADFB8C99F499E834043FA0EACDA40
SHA1:	1B11E1FAF35007C94A967CA577D204FCA85CC5CD
SHA-256:	073FA92B1B8E8A8652E82A0D332A0785D0DA3698532022EC4FFB32EFE6D00520
SHA-512:	462DBA6AE300FFB351A24E4A8B23B395EEE67E4036D0E7FF53808AB9D6D63565C24510B04F0AB7954EEC72784485F01D1EBAEEF95F917D1F669DA1E04215219E
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="_grecaptcha" value="09ANblmnjkZvN-_NAe2fIperWlz2XGXnHiWnaZQnAUroajYvuQJHSdx-Mw8fjIp8qPd0Y3Q5f6_HCvewLHggdadDE" ltime="2511703760" htime="30890190" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IB42RK38\www.navis[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4954
Entropy (8bit):	5.204753484228026
Encrypted:	false
SSDEEP:	96:3RzR97zR97GgazR97zR97zR97pzR97pzR97pzR97padzR97pajzR97pajzR971af:ZHigUHH111i00gfv
MD5:	2DE26B9735E8E31891DA2349871AE0FD
SHA1:	B85C8FAE7ED3EF24B1F6CC90EB36D55A1EA42F40
SHA-256:	38A647F76B9F1E46129617CD806FD00544465F47B36B05648E83194F12E7A384
SHA-512:	A18C5F4E54B5D5B5F15129ACCB8D0CAE61DF5933A5855338DA9FE82FE9276CE01E4F591A297BA9EE81B420090E6112DABD6F88D01F162AB169C2A4519FA06782
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="2806183760" htime="30890190" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="2806183760" htime="30890190" /><item name="undefined" value="null" ltime="2816713760" htime="30890190" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="2806183760" htime="30890190" /><item name="undefined" value="null" ltime="2816713760" htime="30890190" /><item name="Thu Jun 03 2021 16:17:45 GMT-0700 (Pacific Daylight Time)" value="Thu Jun 03 2021 16:17:45 GMT-0700 (Pacific Daylight Time)" ltime="2838193760" htime="30890190" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="2806183760" htime="30890190" /><item name="undefined" value="null" ltime="2816713760" htime="30890190" /></root><root><item name="com.adobe.reactor.dataElementCookiesMigrated" value="true" ltime="2806183760" htime=

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\UM9GSJ8J\www.google[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.99551123674007
Encrypted:	false
SSDEEP:	12:JUA4EyELwEM9+kKDrUA4EyELwEM9+kKcXOy8quKDrUA4EyELwEM9+kKt:ysLwEM9jyUsLwEM9j+5quyUsLwEM9j4
MD5:	F6462A88C6E5BB91144E4811C2F9C6D3
SHA1:	0F7E3DA86E1C7ACC6A07AD9F1F5862BDF1B7AA18
SHA-256:	1D7246628773D12F5912E7657E28915597FC432B1E0B78010A963CBA082D98D1
SHA-512:	BE3779BADF5B11C5438BC0E721C92BF303982A495455EFDA132FBF9741900736EAACE50A67D408F2C51543BCB003E83E4A865318E6D8A14C86EC9542632AF976
Malicious:	false
Reputation:	low
Preview:	<root><item name="rc::a" value="eW1uNWN0MWJzanlvaw==" ltime="2501183760" htime="30890190" /></root><root><item name="rc::a" value="eW1uNWN0MWJzanlvaw==" ltime="2501183760" htime="30890190" /><item name="rc::d-1622762232143" value="b2tsd2s1ZTEwemJ6" ltime="2504173760" htime="30890190" /></root><root><item name="rc::a" value="eW1uNWN0MWJzanlvaw==" ltime="2501183760" htime="30890190" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CF7C2D6C-C4C1-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8531570251791758
Encrypted:	false
SSDEEP:	96:rpZqZoI2oYWottoQ2AfoQjKRfr1MowjkDTo5j/mJRo5IJ+fo5IxfWlX:rpZqZoI2oYWottoufonxMono+oVfoKMX
MD5:	2C76852C96CF6474EA877ED845B6FB8D
SHA1:	72E12BA28156877E09D6474ACCC0FAA9DEC1CE21
SHA-256:	5B06131D44702311312ADDAC0CCCE4AB9F39E7803E77FF18AD0E584F8274D52D
SHA-512:	349E724BBCEC42254A61F8FF5F62ABFA31718D85D5883684FCF05CF3147CFF15A034DBDF1C0B2FF81776D98E514FD4293330784466DC8D61BC35AF8FFD1AB35C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CF7C2D6E-C4C1-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	119952
Entropy (8bit):	2.7984932229146358
Encrypted:	false
SSDEEP:	384:rZ4qCrE4ShHebWBXRXpXqtMEImebWBXRXpXqtME6vwUSk/ybKqYxouoryibBgc7f:DBhZGlIiBhZGl6CX
MD5:	5E0BB78DA17DD7DB4A98CEBD2B3C7CBA
SHA1:	D770969DB73C3ACA1ADA6E62CE101D9F832F8BC7
SHA-256:	90B2F678FD1300621A2C5918585ACB44971BE6E1068EEE0EB65D85B790410CC3
SHA-512:	75204C8BF2A25E96E5E970A55F017CB5B6B4C38EA2C1729E8B1DB661041E99E92B281643C22DCAD049281D88594982CF0E104FA3C90FF26332157AF48CA59D85
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5DE7A22-C4C1-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.565040861483868
Encrypted:	false
SSDEEP:	48:IwXGcprCGwpavG4pQ3GrapbSoGQpKiG7HpRgTGIpG:rdZqQh6LBSQANT0A
MD5:	0FB49552ACB8C2A68EB2C5BB57C3B9DE
SHA1:	51C4D059AD90BE4F41539FF24F426A6CED74677C
SHA-256:	323A647962899CE033CAB54C148101775AAA544AC3A70E1B3F0431F597FF46B1
SHA-512:	E832C1923C199FE99E373588BFEF8CCD836C77286CAF894FAEE731BD327FF9F0287D42500C9FC6B47443FA6D29259F7949DD65F2508B462556C92EDBCC5CDD63
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	4.050222909009826
Encrypted:	false
SSDEEP:	24:KJWvIOmF8loeEwioQT/So6uoJPIH3flFvdA:zIOmPv1oMz6/Pq3flA
MD5:	FD1E0FBD00A514945A24C22C219B50D2
SHA1:	E5B5758417F767BF0569C1DB966D7B9BE9BD902C
SHA-256:	4E8DF14E7741D68BF1822B75AED785680049E08957F0F1D57EC4BE697F8A20FE
SHA-512:	002BA2D355C3C34EF8E6F63250C4FEE91ADF7B459EA2FB9CC097D6940FCAFA0BF6272E7B8C13880AF491CE3DF449F9119A194FF52DC451DBD07729D2BA9D0F36
Malicious:	false
Reputation:	low
Preview:	(.h.t.t.p.:././.w.e.b.a.c.c.e.s.s...g.a.p.o.r.t.s...c.o.m./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... ..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................}/....U....................................................?...Y.................................................Y...`!..u=........................................................s...e.................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\mms\SF2G561B\a738e861168318774f614d60b63625f12599f189[1].dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5439488
Entropy (8bit):	7.978550581661482
Encrypted:	false
SSDEEP:	98304:dxLax87FW2wQnJbwjWQmS8Srlhh08pUFHLup5eAFgRQL8Qo9e7xme2vwTR:dxW2pTwYJbwjWo8S3h0TZuNFg+8HO+vU
MD5:	F21084014D81049594B7F1742BD828E4
SHA1:	7686C35E2544FDB1E281B84797846D77270DF237
SHA-256:	252BD54FEFC530A2EC4C6A16E359F956DBF0E7D1ED97073FEC5B980D393CF658
SHA-512:	D3A300C68A75B49A68C7103CDBD5F2EA59B288065603A2096CDC69126143881EBC4864B34B67B82ECA66A655B5D02E6686DE8029E3B523FB0083F2361538F98C
Malicious:	false
Reputation:	low
Preview:	..rK..}........m...[......$...8...E...QP......................Q.. ...,...i...~..........................7...L...YF..e........4......n@...............x...S......)...5G..hb..}t...........3.............................'...j.......`.......v..'...2...;...gA..s...{=...v...Q.......2...K...)...........I..2O..@...Is..RY..x...d...................?...+..........F...S...^~..hJ..............................#:..-...7Q..E....:......E...V...bG..k...........................1...@t..f...sT...A.......{.......?...I..%...2...e...yr...........K.............%...5L..C`..v...................9.......Y..AY..T...b)..o....^......._............. n..-..._S..s..........................0...E...S...Z'..o...z....z...D...X...!......&...0...Lf..V...a...~....................Q..........?...........u..!...)...B...K+..ST..[}..n...vd..~x...........$..........F...L...P...T....'...............F..... .*. ... N.. Z.. cv. k.. ._. .o. ... ...!.k.!(;.!0P.!5..!.n.!.n.!.0.!..."/.."E.."R$."]@."...".D."..".&.#.>.$.o.$T..$d..$nm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto BlackRegularVersion 2.137; 2017Roboto-Bla
Category:	downloaded
Size (bytes):	35208
Entropy (8bit):	6.392518822467014
Encrypted:	false
SSDEEP:	768:53Dmu13ucOmpIN22bN8o6Ze0XlGV+uM49pSeCu7XniviDffw6mo/quUR:lD13DjSNz0XlG0uL9YeCu7Xn4iTo9o/4
MD5:	4D99B85FA964307056C1410F78F51439
SHA1:	F8E30A1A61011F1EE42435D7E18BA7E21D4EE894
SHA-256:	01027695832F4A3850663C9E798EB03EADFD1462D0B76E7C5AC6465D2D77DBD0
SHA-512:	13D93544B16453FE9AC9FC025C3D4320C1C83A2ECA4CD01132CE5C68B12E150BC7D96341F10CBAA2777526CF72B2CA0CD64458B3DF1875A184BBB907C5E3D731
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf
Preview:	........... GDEF......z\...dGPOS......z.....GSUB7b..........OS/2ve#...p....`cmap......r....Lcvt ...=..xX...Zfpgm..#...ud....gasp......zP....glyf.......,..i~hdmx......q ....head...R..l....6hhea.]....p....$hmtx..<...l.....locaK./...j.....maxp......j.... name..9...x....\|post.m.d..z0... prep...C..w ...8...d...(.............P...EX../....>Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^....g...........<......9.........EX../....>Y..EX../....>Y.....+X!...Y..../01.!.!.462..."&....+.g..k.kk.k......J__.__.......^.......&......9........./......9../........01..#.3..#.3.+..._+...v.S.8..S.8.......z.......... !..9.........EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#53.#53.3.3.3.3.!.3.!.#.3.#.d.C.C..,..E.D.E.E...,...C.@.,....f.........`...`.....f.Q......S.&.Q...-.r.+./..9...EX../....>Y..EX.!/..!.>Y..!...9........!..9......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\L8W3KS7K.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	209023
Entropy (8bit):	5.015572724697433
Encrypted:	false
SSDEEP:	1536:CjcSloI6dXWsWe7ACY6gZ5WzvIj9gUwLkJMQUF2Qhly9Ejo8SRdVNhqthTYluupD:CjcSlWXHKZEchBPHQLbqv
MD5:	9C70E8BBF5EEF0EB79D9670AE04560C5
SHA1:	21A53EAE5BFA92C33FF4EB22068BCDAE6DFD217D
SHA-256:	CAB8D65845F445230CECC3717CDE4136DDD4563CB84BAA2BB387277EC0F90532
SHA-512:	141B1E43A4130BCE700095015C14DE79AAB9CD6928068396698293A228F33AA67161FE547723B48CBC3691D7DF8511D124B3EFE1EF3130CDBDFB762DB7E92357
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/
Preview:	......<!DOCTYPE html>..<html>..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1">.. <link rel="shortcut icon" type="image/png" href="/favicon.png" />.. <title>.. Navis.. </title>.. <meta name="keywords" content="tos, terminal operating system, software, vessel performance, n4, macs3, bluetracker, stowman, tos, terminal operating software, terminal software, supply chain, container terminal planning, logistics, terminal operating system, n4, Get More N4, Get More With N4, tos efficiency, terminal efficiency, terminal productivity, cargo logistics, general cargo, container management, che productivity, customize tos, terminal planning, vessel planning, yard planning, berth planning, berth optimization, yard optimization, optimize yard, automated terminal, automated che" />.. <meta name="description" content="Navis, a part of Cargotec Corporation, is a provider of operational technologi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\ai.0[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	96705
Entropy (8bit):	5.228470338380378
Encrypted:	false
SSDEEP:	1536:EVpXOWPGHRGUvJEzxPNLgyLuG6XV3yV/QtJ+j1YeO4PFWYit:EVoWPGHRGUvJEzxOMQV3yV/ERaNWYit
MD5:	1DD63DE72CF1F702324245441844BE13
SHA1:	58A8BDCDCB398AF7DB424357DF70DF18E7B30E9D
SHA-256:	5201C813C37A4168CC5C20C701D4391FD0A55625F97EB9F263A74FB52B52FD0E
SHA-512:	532D1E907B433AB97785CF632D9637A957152BAF0BA57879C856CBAA469BFFECA22C4F99485679539944B27068D39E70F7D44282594F999142454DA57329A11B
Malicious:	false
Reputation:	low
IE Cache URL:	https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Preview:	"use strict";var AI,Microsoft,__extends=this&&this.__extends\|\|function(){var i=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])};return function(e,t){function n(){this.constructor=e}i(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}}();function _endsWith(e,t){var n=e.length,i=n-t.length;return e.substring(0<=i?i:0,n)===t}!function(e){e.ApplicationInsights\|\|(e.ApplicationInsights={})}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){},(e.Telemetry\|\|(e.Telemetry={})).Base=t}(Microsoft\|\|(Microsoft={})),function(e){var t;t=function n(){this.ver=1,this.sampleRate=100,this.tags={}},(e.Telemetry\|\|(e.Telemetry={})).Envelope=t}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Context={})}(Microsoft\|\|(Microsoft={})),function(e){var t;(t=e.ApplicationInsights\|\|(e.ApplicationInsights={})).Context\|\|(t.Co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\allIntegrations[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	42258
Entropy (8bit):	5.407780090427473
Encrypted:	false
SSDEEP:	384:eZFIXSdlgUSbq3ASHPa//kH0uffcLRzy4cT4KbTmMoVNlWDJ8Z6iAJGe+oFLUoX4:sWSdlJ4QC/vVrkTmMoVNlM+6iAJvXpq
MD5:	A2D5632D818CBF81717E8EA0984CA04D
SHA1:	108CE55398DE4DEDBC6A3FD0F0B5E0669B243A48
SHA-256:	A5286188332CB9933E5E540384979886B5E6503A4C4E24FAAB4A400A7AF3440C
SHA-512:	3874C8E86B97E66A634E743FB553EE21F0B5E1BF0F5924BDDA89E38AB2F0DFBF96231976CE5588331DF81EA7D1BC5575A90F6CEFA61417C383AD39547A88DFF9
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/external/allIntegrations.js
Preview:	/****/ (function() { // webpackBootstrap./**/ .var __webpack_modules__ = ({..// 149:./*/ (function(__unused_webpack_module, __webpack_exports__, __webpack_require__) {.."use strict";.__webpack_require__.r(__webpack_exports__);./ harmony export / __webpack_require__.d(__webpack_exports__, {./ harmony export / "getPlugin": function() { return / binding / getPlugin; },./ harmony export / "defaultGetHubspotUtk": function() { return / binding / defaultGetHubspotUtk; },./ harmony export / "registerPlugin": function() { return / binding / registerPlugin; }./ harmony export / });./ harmony import / var wistia_namespace_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1);./ harmony import / var utilities_stopgo__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(41);./ harmony import / var utilities_stopgo__WEBPACK_IMPORTED_MODULE_1___default = /#__PURE__/__webpack_require__.n(utilities_stopgo__WEBPACK_IMPORTED_MODULE_1__);./ harmony import */ var u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	49153
Entropy (8bit):	5.520906949461031
Encrypted:	false
SSDEEP:	768:/yR3fYFBLbfs5sP5XqY3TyPnHpl1WY3SoavFVv6PU+CgYUD0lgEw0stZM:/y9gZfl5h3UHpaY3SoRCw0sk
MD5:	6DF1787C4BE82D1BB24F8BFFA10C7738
SHA1:	3634E839429E462E49C5F42B75FBFB4BA318AF6D
SHA-256:	2CB09C7B3E19BFC41743CA3624EF81C3258D56525647FEAC76AA757E0292627A
SHA-512:	CB3CE2BCEB61F390298C21E470423CCEB6DD93E648A7DD0467195B11FEF30BF7A086DFF47C4494E2533498D1448C1A22AAB1414C14FD73278F1C92E0F7BC3F94
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	884
Entropy (8bit):	5.617515138170987
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccARvC+KVCetTZ1qCsLqo40RWUnYN:VKEckKoeX1qDLrwUnG
MD5:	129AF537CDD639CD32EEEFBE364F71B5
SHA1:	AA2D71E9881D748BCC582C6F76D3DEB789BF2E5F
SHA-256:	092B05CC27EB17949DDEC8D361B6A22C19FD0AE7FA8FA96150FBE1A955CFF969
SHA-512:	E34BECB83276BFED023B1550B9874944EDBB717C4061CD338F7EF36FCA7646C189D3E813413B56C6100F073EF91C3FB2BD01A4EE7A05C5F4E4E420AC0A0B3A54
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api.js?render=6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6Ld9lQAVAAAAALmKl0QIzXSrPG6V5UJsGqktklj5');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;po.src='https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-+xoUonkPGEYHjXNbLWoTq/M+o6pSjtw4HyuOyq5yVumYnwysETdYuyFwwYTB7S35';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\bootstrap-switch.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	14337
Entropy (8bit):	5.1172037605178575
Encrypted:	false
SSDEEP:	192:RDA4PHgH7hcO0NaZEpt4yPfAlw+M2Z0hQje9IsI+I40cVgnM2BYEVUIR3VBcCp57:RNPHUhcO0Nay7DfKUQKWb+R0cKPB3VJ1
MD5:	5F78AB3522AF9AA9F41B027786CD5C7B
SHA1:	A1101526C12E7883DE94ADC02718D597D9DD6B3F
SHA-256:	692F727417E2CBD82077CF4D157CB0CB6EC7032CD0DE261E1F3D62F76177E4FC
SHA-512:	0B25BC7D7A46E5833C62309D4C2D22E91A3EE3A610DEAD153789D3352638F5780FBF35DF49C12ADF2ED2153217835DCF8784973EFE2C7ED7FD29FEA00B3272EE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/bootstrap-switch-master/js/bootstrap-switch.min.js
Preview:	/*.. bootstrap-switch - Turn checkboxes and radio buttons into toggle switches... .. @version v3.3.5.. * @homepage https://bttstrp.github.io/bootstrap-switch.. * @author Mattia Larentis <mattia@larentis.eu> (http://larentis.eu).. * @license MIT.. */....(function(a,b){if('function'==typeof define&&define.amd)define(['jquery'],b);else if('undefined'!=typeof exports)b(require('jquery'));else{b(a.jquery),a.bootstrapSwitch={exports:{}}.exports}})(this,function(a){'use strict';function c(x,y){if(!(x instanceof y))throw new TypeError('Cannot call a class as a function')}function d(x,y){var z=x.state,A=x.size,B=x.disabled,C=x.readonly,D=x.indeterminate,E=x.inverse;return[z?'on':'off',A,B?'disabled':void 0,C?'readonly':void 0,D?'indeterminate':void 0,E?'inverse':void 0,y?'id-'+y:void 0].filter(function(F){return null==F})}function e(){return{state:this.$element.is(':checked'),size:this.$element.data('size'),animate:this.$element.data('animate'),disabled:this.$element.is(':disabled'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\calendar[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2243
Entropy (8bit):	4.790540967728705
Encrypted:	false
SSDEEP:	24:c58p3r8XmLIAEjdrSSE+nkSECjHSECtMNF2S77nF2SQF2SAlXxSECtFCpSSFtSgu:8MDpIu9+k9C79CW2gF2l2N9CtIBLjVO3
MD5:	E71A69916C3BC6A0C8EAC10B2AD17B26
SHA1:	F85870D57E056071E90F1F52C963DD043FEDF46F
SHA-256:	909D2A0CA824E4750082230AFE6856279931E7FA32976465171D5C5BDF24B9D4
SHA-512:	0EA24F311E235B80281E42DBEC1508D8639EE5B0BBC118369DB867EDA2E90F229FA18A852355843EFF0AC549B7DB0B600739B3FEB02FFE9E93E6A5342301A555
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/calendar.css
Preview:	#container.{. position : absolute;. left : 100px;. top : 100px;. width : 116px;. /height : 152px;. clip:rect(0px 128px 152px 0px);/. visibility : hidden;. z-index : 2;. border:1px solid #999;.}..#cPop.{. margin:0px;. padding:0px;. background-color: #E4E4E4;.}..#containerPop.{. left : 100px;. top : 100px;. width : 116px;. height : 152px;. /clip:rect(0px 128px 152px 0px);/. z-index : 4;. border:1px solid #999;. padding:0px;.}..td.cal.{. font-family: Arial,Helvetica,Sans-serif;. font-size: 11px;. color: #333;.}..td.calBtn.{. cursor:pointer;.}..select.month.{. font-family: Arial,Helvetica,Sans-serif;. font-size: 11px;. color: #333;. width: 85px;.}..input.year.{. font-family: Arial,Helvetica,Sans-serif;. font-size: 11px;. color: #333;. width: 30px;.}...calDiv.{. border-top:1px solid #999;. border-bottom:1px

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\down[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 8 x 12
Category:	downloaded
Size (bytes):	175
Entropy (8bit):	5.141111913514078
Encrypted:	false
SSDEEP:	3:Cs//9nfRfW/e0Rs5/Wiiw49gG44ZO7yl4rt5lmbW1ZEhCU3023:FirmWpDsHr1aCg
MD5:	6C0C4B5AF5ABD8E5152A593D7FBB8855
SHA1:	C014FFB7EB47A428139D88C4E08684AB4CA15E91
SHA-256:	28A39A8D75B76C26577F972739C81F4B02672545AD269EA7E8F32D244077E159
SHA-512:	88615DB0D7DB3850E41D5C8C596B11AE8D1FAE840BF530B6F18DB35525AF161B072D5449A07929D3B1AF3242F7F6C77F3FA4EBEE865825446FEDC58290FC176C
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/images/down.gif
Preview:	GIF89a...................AAA...........................333...... ..........................................!.......,..........,.%..8..y1@:...U...!....- .."1...S] ..%z...;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\export[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 20 x 20
Category:	downloaded
Size (bytes):	313
Entropy (8bit):	6.832486810870939
Encrypted:	false
SSDEEP:	6:/l5OdevJO3qt0fara9XL5yah93FUJrR3qajHG5:rO4yyO9XL5ya93FwR3Ljg
MD5:	95204DE99B173B397C61AE57EBF52286
SHA1:	0CBAD40296393C1F203CF14F63CC3D37128A9293
SHA-256:	96D76287E669F0F127F7A9BA7B54314872FCA8E8E8066F087542CB0567BA4CD6
SHA-512:	D25CF087CA76157D97FC8F5E562578D49D3BA425BEFD0CCA2A12486130CE26588A6317C08343FA565D29A14AAB9C83BB086B565EBF67634B91C86A4513179D1C
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/images/icons/export.gif
Preview:	GIF89a..........sss\\\...ccc......~~~...yyy...III...MMMjjj...777mmm.............PPP......VVV..............!.......,............'.di...l.z.g...eS._.(W...A. .H@.'.Y..B.0p....jA"..C$.....a...x..r.`.<.....`.....].....}..f.......Q...K1....P.i...<..H..........>...........f......w.y..1......f.........M/.+)...!.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\global[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	downloaded
Size (bytes):	202273
Entropy (8bit):	4.578855962703777
Encrypted:	false
SSDEEP:	1536:UdOGIoeOhnV3xdgSvLqh0NwUDgffbJo2ufHdRmqSg2:UdO4eOhnVf/vL0wwUDgfzKfHd1Sg2
MD5:	A1F461CAD8CB0DBCD668E1AE29B1848E
SHA1:	CEE90A1491448740D90EF5727416459504DB75BA
SHA-256:	F674643B0B2C1ED11BF7841FAF2223688D0730F778C6F3961EAF4605D022C0B9
SHA-512:	0DB0D4EF4002DE614A244AC2AF61443A26B8B0282C1635FBE6589D97351101ADC8C9C206E7C3F561D555749F5078627E8FFEB474EF7890A088F5859A954B3916
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/content/css/global.css?v=1
Preview:	.@charset "UTF-8";....[class*=" icon-"],..[class^=icon-] {.. font-family: icomoon !important;.. speak: none;.. font-style: normal;.. font-weight: 400;.. font-variant: normal;.. text-transform: none;.. line-height: 1;.. -webkit-font-smoothing: antialiased;.. -moz-osx-font-smoothing: grayscale..}.....icon-graph:before {.. content: "\e912"..}.....icon-list:before {.. content: "\e915"..}.....icon-tools:before {.. content: "\e916"..}.....icon-cloud:before {.. content: "\e917"..}.....icon-support:before {.. content: "\e918"..}.....icon-training:before {.. content: "\e919"..}.....icon-speed:before {.. content: "\e91a"..}.....icon-idea:before {.. content: "\e91b"..}.....icon-facebook:before {.. content: "\e901"..}.....icon-instagram:before {.. content: "\e902"..}.....icon-linkedin:before {.. content: "\e908"..}.....icon-ncc-circle:before {.. content: "\e90f"..}.....icon-twitter2:before {.. content: "\e910"..}.....icon-youtube:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\global[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	993699
Entropy (8bit):	4.094562590882588
Encrypted:	false
SSDEEP:	6144:lI+QAZVxjxzNQJb7dfzVqg8dXjuQKL+JPv/6TF/RxtOqfzVy1pwnqmPDbAJGjgoz:cL+G5i1pwn7UJGjHMNmTE/Adx
MD5:	58BEC5EDE87024297D2B6B8BE182455D
SHA1:	35F4001E22291A68411E7D9A082A73D1F3E35DDA
SHA-256:	7D485850F839CF2A260BACCF0832E59A061C70C9812BF88438599A33E42C18DA
SHA-512:	308D96EC05EA8CE079E8759832F718F4B42A37916AB802062FB5C0273AC64642AA4D04ECA08E7577ED30F0E89B74DD92C2DD4465EA5048AE8009839DC68E5875
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/content/js/global.js?v=1
Preview:	(function e(t, n, r) { function s(o, u) { if (!n[o]) { if (!t[o]) { var a = typeof require == "function" && require; if (!u && a) return a(o, !0); if (i) return i(o, !0); var f = new Error("Cannot find module '" + o + "'"); throw f.code = "MODULE_NOT_FOUND", f } var l = n[o] = { exports: {} }; t[o][0].call(l.exports, function (e) { var n = t[o][1][e]; return s(n ? n : e) }, l, l.exports, e, t, n, r) } return n[o].exports } var i = typeof require == "function" && require; for (var o = 0; o < r.length; o++)s(r[o]); return s })({.. 1: [function (require, module, exports) {.. 'use strict';.... var _typeof = typeof Symbol === "function" && typeof Symbol.iterator === "symbol" ? function (obj) { return typeof obj; } : function (obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; };.... /* ========================================================================.. * Bootstrap: modal.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\header[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1517
Entropy (8bit):	4.376247713321071
Encrypted:	false
SSDEEP:	24:mTLsXVlumlcFiExQX5W1GjQmnKop9tJ+SZaKxC:mTLsXQFU5caQOKop9tJ+zv
MD5:	BB3104366160489E7495E6D80EA5FE69
SHA1:	A892632E07E8343D7F2DF24B5E408A5D21341CF3
SHA-256:	888C6FA31075309070923E0E516068B494A0597F971A2E9E6707C1503F89E97D
SHA-512:	D3A1C8EE386EE994CDEFD49A31D867E8BFFF642DA3D47BA9C818BCBEAC0E90130F7D72F44FF14F3B0440D178F324606EDCDA5D6E9712E5A7B96CAB084001ECFE
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/header.css
Preview:	/**********************************************************************/./ HEADER.CSS /./********************************************************************/../************************* Header Panel *************************/./ Used for header area, including header tabs. /./********************************************************************/..headerTabLink, .headerTabLink_active.{..border-top:1px solid #F5F5F5;..color:#666;..text-decoration:none;..cursor:pointer;..font-size:10px;..padding: 3px 10px;...display:block;..white-space:nowrap;..vertical-align:middle;.}..headerRow.{. background-image:url(../../images/tabs/tab2/tabRowBgTile.gif);. background-repeat:repeat-x;. background-position:bottom;. vertical-align:bottom;.}..utilLink.{. color:#7B7B7B;. text-decoration:none;. font-size:11px;.}..utilLink:hover.{. text-decoration:underline;.}.../****************

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\icon_to%20optimize[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 252 x 252, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3321
Entropy (8bit):	7.88101175992329
Encrypted:	false
SSDEEP:	96:kDv4c3M17x/7NV0BKIcWvPeW4l+SzACVhkcuw:kzLMz07eW4l+S3scv
MD5:	ABE44D5480D32D4CE483A9DFF2C09244
SHA1:	BE0BCDD6FE8F52B87B463F4086B195B2C6888D3A
SHA-256:	7B1FBCE3728BAF56CD8AFCB4C7A984D02256C49111BB7B3BC3786D77F8C062CC
SHA-512:	DEE0DB60F3710CED73D49FD16F1C049BD2073E64488068506E6FA2FECAE77C775C21B001FDFF042CF656378FD8E98AA769C5973E4B6A8E918423184075BFC8EB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/images/icon_to%20optimize.png
Preview:	.PNG........IHDR.............du9U....gAMA......a.....sRGB.........PLTE.....P..P..R..X..X..P..Z..U..Z..U..U..X..T..V..V..S..V..V..X..U..X..U..W..W..W..V..X..V..W..W..V..W..W..U..W..W..X..V..X..W..W..V..W..W..W..V..W..W..W..U..R..R..P..P..P..N..N..L..K..L..I~.G~.F}.F\|.E{.Dz.Cy.Cy.Bw.@v.@t.>t.=r.;p.9n.7m.7k.4i.2..J....1tRNS.... 00000@@PPP__````opp.......................=.4Y...jIDATx..]}..H.n..7...f...3..l.r..MpN..D........~1* .Tu74..5/..PUOUuW.!....m....a.%.....W.}...T.?.U.k.=0.[....~..u).].........&.A.z\.08..)#t...p.Q3)....R9.A[..\|..vY..k\|..A+......\|..M...S....F.8.G.....<..E.l.....R...T.......b}._....(.../6...P.....[Z8..."=>b..".SI.YO./qQS./......I%CnY..3.._.\\.R.h........g1...N..H.5....c.J..H...R@..].......LK./\|.wh...;W....}..sc...._j..g..r....-1~a.~HK.V.{.=.;..r.../k...k(.......P..4.A.#z........V....V...-.3..N+..v.>..b~.j.!.......V..uTz..k........(.,..wz...qg3....{.7.........v&O.........<qj7...^."x..v.L..f.rf....<s,!..._.Y..`..'...t.?..fp.o..._....-w..g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\instagram_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 25 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	390
Entropy (8bit):	6.945337398524976
Encrypted:	false
SSDEEP:	12:6v/766nM2m//+yjEa9kszOVK3esrW72W+J8cqiLMN:41muyjEiDqyW+5LMN
MD5:	8696A3867C089C2BADFCE43D4EC2BD7C
SHA1:	3D6C0FB2F557F98BD39CD6685D90C0AB854F4D6A
SHA-256:	D8B6D7561EC5A2FAFD1F784E830D704BA87034F9F6A1697FA1BAF2A4A7936E85
SHA-512:	AC53503B03C60EF42A37115C24EA8C3A1EE4D8599F2047F3461F7D587B73CFC435D0A09AFC9C798DFDB980E768C473A38408A08B4EB38273E9733B72A3E4B790
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/instagram_default.png
Preview:	.PNG........IHDR.............8k......gAMA......a.....sRGB........fPLTE...0@`::Z4@\6@\5@]6>^6@\6>\7?]6?^6?\6?]6?]5?]..............................t{.ho.ho.\c{[c{OWqCKg6?] s......tRNS...@P`.........~......IDATx..... .E..i..".`......@.JGf..&...o.?..d]D.iy.$O..-.J)..v..........:.........~..........`.....k..(.3.U.....xk.`#../.".`0~ZU....s.a...\..C.2.9...g&..K.C\|..M.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86659
Entropy (8bit):	5.36781915816204
Encrypted:	false
SSDEEP:	1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
MD5:	C9F5AEECA3AD37BF2AA006139B935F0A
SHA1:	1055018C28AB41087EF9CCEFE411606893DABEA2
SHA-256:	87083882CC6015984EB0411A99D3981817F5DC5C90BA24F0940420C5548D82DE
SHA-512:	DCFF2B5C2B8625D3593A7531FF4DDCD633939CC9F7ACFEB79C18A9E6038FDAA99487960075502F159D44F902D965B0B5AED32B41BFA66A1DC07D85B5D5152B58
Malicious:	false
Reputation:	low
IE Cache URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Preview:	/! jQuery v3.2.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\linkedin_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 25 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	335
Entropy (8bit):	6.862232441643012
Encrypted:	false
SSDEEP:	6:6v/lhPySFnMRrizbC+JGFOoJoFc3U7gVVaP01hF9sMwFP+BZKqfiIKGKdYll2up:6v/766nMa9JGRuFc3IgVwP070jFP+8qB
MD5:	AA8072CC4C4BBBA3D127CA929D1DB0EF
SHA1:	1DFB6AFFE525F0CFCD50B73BE339AA0A0355D6EF
SHA-256:	44B05AD4FD5E0915287844266D9C95E5C49042E2F697D031AD344B68091DB6C0
SHA-512:	757712FD2B4DF1DF2DA00B6CA25AE6AA4AB0F4FA7DCD76C8724E968B03A236CE138496DB479CFAFED8B1EB453ABECF7619A86FA239387806F651065B0230BE6A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/linkedin_default.png
Preview:	.PNG........IHDR.............8k......gAMA......a.....sRGB........ZPLTE...5@]5>^7@]7@[7=]6>^6@\6?\6?^6?]6?]............................u{.ho.ho.\c{[c{OWqCKg6?]3a.l....tRNS.`oppp.......N.....{IDATx.....0..P....$%l...7....@........Q..;...l../'@.\|..#mdZ..u:fYSJuJ.Yy..#..<.).....=..q^..1..fM....^&....}....V../..9..m.T....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\logo[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 288 x 146
Category:	downloaded
Size (bytes):	12519
Entropy (8bit):	7.900283426223947
Encrypted:	false
SSDEEP:	384:s7TRRs6ab+WQSSEbNNjP0+5KI8zu4GAVjsT/o:sPRu6aq7IHoutNTQ
MD5:	39EF6381F2514837E883A6411A739F56
SHA1:	75C4B56837C7F5A9EB8EFE144D3A1CE90917CCD7
SHA-256:	5B976D47C6A9CCBE9E2E6CAB65C3CC017C95C3B4C5D4E941D805A64AAD1AD8CC
SHA-512:	4969786B7B45151182469EF60A763ABF49B1B7A61158B889BEC71320815C78C6C7FDDDD53609D05A6B3D6B66284C4E0B149372BAF993A9EE43783D8E839077EF
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/skins/gpa/logo.gif
Preview:	GIF89a ...........3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f.........3..3.33.f3..3..3..3+.3+33+f3+.3+.3+.3U.3U33Uf3U.3U.3U.3..3.33.f3..3..3..3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f+.f+3f+ff+.f+.f+.fU.fU3fUffU.fU.fU.f..f.3f.ff..f..f..f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........+..+3.+f.+..+.+..U..U3.Uf.U..U.U......3..f.............3..f.............3..f............3..f.............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U....3.f.........3.f...........3..f.............3..f..............3..f..........+..+3.+f.+..+..+..U..U3.Uf.U..U..U......3..f..............3..f..............3..f.............3..f.....................!.......,.... ..........H......\.0.@...E..-.e.Bi..iS.Mi(..(1..8:r$x...2O...7...8s.........H.b.H/.Z...&P..F...N.5i...1&...8.>......e...QS....<.....O.0aB&....5...L.......,Z.^E..-..J.TMj.bM.5GW.a..M.#......^]....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\mega_promo_360ms[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 370 x 300, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4970
Entropy (8bit):	7.904710798515039
Encrypted:	false
SSDEEP:	96:hwO+m++1Vo8LckFcv9/aQ1U0XpcsHj4f/Dbskv:OO+1Cr9FK51Ncu4f1
MD5:	AC0B72CBCDA1ED1F0DFF3F3C3BF0999A
SHA1:	0C3FFBCCC1C0230C684BABE02FD69F65EC0E5A56
SHA-256:	F67B24D0AF7700A7D08F7297CEB32FD50306EFA41D8256C9450D4E2780632CAC
SHA-512:	7FB4F61B30176379F23D15D972E8071196A8347A2419693D708ADB531109BCF0127FE3D912B326EB5FA42D785C694DE41672C07AD411F7A5D7E58F7562E0DB13
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/c77cd6d0c78840baa8b884b470e782de/mega_promo_360ms.png
Preview:	.PNG........IHDR...r...,......~.... PLTE.....................................................................................................................................t......~..f.....q...r..Xt....fc....J...f......[.........U.....<}.OY.....G...........t.CK...\| 8...=..*.../.....!..t..iv.]kuRakFVa........IDATx.....6...l..r.....-.oK.u..]3..K....e..._.KB.$........C^6`...G........h."...h..Q.hx2<..5.._.^...!..GGG.W.(.._......&......Z.......e8$.Z4.........c..1...! .r....r .r....r ........! .r....r .r....r ........! .r....r .r....r ........! .r....r .r....r ......\.{..\..?....~v.....\|u....E/...J.......s ..z?\|y6W..._....\|.g.0.{...-.....G.y.......\.OL'...-......bR2...f.sC..o.o....N.k....l.+.........s ....^..%...&.....9.} ....8;{97.{..r~.....i..#.6......q..u...?...g/....D..%..7@.....(.\|.p.?.....KZ........%....\|.@..Y.z.......F....[}..7../...Qy..]..t.....v.w...'...l..6...Z...uW....9....&..l......(.1........0.E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\mtn_hp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 480 x 205, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	61127
Entropy (8bit):	7.994262000480126
Encrypted:	true
SSDEEP:	1536:vUqUOrbr53rn3bS4hp33JgAvxEGVA02/zQ/NR39XtaHAyWP33M:curbr5LbxHfpEGkkLNdzM
MD5:	9F75CB5B64E7FC6EA8D6ECE01ACF9CBC
SHA1:	6FE9E0F2B32070223021B3DF78C5B61AE9B041CF
SHA-256:	5E2976C341FDEF2BF9694EAAB8B50BD10A1665526E9F655938809972670F3119
SHA-512:	625B95BFFA05C2E69C63F41395B8317CBF3C70020160020A85BA888E3345792AC58D68547987D30923FAB7BB6B67E21818497FE54CAAEE868AD591FF190D14B3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/860339f8e24e47049d8c385ddaceb37f/mtn_hp.png
Preview:	.PNG........IHDR.............WOS.....PLTE#q..h..v.....l.."C.X..Q.;s. ;....{...+.q.F..5...].0...z..S.....0[.Ex....[........:kc...(K.b..b....#...j.5..Wv.....K..J..3a....As.....9...$...S...(.9k.#J.Dz.t.Qbr2...R.....I.d...D{D...b..0["...{..Bj.Z.&...3b.........e..l.$.....,W7......M.2...9d.+R.r..q.....(K"......q..As....l..J\|........0V...K.a.....:f.#A$...{..8d...X...............L.(y..D..+c....T....!................y.....j....0U.......K.9e..3l........+Qq.+Z.t..Q........0T.3k.J\|....R.....[.,...d..Ry9HU.{..$R....4\...!..0...[.0........!.....o. .D..;..U..R...B....Z.....Bm...N...D..Jr.#J([..j..e......6....S..(E5...8\..,.8\.p.z..H...Y..(E(gR.Jq.\|.&7H....0MA...n....!..<p{.DaH.......+.O~.$R.......&2.0M..-._..[......%1=.<o.[.. ,.O..:S.E..$Z..$.. ..0.."..4..'.. ..0..5..$..$.. .....$.. ....5U...9...}.o.... rk.....IDATx.l..xSe.6..$....`!.....Z.4.PC#-.....B05..... .SKP.hA#TD\|..gp.J...........#.}..^{f......u....o.....I.&.........s...._3f....Y.3...3.L<.+.7i..p.FS.+..$#.[.>O(...M.......B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\n4standard[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19654
Entropy (8bit):	5.132195051149054
Encrypted:	false
SSDEEP:	192:NiZCZbBA+/GPPJuWomxiXvwMAOWMNk2MM:UoZNAlPPYWOwMrn8M
MD5:	E1CB8A0CE1DEE0FB7E605AF45AA8CDF3
SHA1:	7A8200D7782E1015CC2D3D2680613C5524E16C8D
SHA-256:	D4F8056F7E67ED1E4DF5C4467BDAD4BA17EB8DFC1B89694E09779F0D017339AC
SHA-512:	904AB0670917DAF3F3A9E4881EEAA82B77B162AC84612A9FAC9732ED9278111B23F5E2B1FC5853A26000F44B0FDFEA03739CF3C98DF812C8CA1D0D5429282590
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/n4standard.css
Preview:	/. N4 Standard style sheet.. See Html document that describes the usage of this before modifying.. Copyright (c) 2003 by Navis Corp.. Written by Andrew J. Peterson, 2003. $Id: n4standard.css,v 1.4.2.2 2010/05/21 08:47:07 uganesan Exp $./..table.mainTable.{..border-right: #ccc 2px solid;..border-top: #ccc 2px solid;..border-left: #ccc 2px solid;..border-bottom: #ccc 0px solid;..margin: 0px;..font-weight: normal;..font-family: verdana, arial,helvetica;..width: 100%;../height: 1200px;/..color: #000;..background-color: #fff;.}..iframe.{. margin:10px;.}..div.help.{..border-top-width: 4px;..padding-right: 6px;..padding-left: 6px;..border-left-width: 4px;..font-size: 10pt;..border-left-color: #999;..border-bottom-width: 4px;..border-bottom-color: #999;..padding-bottom: 6px;..width: 100%;..color: #900;..border-top-color: #999;..padding-top: 6px;..height: 72px;..background-color: #ccc;..border-right-width: 4px;..border-right-color: #999;.}..a.{..color: #666;..text-decoration

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\navPane[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3126
Entropy (8bit):	4.7757886415975745
Encrypted:	false
SSDEEP:	48:+Piy+luClcnW5Jih5CQh53t0xMUj22JeI4r25pdn:+PiflllcnW5JWh90xj1Qkf
MD5:	FAC58BE919F16E3109B45B4F97E248DA
SHA1:	906AF5AC690D0AACEB13546F947F4D0AAB4F961A
SHA-256:	616D6C5D580AE59E167ADD48587947E7C1CFF83EFBD1EA323AFA5B8DA43DA2E3
SHA-512:	D3200E3889AC1AB78AA69A5E97C84E073D16EE7530981CFCBA8632E573EC8E4C3C1AB74C9C9E398549D41851010F4A8E0E0A8B928FF1B60BB1898F239185E808
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/navPane.css
Preview:	/**********************************************************************/./ navPane.CSS /./ Controls appearance of elements in the left-hand navigation /./ panel. /./********************************************************************/...navUtilities.{.}..navUtilTitle.{. color:#666;. font-weight:bold;. font-size:10px;. padding: 0px 5px;.}..searchPanel.{. border-top:1px solid #A9A9A9;. border-bottom:1px solid #A9A9A9;. background-color:#F5F5EB;. padding:5px 10px;. font-weight:normal;. margin-bottom:10px;. white-space:nowrap;.}..recentItemsPanel.{. border-top:1px solid #A9A9A9;. background-color:#F5F5EB;. padding:5px 10px;.}..recentItemsPanel a.{. color:#5C5C5C;. text-decoration:none;. font-size:10px;.}..recentItemsPanel a:hover.{. text-decoration:underline;.}../****************************** glo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\ncc_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 25 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	417
Entropy (8bit):	6.98603414758231
Encrypted:	false
SSDEEP:	12:6v/766nM3QGWpwbL/+NtvvDQHt5lM0ULv:4mQBMaNtXEHt5S0ULv
MD5:	1225F144DC7A3D01900A6CA85B82694F
SHA1:	DA680FDC2A4BF3B815DAD18176221471ED91D935
SHA-256:	60327016AA495D30E97CB6B820BC987E269D807D3A7D12BD26954DCF0D7DA7DA
SHA-512:	605DAA63D57C9B8DE4CC4A7F9918455B27E2C9BD01412A88D5B45F92BC7265313FE90A8B4BD33C53F8C088CCEAC6F10B516CC13917C746A77CC092AA0CCE7F5A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/ncc_default.png
Preview:	.PNG........IHDR.............8k......gAMA......a.....sRGB........{PLTE...0@`::Z4@\6@\3@\6>^6@\5>]5@\7?]6?^6?\6?]5?]...................................................u{.t{.ho.ho.[c{OWqCKg6?]2QQ.....tRNS...@PP.........,.......IDATx.....0..../.UQa .`...B#&d..\.b_...Q..A...E..h...Q<".I.6,...&..$..e.....VTK...,.aU].\rQq.]q/u..\|o....kf....}..~o..d7.., E. ...'F.}..0P:ke.....o/.%..ax~\.....L..V......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\predictions_2021_hp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 480 x 205, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	53111
Entropy (8bit):	7.989843524190983
Encrypted:	false
SSDEEP:	1536:+pNtuH27ulh88rdlELoFnfwe26JaBaNu0Z:+P0Tlq8hlELunfwhUUaNBZ
MD5:	8C35665F90E9F68C89A8C003E8159A7E
SHA1:	6726B36BE085108ED1271FBB3713AF89ACAA3088
SHA-256:	14E62F17AAACB199CFA5392315BB666D6F9AE3F3C55E3A3177C1F3F36A5E1DC4
SHA-512:	B1DACA4F3F4C890D1B4A36AE503A1E4CB4AABFEB3E0D48B174D299EEDB7CFE04805B72C7B808AF166B6692B619164C1321A4078501642C10F3071E6645DD0A11
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/6abea65cbfe849118ebdf51b13d8bb9e/predictions_2021_hp.png
Preview:	.PNG........IHDR.............WOS.....PLTE...FTwG[.6Gg.._L6I.pkiXjo.......7Rz9X.(Lx....3U%7T.$7UZw.u.5d.Wc..Fo.'I"Q....FIdeh........hYHg..2W'Dg)R....FBX.TS5B\.Cvx....4Lsj{...)...6n.."7)$:ft.Q..&1JGb....Tj.3;U.......WSjyt.I{.VFX...z..54I...w.Cfay(Q}w.....T..i8L......Xcz.SkfHW..4......Vt....vgwy....Yr.....:_#+BUKb.sU...g........w..wFW\|...,Q$Y..0LyV\...ufIPl...............$Bz....rl.{fW......gU].R.Dl.ak.zai.........hDMi..........!...d..5(@.......(.....+..!...X@MY....yDJ......... .@Mo'.5GA~wz.9a..3...lo.gce]OZ#<^V{.:kl{XLD?JIs....$U.......\|.....)_.iX.~re...f..7].8Pm. ..c.......N..J<\WQH.{.y..PMp(U..,N...]O.......fyt....-.I}.0O..hWN.......P@?..v.mu0V.Hu.Wn...$.>\nj.%Pg...#Z.Co..."..@T...........KN\......$/Q............................................................................+.....2IDATx..}P[./..:.!..e....BX....."bad\|..c.zl0...C.aR<..N,...3.N...8t..o..[.9..aN....4g.?.v.s....:.. 7=...n........I........@.^...<...}....].+........7.vr.......&..v.0.a..rm..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\promo_pr_acquisition_banner[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 2500 x 1500, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	6258876
Entropy (8bit):	7.991104779286385
Encrypted:	true
SSDEEP:	98304:g58r6e2r5K1/kGBC5+cf7bKX71XVOTrEnGqqOsvwkeiHvIk5h0D6fzA68nCnOgb7:ti5/ccj+XBXFqOs4kezAeD67AxCOUj
MD5:	28C02FB2D8AAA4F9BEEA014EB914AAD7
SHA1:	7E171E990781D9F8012699148DBF260058DBAC4B
SHA-256:	69860AFF30AAAA6BD4CD883D2C7D7B348B05ED95ADFB4A51F3B28E3F86494E77
SHA-512:	CBF6429C69768904A4DAF7A81E9D845FCE3CD2570FB250F2B3C680C509F6B0864BF997410A5608D1E136A1502E3FFF36DAE90BB818830C098784F584687481B3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/home-page/promo_pr_acquisition_banner.png
Preview:	.PNG........IHDR..............4..._..IDATx.4..-..7.kE..<..s...TQ`cJ..[.e..Yr..;.,..t...,......lp...W.{..\|d....5.p#...;S{..s.9.o.....E..Pa'j...P....a..{.A.#...QD.\|![U.e.N;[{ #..B.'.c.!..0...K....I..W.T3h.P..D......W-.....F..A........^..y.8..#...[.N..Y7..l$.[.T;TnvVm..U..0IPs..N..5......C.t..._...".#o...q...+aS.....E......2U.0&.I#f{.6....v.z.b.....4A.l@V-."f.....d.0#..U.pe..^..8.e.T....$..\y..3_h...c....L.0.k.J\..BF...^\fLd.Z.&5@..q'e@.....+.`F.-.$.....h.Qd3..D...Tn/.S...^.+..O.j......c<......4.k..J.....A..j.[<V-.0;.... ...Zh..j...........&.1......*.k.c.;..i.l..a..m.?z...../......\.....7.d.7...X1.6.d...N..A...N8.(.c.s...N/r..ZBg.@F...........6.n.B.@..ul_.7....[.>l....k..P...'..+.B..w...c....\+y.89o...F.....8.\|.)..5..b.{.g......I.X.J....AF..)2.#...r..q6a...{.f.8.Y.[<......9..'\U..)...<T].%x..........&.+.O.s\....e.......+.l..^Q.....\...L...p.D.+...c.5.0.E......k..:.(....H/=.t...Z.1.....?..."+.....:.....L..T]..@l....`..&.u..\.,F.g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\recaptcha__en[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	350180
Entropy (8bit):	5.711967267537503
Encrypted:	false
SSDEEP:	6144:aq9SoRPYSmIFCzEKh7lohRGDk2ZpGBBq9qVAX/oXq:aq9SoRPNEzEKhZoHEkWGBBj+oXq
MD5:	40018AB74791324F5BA0459A05F80D07
SHA1:	4EAC42BC4ACEADFEB3C0849277236AD03CB50A7E
SHA-256:	33DF66CA469E2DE5AE4723C4944B20FD37D65DAA2F095B6EC2FF0D70ED6C3D57
SHA-512:	824A444D00D98BED0A9E72E25034FF1C0DBE241395AEB9EEC1B4E5D0E003DDDE5F9487F5EECED1D405F66232950E7FC5DFDD11B806A5B590441B8D96AEB86FF9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/sG0iO6gHcGdWJzjJjW9AY49S/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var w=function(){return[function(A,T,a,B,b,t,J,Y,D,G){if(D=[null,96,0],3==((A\|3)&15))if(Array.isArray(b))for(t=D[2];t<b.length;t++)w[D[2]](1,D[0],a,B,String(b[t]));else b!=T&&B.push(a+(""===b?"":"="+encodeURIComponent(String(b))));if(!((A^965)%10))for(t=[12,"fontSize",1],J=k[6](5,"px",D[2],"SPAN",t[2],B),x[15](D[1],B,t[1],J+"px"),b=w[26](17,B).height;J>t[D[2]]&&!(a<=D[2]&&b<=T*J)&&!(b<=a);)J-=T,x[15](D[1],B,t[1],J+"px"),b=w[26](16,B).height;return 2==(((A\|5)%((A-4)%7\|\|T&&T.parentNode&&T.parentNode.removeChild(T),.21)\|\|(Tb.call(this),this.X=D[0],this.R=D[0],this.U=window.Worker&&T?new Worker(v[21](18,m[44](13,"error",T)),void 0):null),A>>1)&11)&&(t.response={},t.P$(T),Y=c(function(){this.G4(B,b,J)},t),k[21](25,t.W).width!=t.um().width\|\|k[21](33,t.W).height!=t.um().height?(K[24](30,t,Y),m[18](4,a,t,t.um())):Y()),G},function(A,T,a,B,b,t,J,Y,D,G,N,I,M,z,H,e,Q,P,F){if(!((((P=["undefined",13,5],A<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\shadow[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	718
Entropy (8bit):	4.651574976809006
Encrypted:	false
SSDEEP:	12:UMUgqi29gehwallsQpqgcrullsQpqgc6vn:2gCKK4Q0gz4Q0gHn
MD5:	BF48EB79FDD88149A88AD6B40A99342C
SHA1:	C3FC7BF475015B49A567FB8472929A4737AED7EE
SHA-256:	49B5825B22EFDEF60989F15C8890F56473CA82DCFAE0B7B27746FFBA088749D3
SHA-512:	7A1C5C67AC5C872D8D287BBE8B64CA2269E4D03518ACE9DC00A3A4FBC837DA64E648735761E6CE47FE7493E6A13795F81288706EA25F755CCFADBD389E58D777
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/shadow.css
Preview:	/**********************************************************************/./ SHADOW.CSS /./ Controls appearance of shadow elements. /./**********************************************************************/...shadow.{. .FILTER:progid:DXImageTransform.Microsoft.Alpha(style=0,opacity=10);. .-moz-opacity:0.1;..position:absolute;..top:0px;..left:0px;..background-color:#000000;..visibility:hidden;..z-index:1;.}...dropShadow {. .FILTER:progid:DXImageTransform.Microsoft.Alpha(style=0,opacity=10);. .-moz-opacity:0.1;..position:absolute;..top:0px;..left:0px;..background-color:#000000;..display:block;..visibility:hidden;.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\showNotice[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	37538
Entropy (8bit):	4.805814401610027
Encrypted:	false
SSDEEP:	768:Z4/4IUaxIHIgmxcSfpPWeIkjyAe2P2wLtm8uRb+uw/bEr:Z4/RXxIHIgmxzWeIkjyAe2P28A8uRb+E
MD5:	31EBDD9E05945C9536B23D55315C5D4A
SHA1:	5660F1655FCF40945683D3F9AF7653795FBECF0D
SHA-256:	701A27C74312A0A0255291260BCF7D100A5FA4A7E2C561A9BD8BA23C887ABF0B
SHA-512:	25E39551E67633F74C0AB562C2FC2E38B918B97BAF0FF552155613B34DE57E5119F2AA9D27109F921DA448299299142C9863DF0353CE22125F29F09D3D13A567
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/showNotice.do?report_type=1&GKEY=112
Preview:	.....<html>.<head>.........<META HTTP-EQUIV="Pragma" CONTENT="No-Cache">.<META http-equiv="Content-Type" content="text/html; charset=UTF-8">.<META HTTP-EQUIV="Expires" CONTENT="Tue Aug 22 18:53:10 GMT 1975">.<meta http-equiv="X-UA-Compatible" content="IE=9" >...<html>.....<title>Today</title>.........................<script type="text/javascript" language="JavaScript">..// Webaccess JavaScript Library (c) 2000 Fortuity Consulting. All Rights Reserved..///////////////////////////////////////////////////////////////.// specify the name of a servlet that responds to requests:.var servletName = "Dispatcher";.///////////////////////////////////////////////////////////////.// Extract the URL of the current directory (the application context):.function getContext().{.firstSlashes = window.location.href.indexOf("//");.secondSlash = window.location.href.indexOf("/",firstSlashes + 2);.thirdSlash = window.location.href.indexOf("/",secondSlash + 1);.var path = window.location.href.substring(0,thir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\tab[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2768
Entropy (8bit):	4.5808363897818225
Encrypted:	false
SSDEEP:	48:SBCHAOAFix5R2Ho5jR5y5vBOaU5Q2pr5Bly5cb6:SAHveUDgvkaid1wcb6
MD5:	CE57DC419BAF2AED91CB97DCEEA68434
SHA1:	14B55C8F61F3865C3CB9CEBDB9D06FD81FD80C77
SHA-256:	6FB857E679C4EA34E1566D5D47C62B05D5236A1B09BCEB643B708B696E7E9019
SHA-512:	12D5B3C9EDC1F9593EFCF483C194850E606544ABDC9CF66616B7859B97827AD978DF05F20B3879E3E54DB50EBAB5C7A9DCD26D3D8AA14AF0032F6D9960B32342
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/tab.css
Preview:	/**********************************************************************/./ TAB.CSS /./ Controls appearance of tabs. /./********************************************************************/../*************************** Globals ****************************/./ Applies to all tabs. /./********************************************************************/..tabTable.{. width:auto;.}../************************ Content Tabs **************************/./ Used for tabs appearing in the content area. /./**********************************************************************/..tabLink, .tabLink_active.{..border-top:1px solid #F5F5F5;..color:#333;..text-decoration:none;..font-size:11px;..padding: 3px 10px;...display:block;..white-space:nowrap;..vertical-align:middle;.}..tabLink_active.{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\twitter_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	335
Entropy (8bit):	6.8095314333586
Encrypted:	false
SSDEEP:	6:6v/lhPknWCnMRYYYz9j+JX2QFO29tK8m1eYa3WsNSK4T1FhtxTb0YKIZCN6ztp:6v/7gtnMYYkCcQpHm1+0TDhtR0/7N6zD
MD5:	EF3BA06C0897F5CE35D4F89C4D7B35E9
SHA1:	4714FC12B71932FE279457DE90AB8E0FC97DB16B
SHA-256:	E6743EBD3A6343780BFB00D498CD59D06D4DE5C3175DEB03D9CBA2A7567FEB5C
SHA-512:	CBD094D3BE9892DF538314B87EA0F620F3DAE8CF5300FDDF8049331E8EF481EBA255C1A52C45EADBFD1E75701808F2FB81A3272E0A360C83CC74B6C47A161476
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/twitter_default.png
Preview:	.PNG........IHDR....................gAMA......a.....sRGB........TPLTE...5@]5=]5>^7@]7@[7=]6?^6?]....................................u{.u{.ho.[c{OWq6?]..&{....tRNS.``oppp...K......IDATx.....0.D'l...(u....?Q."..7....4....md.....}`.;.=.R........:"..\|....D..".........l...n..L...}..YpK..^.S...I.p..uw_{....N.....5k..n....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\wistia-mux[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	96330
Entropy (8bit):	5.495899885233113
Encrypted:	false
SSDEEP:	1536:svR0tbpVGtMtfDZwael5P8KSs5USYw/NXnj/Sc67RuxTwp5JS+cC:svKzPdDZwXps9uxTwgJC
MD5:	E8E035E488B21FA6A3DDF3F0FEC73ADB
SHA1:	215FACADFDE395F7965DB630BB310891719BBDA5
SHA-256:	5FEF4203FDD3629C33ED0A745D8437E59E17E7E9DEC036B4BB91C863FADF8EC6
SHA-512:	45BD731B5EB1DE3BBCB3B5DFA0CEA2D776A932214BE195A4E7CE2BBD53FCC07973C0A92ABE8EA9FA892CCF07CE8C71EC116E2C96B1C3695817EEF3D41C291EDF
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/external/wistia-mux.js
Preview:	/****/ (function() { // webpackBootstrap./**/ .var __webpack_modules__ = ({..// 635:./*/ (function(module, exports, __webpack_require__) {../ module decorator / module = __webpack_require__.nmd(module);.function _typeof(obj){"@babel/helpers - typeof";return _typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function _typeof(obj){return typeof obj}:function _typeof(obj){return obj&&"function"==typeof Symbol&&obj.constructor===Symbol&&obj!==Symbol.prototype?"symbol":typeof obj},_typeof(obj)}/. mux-embed. * @version 2.4.5. * @copyright 2018 Mux, Inc. */(function(){var define=!1;!function(e,t){"object"==( false?0:_typeof(exports))&&"object"==( false?0:_typeof(module))?module.exports=t(): false?0:"object"==( false?0:_typeof(exports))?exports.mux=t():e.mux=t()}(this,function(){return function(e){function t(a){if(i[a])return i[a].exports;var r=i[a]={i:a,l:!1,exports:{}};return e[a].call(r.exports,r,r.exports,t),r.l=!0,r.exports}var i={};return t.m=e,t.c=i,t.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\youtube_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 25 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	376
Entropy (8bit):	6.885155894365008
Encrypted:	false
SSDEEP:	6:6v/lhPySFnMRwYCKZNUaWFO28FOrgxfOgz+Fq9bL1lqCX7l3yAhnm9tiKwddvqHi:6v/766nMwYC6NVWp8FIoOgS41r7l3yA9
MD5:	8C928E72A17DA39DF7987600E2F524F4
SHA1:	5C5AA1F8399B72D730147D22310578730ED8CAD5
SHA-256:	B7B76D30CCBA6C8E1BFA590EDE2D386C09EF4BC0CD76390C6F1A8027E0A9921C
SHA-512:	04B0A176971707AA066D625A15F103A0CF3D79BC4ECC2245381550B7977001A68C8407CBACCD90FC1F5100414C2B71E993203ABA1DB1B654A115E0497665006C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/youtube_default.png
Preview:	.PNG........IHDR.............8k......gAMA......a.....sRGB........lPLTE...::Z3@\5@]5>^7@[7=]6>^6@\7?]6?\6?^6?]6?]5?]........................................u{.ho.\c{[c{OWqCKg6?].......tRNS..P`opp........H.....IDATx..... ....<U!Z.E...?z....W}.8......H..0.5K`....t.......\..rl.iM..J..3.....r.r.....MS.x...k*}.a...-..Gye@.y.]}"k.%:;..............x..k?t.]}.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\E-v1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	630724
Entropy (8bit):	5.258472779687222
Encrypted:	false
SSDEEP:	6144:nAzocXPMnz8iDEGz93biPxEhqStdVQt+xE0w4jF:nAocXEnz8iRzlVK+xE0x
MD5:	6217B26B39F391E3001A2B3AE1BA22D8
SHA1:	95D31DAEE312551479A647290452B55FF2D58358
SHA-256:	502026CCAD6843FB707C19F5C52D77A2CB5EBD7DDE507392EDB530CC620BAF67
SHA-512:	3AA6E3ADBB6E1965AE0C8A96D96FF87CBDF371F8149881E68441B4CD8350285931FF9DC140F000E13D700A9B4718CB08B7EFC4EFA85F6688AB9603B9A372C40D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/external/E-v1.js
Preview:	/! For license information please see E-v1-with-vulcan-v2.js.LICENSE.txt /.(function(){var __webpack_modules__=[,function(t,e,n){"use strict";n.r(e);var i=n(2);null==i.default.Wistia&&(i.default.Wistia={});var o=i.default.Wistia;null==o._initializers&&(o._initializers={}),null==o._destructors&&(o._destructors={}),null==o.mixin&&(o.mixin=function(t,e){for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n])}),e.default=i.default.Wistia},function(t,e,n){"use strict";function i(t){return(i="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t})(t)}var o;n.r(e);try{(o=self).self!==o&&void 0!==i(o.self)&&"undefined"!=typeof window&&(o=window)}catch(t){o="undefined"==typeof globalThis?window:globalThis}e.default=o},,,function(t,e,n){"use strict";n.r(e),n.d(e,{standardSvgAttrs:function(){return s}});var i=n(1);function o(t,e){var n=Object.keys(t);if(Objec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\GetFormInitScript[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6153
Entropy (8bit):	5.215255664867872
Encrypted:	false
SSDEEP:	192:qX0//hCa5w5BU1LxdBU1LY1BU1LZ1BU1l0UCuKBU1LX0BU1ln2UHcyBU19zdjK9G:U03hCa5w5BoLxdBoLY1BoLZ1Bol0nuKN
MD5:	8ADCE2D1DE784E220635C92B9B20962D
SHA1:	07548055A4C7EB7782F70F35D5078DB026D6D130
SHA-256:	C6CC641C4B2F4091FD42495A23EE741912A720E732537E6DF9F69BF83931CD9D
SHA-512:	832583EA32822530B6EC5D55A8222698CB59FD2B0EAD2A05528D3A56CAA6D89428B5A0DF5FADEDC06179C20D5A35F9935D10621DEEBBB43D0C2692505AE752E1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/EPiServer.Forms/DataSubmit/GetFormInitScript?formGuid=7e146e8f-cc51-4922-9922-dea5dbed1f4a&formLanguage=en
Preview:	../* This view acts as a rendering template to render InitScript(and server-side Form's descriptor) in FormContainerBlock's client-side for Form[7e146e8f-cc51-4922-9922-dea5dbed1f4a]..TECHNOTE: all serverside (paths, dynamic values) of EPiServerForms will be transfered to client side here in this section. */.(function initializeOnRenderingFormDescriptor() {. // each workingFormInfo is store inside epi.EPiServer.Forms, lookup by its FormGuid. var workingFormInfo = epi.EPiServer.Forms["7e146e8f-cc51-4922-9922-dea5dbed1f4a"] = {. Id: "7e146e8f-cc51-4922-9922-dea5dbed1f4a",. Name: "chat",. // whether this Form can be submitted which relates to the visitor's data (cookie, identity) and Form's settings (AllowAnonymous, AllowXXX).. SubmittableStatus : {"submittable":false,"message":"You must be logged in to submit this form. If you are logged in and still cannot post, make sure \"Do not track\" in your browser settings is disabled."}, . ConfirmM

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\JTURjIg1_i6t8kCHKm45_bZF3gnD-A[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23628, version 1.1
Category:	downloaded
Size (bytes):	23628
Entropy (8bit):	7.97652223541331
Encrypted:	false
SSDEEP:	384:aWXmwssTJH1/G6rbr24Jln5GTJO8XWSN2OyyW/nGGxnslEYe3cB68HOeHS9AVqmT:aW2wdx1/HPCQln5F8XL2frP5pMB68H/N
MD5:	7C839D15A6F54E7025BA8C0C4B333E8F
SHA1:	09FC9F1CA6B859952A3641EDBFB1424E1C873F5D
SHA-256:	46226ABFCDE5DB2598FED8FD0DE77AF9B96C8242DC0E72242971F0BBCF566A38
SHA-512:	239EDDCB1FE723077F1FDC76B265A3D5E6F946F5258C968B15AB99CDD817D0D67D85248DA13820D9EBF0EA256F1E29ADB975894707E1901BCBDB0C2908ABC8C2
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_bZF3gnD-A.woff
Preview:	wOFF......\L................................GDEF.......G...X.g.^GPOS..........2....!GSUB.............,.OS/2...\|...M...`Ti.mcmap..............h.cvt .......d....2...fpgm.......F...mM$.\|gasp...<............glyf...D..4..._.F.1.head..S....6...6.Z..hhea..S@... ...$....hmtx..S`...$...>...loca..U....!...(N.e.maxp..W.... ... .h.Wname..W.........+.FOpost..X.........D.z.prep..[..........K..x.%....P......@:D...$.. ]!....h.....2/.$.....D.^.F..ua.].N....%>./...x...p.I....RK..Z-...m.-.= .a.........1.0..n.........-h....C!.......Wm.F3....J~/..\|........._]F....Y.x.._......s.w!.S...'..9d...(...5.).O.z.>...OQ..7J'....>...J.:..K$a6. .._P.lXP."....6....Ie.sY5.n.t'".C..-..5.2...4.}..H.P....w.......OX.....)8....7?..H..I.@\|.....R.'..#R.:....{C}....V.%.i...v.L9K..C......N".r.P.../..7.UN..'..0...-.Q..M..o.6......-.&l..B.w..x.....e>....CB....&........&..P.S....3..Y...Q>/..e...B.+..\|.o0..I.#L.]a...../................&..gLz....J...g!.,$..4#...2L..>.P...gF.67.@.}...IX.&....?Vi....ORR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Me
Category:	downloaded
Size (bytes):	35588
Entropy (8bit):	6.410135551455154
Encrypted:	false
SSDEEP:	768:6yVJgIpAqZsXgDNHOBBPXNOKdhT1N+06XAxGrzmoqpxk0SnuUR:enq805OBBdhT1NP6XAxGryoqp2
MD5:	4D88404F733741EAACFDA2E318840A98
SHA1:	49E0F3D32666AC36205F84AC7457030CA0A9D95F
SHA-256:	B464107219AF95400AF44C949574D9617DE760E100712D4DEC8F51A76C50DDA1
SHA-512:	2E5D3280D5F7E70CA3EA29E7C01F47FEB57FE93FC55FD0EA63641E99E5D699BB4B1F1F686DA25C91BA4F64833F9946070F7546558CBD68249B0D853949FF85C5
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Preview:	........... GDEF......{....dGPOS......\|<....GSUB7b.....8....OS/2t.#...r....`cmap......st...Lcvt 1..K..y....\fpgm..$...v.....gasp......{.....glyf.'.....,..j.hdmx......r\|....head...r..n....6hhea......q....$hmtx..MO..n@....loca\v@z..l(....maxp......l.... name..:...z,....post.m.d..{.... prep...)..x\|...S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\KFOmCnqEu92Fr1Mu4mxP[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-Regularht
Category:	downloaded
Size (bytes):	35408
Entropy (8bit):	6.412277939913633
Encrypted:	false
SSDEEP:	768:PX4i+tezjtQYgu30G0xL9nQbuEL7LQo9SBxQbptqKmomjJlvh:PJ2z3G0xpUusLEBKptqNomjV
MD5:	372D0CC3288FE8E97DF49742BAEFCE90
SHA1:	754D9EAA4A009C42E8D6D40C632A1DAD6D44EC21
SHA-256:	466989FD178CA6ED13641893B7003E5D6EC36E42C2A816DEE71F87B775EA097F
SHA-512:	8447BC59795B16877974CD77C52729F6FF08A1E741F68FF445C087ECC09C8C4822B83E8907D156A00BE81CB2C0259081926E758C12B3AEA023AC574E4A6C9885
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf
Preview:	........... GDEF......{`...dGPOS...h..{.....GSUB7b..........OS/2tq#...q....`cmap......s....Lcvt +.....yl...Tfpgmw.`...vd....gasp......{T....glyf.......,..j.hdmx......r ....head.j.z..m....6hhea......q....$hmtx..Vl..m.....loca?.#...k.....maxp......k.... name.U9...y....tpost.m.d..{4... prep.f....x ...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\U8GYL0RO Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Reputation:	low
Preview:	0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\WebResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	97163
Entropy (8bit):	5.373204330051448
Encrypted:	false
SSDEEP:	1536:GYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOaS9TwD6b7/Jp9i:t4J+R3jL5TCOauTwD6FdnCVQNea98HrV
MD5:	4F252523D4AF0B478C810C2547A63E19
SHA1:	5A9DCFBEF655A2668E78BAEBEAA8DC6F41D8DABB
SHA-256:	668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
SHA-512:	8C6B0C1FCDE829EF5AB02A643959019D4AC30D3A7CC25F9A7640760FEFFF26D9713B84AB2E825D85B3B2B08150265A10143F82E05975ACCB10645EFA26357479
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/WebResource.axd?d=rQapnFTl_pgMjn3yGS-nPhMH5pAn7wAmaJottpNQwTsNbAD7LW2RrjNi8c4xuFPu9isdvAz_q42YJ8_I3YnOtsV3Fb_HORTj3Oar4WpKQRdIkFLltaiEV98CQ6HUMjg92XzAmK7QnWZw949nLXRk5ynnnTo0NJ6ShPENODz4jes1&t=636540400180000000
Preview:	/! jQuery v1.12.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\about[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	33333
Entropy (8bit):	4.5864627800247835
Encrypted:	false
SSDEEP:	768:+LsyjUaxIHIgmxcSfpPWeIkjyAe2P2wLtm8uvb+BvCu8hEv:+LsQXxIHIgmxzWeIkjyAe2P28A8uvb+b
MD5:	D1CAE6C4918C20AC387480430E514E10
SHA1:	23367406E33F5D4FF9F871630BA68ABD66E0857B
SHA-256:	9ABEFC9F1F86B5F91F5C00AD485A97824061FEB028FFF595A0BB59493748CE45
SHA-512:	311C026AF7F193130CD6D1DCC3DE7E78ADBCC054F75F6269EE817ED13749D1F33ACFB2C143A6A08A4FA442BE2372C968EF8FD2C36BB6A35EC2DB510B93ED2800
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/about.jsp
Preview:	......<html>.<head>.......<META HTTP-EQUIV="Pragma" CONTENT="No-Cache">.<META http-equiv="Content-Type" content="text/html; charset=UTF-8">.<META HTTP-EQUIV="Expires" CONTENT="Tue Aug 22 18:53:10 GMT 1975">.<meta http-equiv="X-UA-Compatible" content="IE=9" >...<html>.....<title>About WebAccess</title>.........................<script type="text/javascript" language="JavaScript">..// Webaccess JavaScript Library (c) 2000 Fortuity Consulting. All Rights Reserved..///////////////////////////////////////////////////////////////.// specify the name of a servlet that responds to requests:.var servletName = "Dispatcher";.///////////////////////////////////////////////////////////////.// Extract the URL of the current directory (the application context):.function getContext().{.firstSlashes = window.location.href.indexOf("//");.secondSlash = window.location.href.indexOf("/",firstSlashes + 2);.thirdSlash = window.location.href.indexOf("/",secondSlash + 1);.var path = window.location.href.substri

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\appointment[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1227
Entropy (8bit):	4.607950452157535
Encrypted:	false
SSDEEP:	12:UMjC4FTYp4Jhxv/88/1EcLmPv/88/186x89acLcXAa8X6BGO885W8Avh88DYeNvh:gjp0hMcj+vS8egEj37HcPd0
MD5:	ADC362FB33CF07257D8242F4A3D06D92
SHA1:	1D749FE0E0CE31DBFAA18875FCCCFB2F50B578F2
SHA-256:	4093CFEF7D4609E47C90FA987EA49061F216A1BDE9F2931C55845B1D720EFC1D
SHA-512:	2BAF435FFE56D761225E6674F13DD7B85642EB540F138D41632CEA25FAA7B016F51BC94B6696023BC3B17DB68C4074EC925FAEB4C90FF1EB7DEBB37E49E022E1
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/appointment.css
Preview:	/**********************************************************************/./ APPOINTMENT.CSS /./ Styles used to display appointment related pages. /./ /./**********************************************************************/...labelHeader.{. background-color:#aaaaaa;. font-weight:bold;. white-space:nowrap;.}..nbrHeader.{. background-color:#aaaaaa;. font-weight:bold;. text-align:center;.}..labelEntry.{. background-color:#D5D5D5;. text-align:left;. white-space:nowrap;. width:82px;.}..radioEntry.{. background-color:#EBEBEB;. text-align:center;.}..addEntry.{. padding:0;. background-color:#EBEBEB;.}..table_background.{. background-color:#999;.}...td_background.{. background-color:#F9F9F9;.}.div.apptTable {. border-style:solid;. border-width:1px;. border-color:#999;.}..formLabelTd.{. b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\blank[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	downloaded
Size (bytes):	1214
Entropy (8bit):	6.925737607348584
Encrypted:	false
SSDEEP:	24:xal1hiyWwjx82lY2T3oVkK53yJ3VmA2LOsj8GY8a9AH:CuNn2kwJ3AAeOsYL8aAH
MD5:	FBDC4ED9A1E2EE4917A265306927BCF1
SHA1:	6D177725D8230DF0457E72004080F712E26FE624
SHA-256:	A78759EA185FD0FA42CA9BE1FC5BCA4D3167A2836DC6C85E479A19DBF57FE2C2
SHA-512:	E529A409048C78837F0D6A6EB77450070EEECC7915D81C45970915F3BBE92BFDAF9056580BB84C14B21C499D04A73945EECD0AD33C61942C5D28DAF06CC7C40D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/images/blank.gif
Preview:	GIF89ad.d..........!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:B06C130C478A11E6B3E8D67655718D4D" xmpMM:DocumentID="xmp.did:B06C130D478A11E6B3E8D67655718D4D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:492A1D7F478811E6B3E8D67655718D4D" stRef:documentID="xmp.did:492A1D80478811E6B3E8D67655718D4D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}\|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONML

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\button[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	3835
Entropy (8bit):	4.846639095328846
Encrypted:	false
SSDEEP:	48:5a95z5Xjo3EEOmRsSPSQnb+aQloU87osEEn9ndTsPg2P32Qnb+1mQloUd:5S5z5XeOVk1aez5mR5wr
MD5:	159C9171D4DCEEB76F9F6DFF20B8F924
SHA1:	5F14559490A89952D55B04361C76EDB8F71CD0E3
SHA-256:	D946320B0D8FBBD4775BCB64565E72FCEFD85D659B6035B76F8ADD1E7A41308E
SHA-512:	57FE46A2CEE9097748BF4CD35B1C81DB72865E383303BC53502B05FD0C3F5A35AEF4C9A713FFC43FBFF4203CC19AF9940F20CE08692AD3844A95ED57FC725752
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/button.css
Preview:	/**********************************************************************/./ BUTTON.CSS /./ Controls appearance of all buttons across the application. /./********************************************************************/../************************** buttonArea **************************/./ Used by the <table> that contains the button elements. /./********************************************************************/..buttonArea.{. padding:0px 10px 10px 10px;. text-align:right;.}..buttonTable.{. margin:0px;.}..buttonRow.{. padding:0px;.}../*************************** button1 ****************************/./ Gray buttons. Used for page-level operations. /./********************************************************************/./* the parent <td> is used to draw the border ***/..button1Td, .button1Td_default.{..border:1px solid #9F9F9F;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\content[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2627
Entropy (8bit):	4.740376940473023
Encrypted:	false
SSDEEP:	48:gUp1eMQ6NM2n5vI0J5VEBJ5VS+t5iP85iWx5i4J5UJ5rXycuyMyPx:gK9NMGvzVMVS+viP6iWriIcTyFyMyPx
MD5:	0C1FB1D65C30AB7F92A875D73826E9DD
SHA1:	DA43B3C6501A685FF5FBC491F5832CF1A33B850E
SHA-256:	4854D7C79D8464F08901BAEBD821F723DC94B9482ED0C105D2F2D7BA836212B7
SHA-512:	B52FFD84227C8829525EF9EDA58ECFA915C61B34067368FB777E925E01517C471F25395C1703970AC1DF5A6B21692137B9242B93D2490A3941A353B7DD7BA363
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/content.css
Preview:	/**********************************************************************/./ CONTENT.CSS /./ Used by any page with a content panel. Controls the /./ appearance of the content framing, margins, highlights, etc. /./********************************************************************/../*********************** contentTable **************************/./ Used to frame-up the content area in a gray panel. /./*********************************************************************/..contentPanel.{. padding:0px;. background-color:#FFF;.}..contentPanelTable.{. / determines whether the gray box in the content panel stretches 100% width and/or height */. width:100%;. height:100%;.}..contentArea.{. padding:10px;.}..contentTable.{. width:100%;. height:100%;.}..contentHeaderRow.{. background-image:url(../../images/tabs/tab1/tabRowBgTile.gif);. backgr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\conv_v3[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	68718
Entropy (8bit):	5.568303356883967
Encrypted:	false
SSDEEP:	1536:RLdT264hQPqNBAU9sLuqhTvvQVVLJqAakRih:RLdTF4aOQhjohPih
MD5:	60D40D10D1DB03EEA011CC595B2C6AA5
SHA1:	7AD3BB61C934588E9C3A0EC2206324E5AF4511BE
SHA-256:	AFDD29778A35ECF1638FC1C8BEE1D4F7843D437D01B5DB08CDF364DA6B0EDEAF
SHA-512:	9CDC981D17970C8CE02A9698E79D00553C36022E70A2F3B4D9E754B732012BF9252C7558616A32178846C37FCB81663E4F75ADE2001537161C2B8EF5BE169026
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn.b0e8.com/conv_v3.js
Preview:	function initializeFPJSLibrary(){var x64Add=function(m,n){m=[m[0]>>>16,m[0]&65535,m[1]>>>16,m[1]&65535];n=[n[0]>>>16,n[0]&65535,n[1]>>>16,n[1]&65535];var o=[0,0,0,0];o[3]+=m[3]+n[3];o[2]+=o[3]>>>16;o[3]&=65535;o[2]+=m[2]+n[2];o[1]+=o[2]>>>16;o[2]&=65535;o[1]+=m[1]+n[1];o[0]+=o[1]>>>16;o[1]&=65535;o[0]+=m[0]+n[0];o[0]&=65535;return[(o[0]<<16)\|o[1],(o[2]<<16)\|o[3]]};var x64Multiply=function(m,n){m=[m[0]>>>16,m[0]&65535,m[1]>>>16,m[1]&65535];n=[n[0]>>>16,n[0]&65535,n[1]>>>16,n[1]&65535];var o=[0,0,0,0];o[3]+=m[3]n[3];o[2]+=o[3]>>>16;o[3]&=65535;o[2]+=m[2]n[3];o[1]+=o[2]>>>16;o[2]&=65535;o[2]+=m[3]n[2];o[1]+=o[2]>>>16;o[2]&=65535;o[1]+=m[1]n[3];o[0]+=o[1]>>>16;o[1]&=65535;o[1]+=m[2]n[2];o[0]+=o[1]>>>16;o[1]&=65535;o[1]+=m[3]n[1];o[0]+=o[1]>>>16;o[1]&=65535;o[0]+=(m[0]n[3])+(m[1]n[2])+(m[2]n[1])+(m[3]n[0]);o[0]&=65535;return[(o[0]<<16)\|o[1],(o[2]<<16)\|o[3]]};var x64Rotl=function(m,n){n%=64;if(n===32){return[m[1],m[0]]}else{if(n<32){return[(m[0]<<n)\|(m[1]>>>(32-n)),(m[1]<<n)\|(m[0]>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\facebook_default[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 25 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	334
Entropy (8bit):	6.726260763801135
Encrypted:	false
SSDEEP:	6:6v/lhPySFnMRUYYzbNUaWFO280DOjUtyRbVCs9sSXr4+70fhB0zA8CJd7dW0ldp:6v/766nMUYgNVWp80qjXbVCs5d75A8Cp
MD5:	D21A0B988E89523B49F6E5DB66D88B4E
SHA1:	43346CF7F01F6D4B4E1D93607AAF210724FCF111
SHA-256:	1B4097927CE1689E681BAF451481A171EE8D4CBCB5E662D0BEC38D7D3D2B6011
SHA-512:	30DBB878C3B05F45713086FAB0C5EF0EB68EF9E5852564E67DDDEDD52F527F4423627F342F8FA24016F0A747525067FEF11F592A56A96EC37BC66D520669421C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/footer/facebook_default.png
Preview:	.PNG........IHDR.............8k......gAMA......a.....sRGB........`PLTE...5@]5>^7@[7=]6>^6@\7?]6?\6?^6?]6?]5?]...............................t{.ho.ho.\c{[c{OWqCKg6?]........tRNS.`opp........l.L....sIDATx....0..Pq$.AI.1N...K.Z...r_.B..U.b... .....h.. \..V/ez...O.(...=..).......#k,...m...O..p.\...~.s.........@.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	2.490039098412334
Encrypted:	false
SSDEEP:	12:XFRa+aoSHEwxEoKV2c3jzToacJSbiNbLaooYnw:XF8loeEwioQT/So6uo
MD5:	52BB0512EFC5707E16E08997ACB89E45
SHA1:	358125E90183732DCD38AB56037D71D0050171A0
SHA-256:	8E0AEB808F295EEC8640A67437292F6A1FF56B2EAF2F613ED598933B0AA42ED0
SHA-512:	9D08BEBA9353F501979BEB5DD00BEAF463F985055B9B38AF9B40F350E4DCCDDBC7027651BF2C51F8CB44EF29389954B369E324892656D409CD0192C59626A6A3
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/favicon.ico
Preview:	............ .h.......(....... ..... ..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................}/....U....................................................?...Y.................................................Y...`!..u=........................................................s...e.......................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\gptw_small_web_banner[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 370 x 300, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	14663
Entropy (8bit):	7.917914432046883
Encrypted:	false
SSDEEP:	384:LviJ+m3F5mpc/cdTdPd4mufrI4a9dPBwB0eBzST1/YbV4YxOLf3YJ1N:Lvw3FopecdTd5qrJaDPBwB0USG4zf3AN
MD5:	7A98E41400C0365ABED45880D2F275FE
SHA1:	97F5F54606B3F30BBDCB5A31DB7B14DDEBC87604
SHA-256:	416668D0B1D1F84686FB0E5372CA6B76FB504159FE4CA732D6C9495B4A1B1642
SHA-512:	B12A7ABBE6DF4437984925F8FC0B85B10B620BE3B594CE895566F898D0F720D18F88DE9548E0229379312B2E35880F7530D4DF3CFEEAC286056BB223E4E5E459
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/0b3f40ef14014206b71abf40dbbb4593/gptw_small_web_banner.png
Preview:	.PNG........IHDR...r...,.....Q....9.IDATx..w\.G..m.h4.Dc,ID..{...5.$vMDc.1."..bo.a/.;.X...EE...q.....9f]f.........Gr;3.{.\|.y.g.'...J....e.3.+.R..(....+P`.X.V......V......@..`.X..+...X..+.....V..`....+...X..+...X.V>J.H....../..MsL.9&.....i....S'Q............o.Q...\|..-.Z.v..Y......................a.........+.JJ..m...Y.by.v9y.JJ...k')].X.V...6>%J$......7..D\......!!6..f..[..V..`.._.o.M..L.M.F.j.......V.....+....V.....cz.(a.Ty..U....6U.....j:...9.N.......V..`...:.w..+...r........$+..+.a..`.X.X........W....iwy......\|.f....V..`.obL....+E...8B\|..6......K.Q....i.R...j.`.W..={.!!.......4H..7...CCM........!!...i.:..`..$.Xa..I.~....)*.x...Qe..qy..Q[.,.i5...U..jU.s...W.b....D.`.X.aX.."..{..0W.).E..g.....M.O..!..p......=U.l.m./.?rD.....5w..%K.Z.l...H.._.[..>O.>..D..... .].X.Vr.V.={r;..5....\....7..?..._?kR.KN(.A...B..5./_.....^...+.4bE.~=....rd..X.$..E......6.5..l..6._.)c.J..e.+...U....zi&N\|...)....)..5.m..,z..V-..B.L......V....X...T/y...+\|..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\icon_Automation1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1000 x 839, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	27911
Entropy (8bit):	7.925867260380531
Encrypted:	false
SSDEEP:	384:5jKa1WMjJ4TJ6IjyIGTBxBjz9s8Gt17pFsB9DMgC6eYQC93EgJP9tn9RATS33Gil:5IMa6gcP9gPsfgX6eavP9t9RF3l0cv
MD5:	F684093B26BB084767E0ECE3269CAB55
SHA1:	1AD415A9B96844D9B1A836DF94DCCA9A4CD3BFF3
SHA-256:	3835D040353F03E78E1255D03CC657D4CBF5479F84260BCD3FB38A51D4575D97
SHA-512:	EDE2BEF40AA61EC3B623E6BE599F87DAEC5FD829C2430CCEAC308622EE5E1909C17B12422267456988F81CF1D50C06FD3A9C8C64D9025B9C8FF536AF17680B50
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/images/icon_Automation1.png
Preview:	.PNG........IHDR.......G.......T..l.IDATx..Y..:.F..!$..`...............!.B...[K.ZBRH>.^..f.3S..W.....................................................................................................................................z...d.E.o...c....d.Q.....d..^f.$.w..&.......'..<.x...u...4b.HN.rC....4..YJ..Y......R..I......AJ.R&....'.X.........H:..@...b.$... @.ob..A.................9......y/V..t...WA..]......$.7..>:.....ob......o.."..t...w.>....A...x'.w...........`.....K9..t..........A?.t...W..I..E...x!.@........:Yt.......A_d.In.{..d.If.........A...5..u.....O.5.{....> ......5,..=Y=p.....<....-Z.Lt......"...,:....<..".........r^(..A....@Q.r^2Yt...-A.J......HjQ..,:......e..d....4.u*.!.E......t..,:...J.....SIEy..,...s1...scy.Y._^.!.L.n>Kg.?....QV....V..v...b.8...l:Kg.?.?Z..L.....L$...1.....l....3..d.......@...b~....E.A.i.7&....]`.d.(..............0..&...4..7.h....H'..X[.,d.?...j........b.\|umh3.n#..A..C........3.y'.h.....EW.sD.....)..k^.d.?N.EW.sj..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\ieEmulation[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6959
Entropy (8bit):	4.07944089921338
Encrypted:	false
SSDEEP:	96:GBWO8/SML3g3k2kN6MGVQ/k2Vn+MGCKceyI:eML3MY6MGVQ/tn+bCL2
MD5:	162B891519F3B3C6E84D27B6F3760746
SHA1:	2D866214430BE82200F285CC684F33E2030C2440
SHA-256:	692AF71C8A8E71E5D04C3187DB75257C240DB7B434B60671CF109D11834059FE
SHA-512:	6032A3BAB2ED70CE304C4DA2A8DDB63C8D89E6931FAA3B38ECB09F44CC13200F7E3FBF52B5D9F047C12E2B9F8E0AA99B952113F90DF0DA17E7C63CD82338D7C3
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/ieEmulation.js
Preview:	/**********************************************************************/./ This script contains modifications to Mozilla prototypes that /./ allow Mozilla-based browsers to emulate proprietary IE /./ functionality. /./ /./********************************************************************/./ /./ This file depends upon the following JavaScript files: /./ -none /./ /./********************************************************************/../********************************************************************/./ Mozilla doesn't have a click() method for anchor tags. The /./** following code cre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\launch-55dc93f37385.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	21404
Entropy (8bit):	5.20339050190055
Encrypted:	false
SSDEEP:	384:e4/UumCsJO9OUe9VwkdARPnvhqP4gBdyPHIEeNaQCGIzIH3pb9aXKT7brnoT/ABZ:6umdM929VwFTNgBdyPiwQfTbbIw
MD5:	C8ADA97E2B8228EE33AFE1E12ED67BE9
SHA1:	ED1CEA5BE4848272627CFC02943CC8A7F89726CE
SHA-256:	A231E75BFF45A4F5A8911D1AFF15FCADABD4EC47997BB8E081741D53312F4E86
SHA-512:	6A1B0C0E50B9CFB2FA1AD35B84F0B7BCC4C7CA0C704BF3BBFC9AD42949C3A66C99E4463B23CFB0217F694532617C76B78FF62B978AAA531E948EA4A7C80E01F8
Malicious:	false
Reputation:	low
IE Cache URL:	https://assets.adobedtm.com/175f7caa2b90/53d2855b9b40/launch-55dc93f37385.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/175f7caa2b90/53d2855b9b40/launch-55dc93f37385.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2021-02-02T21:23:06Z",environment:"production",turbineBuildDate:"2021-01-19T16:25:50Z",turbineVersion:"27.0.4"},dataElements:{},extensions:{core:{displayName:"Core",modules:{},hostedLibFilesBaseUrl:"https://assets.adobedtm.com/extensions/EP0fe6b1b3170b414e92e8f7ad4f74f857/"}},company:{orgId:"AD246FC2526AB0CD0A490D44@AdobeOrg"},property:{name:"339043 - Navis LLC",settings:{domains:["octopi.co","navis.com","jadelogistics.com","biarrirail.com"],undefinedVarsReturnEmpty:!1,ruleComponentSequencingEnabled:!1}},rules:[]};var _satellite=function(){"use strict";function e(t){if(t.__esModule)return t;var r=Object.defineProperty({},"__esModule",{value:!0});return Object.keys(t).forEach(function(e){var n=Object.getOwnPropertyDescriptor(t,e);Object.defineProperty(r,e,n.get?n:{enumerable:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\logo_navis[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2300
Entropy (8bit):	4.94191701996074
Encrypted:	false
SSDEEP:	48:czAvf3QFH1x85R3Bs7DefPdY9HoDQJ8nB2qK8alD5sLimD:vvfgFVuRbYRB8Ej8A5simD
MD5:	5D87C709B9F90542A2D133A75F2DC181
SHA1:	18FC84D1EF755B0F87BE470D2969D32C7A5F1B05
SHA-256:	FC6E3E521DAA26E02B4926E65731EFB15452EF4CF9907265F40BC4D98CFC6F86
SHA-512:	2C4F4CE08511F8BE34C9EA8EE6CC972B296DB6ED8B2D0A96DC74074B49BF00BE94A375CF89A406AEE34501F5406A6B7C8C7E68D0C25674B71B7C9FA6D7772B3F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/globalassets/logo_navis.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 22.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 186 57.4" style="enable-background:new 0 0 186 57.4;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#76BC21;}.</style>.<g>..<g>...<path class="st0" d="M0,22.6h10.2v5c3.6-3.9,8-5.8,12.9-5.8c5.6,0,9.9,2,12.1,5.3c1.8,2.8,2,6.1,2,10.4v18.2H27v-16....c0-6.6-1.4-9.7-7.2-9.7c-5.9,0-9.6,3.5-9.6,9.4v16.3H0V22.6z"/>...<path class="st0" d="M78.7,50.4V34.6c0-4.5-0.4-7.5-3.3-9.6c-3.1-2.3-7.7-3.5-13.7-3.5c-12.4,0-18.8,4.4-18.8,12.1h10.7....c0.1-3.9,2.5-5.5,7.5-5.5c5.1,0,7.6,1.2,7.6,3.7c0,3.6-4.5,3.4-13.1,4.1C45.1,36.7,40,39.1,40,45.9c0,6.6,5.3,11,14.7,11....c5.7,0,10.1-1.4,13.8-4.8l0.5,3.6h11.3V55C79,54.1,78.7,52.6,78.7,50.4 M68.7,39.8c0.7,5.8-4.1,10.1-11.7,10.1....c-3.4,0-5.5-1.7-5.5-4.2c0-3.1,3-3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\mail[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	200
Entropy (8bit):	6.267930132862246
Encrypted:	false
SSDEEP:	6:6v/lhPO67CnMRW8CUIHec8rc3on/hkdFZuVp:6v/7P+nMUUX830MFc7
MD5:	10F3A0C3E33218463FACA3B8EA73FEE5
SHA1:	F1EB2547DA013FFF45B0013C4229068DABF1A226
SHA-256:	A26CD65615398ADF84E548233176E2B03A175EA473097B1C39ADCCCC67AF511F
SHA-512:	02143FF5B7B5DFFDB693C9F043EEB67823CA0BC0B4F4676595A05BD721853BB6A704950A7F638EF56ACC015F1640A65A003A2643A7EFD4F84300A83ADE446264
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/images/mail.png
Preview:	.PNG........IHDR...............7.....gAMA......a.....sRGB........rIDATx..m.. .D+..H@.N@..NJ%T.[R...oY.&.{..\|T$j....c}.b..d..=<..R.@}.C..7`..%....*.(.....{....\.7.g...pF..$..Q.C..M........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\marvel[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	8852
Entropy (8bit):	5.246414188322988
Encrypted:	false
SSDEEP:	192:D5qt++Arx8Mb/oxPOuOk3Bmz/P/8dIb43QqWdSaTH4CRaV/ig9fqa5CuIvKVkh+N:8t++APb/oxPOuoj/8043QqWdBHhq/igv
MD5:	3E921F5930B44539358A9B6658675D78
SHA1:	DBEF9AF5621F97815A8A6772A7FE95A728EC85AC
SHA-256:	04358F8C79513A23B07E61CD7F91E86B9F703499C0D9252D50A57483B79AD050
SHA-512:	D91FB09462D49CD165ECB1A19D68BD7EA2B691055C79D01952FA01BF5D17BF49FA64DB9E8D3BE95D3188A418CAE457F61843954DD332D976C7C32D746BCD1749
Malicious:	false
Reputation:	low
IE Cache URL:	https://marvel-b2-cdn.bc0a.com/marvel.js
Preview:	!function(){"use strict";var e,t,r,a,n,i,o,d,s,l,u,c,g,m,b,f,v="marvel-1.77.0",h=!0,p=!1,x=!0,O=!1,C=[],A="http://",w="https://",k="//",y="data:",N="/",L=".svg",V=".gif",j=".mp4",M=".webm",T=".ogv",E="src",W="data-src",I="srcset",R="img",z="source",B="style",F="div",U="section",D="article",S="figure",_="a",q="attributes",G="body",H="background-image",J="background:",K="background ",P="url",Q="(",X=")",Y="'",Z='"',$=" ",ee=",",te=1;function re(A){e=A;var w,k,y,N=!1;try{if(-1!==navigator.userAgent.indexOf("MSIE")\|\|navigator.appVersion.indexOf("Trident/")>-1)return;if(t=document.getElementById("marvel"))N=t.getAttribute("data-testmode"),r=t.getAttribute("data-customerid"),c=t.getAttribute("data-opt");else{if(!e)return;N=A["data-testmode"],r=A["data-customerid"],c=A["data-opt"]}ae("data-opt")&&(c=ae("data-opt")),p=!1,(w=ae("marvel-debug"))&&"true"==w&&(p=!0),N?(h=!1,(y=ae("marvel-testpage"))&&"true"==y&&(h=!0)):(h=!0,(k=ae("marvel-activate"))&&"false"==k&&(h=!1)),r?0==(r=r.trim()).length&&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\megapromo_n4_saas[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 480x300, frames 3
Category:	downloaded
Size (bytes):	38849
Entropy (8bit):	7.981755362348129
Encrypted:	false
SSDEEP:	768:BCNW2+dZ99DtM9kl/+ajTaAqhFhfxn4MQGlThjTp7AGk:BCNWdNpM2+avaAqhfpOGlVTRAGk
MD5:	2D2460331E040D02FBCA11B0CEAB33E7
SHA1:	740147E3A4302D317D12FB3C1217F3FC8C3ECDB7
SHA-256:	576DC433D268CADE56BAC1DC5A9129913F7DB65B233FABC2EBAFF94E077C2509
SHA-512:	5025A2CB99DDAEC4D051C93B6132BC8DC9F58847D8BE5BD287980D75A13B9FD5EF4562DB17353514CC3AAA23EBABDDD56D4023495D520CDAF70A668CB6C0E0DE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/9e5938154b774105bfb181a07809308f/megapromo_n4_saas.jpg
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,...."...............................................................................=..moe@.}...\....#Z.....i.T'..P=kdX5O.kZ..Z..$...o.QMu8.&....^..a..e@.....U;Z.L.W..B....;...5...G..\o5...j..j...K/..,o=y.-:..GU.j..N=>...-....fu..h..xq.j2...x...}..`+...v...'.i.(.E.........(...%,...-M....x.8..z..<+.vf...o....k.e...b.`..J..@..zt6aC..m..e.s,.;..w^..Z.N.]../g.....?G....E#^.5;.V...h..+R......aM".1..=hr..3.........V....iA.r.!._..K.~...}gW...%..0.c.Q50..K.W>.;.d.....2.........,L... F.&.8..x./...`..j.......Y..\|#.)......,Hf].Y..G.Itq..d..~.6N...=.'.5....../Os=......_.\|..w...5....`.D..:..4.Y5.RVl.I.I...&.f....E[.~...#A......?......5IW.......T.f...s..(.j...ZE6...I.-...6....^#O.<.j.k....k.....<..G.'..P..>C.dt...7/...>=u8.am\|.:....4.=.~.Y\|.N2.aV.F.4..{..9.Au]...9.Wm.Y....F....P5...:.c.F..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\mem8YaGs126MiZpBA-UFVZ0d[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 18160, version 1.1
Category:	downloaded
Size (bytes):	18160
Entropy (8bit):	7.961831708897042
Encrypted:	false
SSDEEP:	384:K9BQHZEFEbXlSNPoWvbYZbX9rnztP94u6pZ4nmrOmbSi+x:KLSb1GIbN76j4oO8j+x
MD5:	20890DE1FB4E49EA0B36F058BCA1B7E7
SHA1:	023D6720D92A54A3BB0AB219818D2E6E6AAD24A7
SHA-256:	C71180612EA84F5F9882D35DF024707E5B5E1BB18EFB2C8123FA5BDD30D3E079
SHA-512:	E6B921D20C0B7BFEA5A79D18D1C23DA7C79BB4E4D76A29AF48D7705C9C1F43E9E6578F1F36E00624DACD97411B68A214E750D0EDEB7BF12E889F16B6C522E1B0
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/opensans/v20/mem8YaGs126MiZpBA-UFVZ0d.woff
Preview:	wOFF......F.......j8........................GDEF................GPOS................GSUB.......y.....;..OS/2...$...^...`~]..cmap.............Y..cvt ...8...Y.....M..fpgm............~a..gasp...0...........#glyf...@..6...S.Ug:}head..>....6...6..cphhea..?$.......$....hmtx..?D..........[Xloca..Ad.........I.maxp..C,... ... ....name..CL........&:A.post..D<........5.".prep..F.........C...........................................x.M...P.@..L..$$. .g..;..k.z...P.$K......[.E..Z....B )..a.:...i...!......J ...U....l/..m.&3.KO...#..-..%;7.V..........x.c`f..8.....u..1...<.f...................A......5....1...A.._6..".-..L.....Ar,......3..(....x.\.!..q......#acf...#1Q@.'U..@..".llt.Aa#.f\|c.W.....'..X..!..C...ITPE.;..V.j......0. .L0E...Yd.mN....:.....F....GG.g.s,x.>0....v..I;o..<.$G9.\f2...e(}.IS2..uc]p.........M.x.c.a.g.c..$KY...e@.,.."..........?....%.g....Z.....(".o..Y..Bu342.e......0..........M=.....x.uTGw.F........)..)7.W.$`.....G.Kz.)e....t.\|.1.7...s.g...3.7mgf..~{1...s.3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\n4addendum[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text
Category:	downloaded
Size (bytes):	9069
Entropy (8bit):	5.275627378135868
Encrypted:	false
SSDEEP:	192:N9UpM0Zcsr6KJaw5Isk/APHTkd/UNt6+cFjwRHeI5etS+41aJt:N9A8S+4Q
MD5:	9193DCF176E055F1BA73D0BA880A5BE6
SHA1:	A4CED685B5F52599E97F3635E4BAC3F19CFDD816
SHA-256:	E46381F36EACE1CAA6CB42E08A44F737EEECE2245931A08FEB4CD66CF0E30A5E
SHA-512:	7E2EE6A90FD8930DA3D67E44EEE1B9D031AAA53888E4F13A01B477E6A39783634AA13EF70C5D6501C51229CB63EE909D980D4AD3F827E9B78BB3FBEF512326F4
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/n4addendum.css
Preview:	/. This is an N4 Standard style sheet addendum..* It should be rolled into the N4 std as soon as reasonable.. See Html document that describes the usage of this before modifying.. Copyright (c) 2003 by Navis Corp.. Written by Clay Newton, 2003. $Id: n4addendum.css,v 1.14 2008/03/05 06:21:55 uganesan Exp $./..select{. width:170px.}..select.grande{. width:320px;.}..select.med{. width:180px;.}..select.lrg{. width:247px;.}../ tabLink needs to work for other elements besides anchors */..tabLink.{..margin: 0px;..font-weight: bold;..color: #666666;..font-size: 11px;..font-family: verdana, arial,helvetica;..text-decoration: none;.}...loginTable{..font-weight: bold;..color: #666666;..font-size: 13px;..background-color:#EEEEDD;.}...loginSubmitRow{. height:40px;.}...stdTable{..width:500px;.}..tr.odd td.loginTable{ background-color:#E0E0E0 }...helpLink {. font-family:verdana,arial,helvetica;. color:#999;. font-size:10px;. text-decoration:none;. background-color:#

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\paging[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	998
Entropy (8bit):	4.481795950542114
Encrypted:	false
SSDEEP:	12:pKq/Rg2fAhcV3c8FgnfV4BYGyFwY1bsYi0wyNAX8x0ayRYiShOvZwX:phR/8k3ceK4qGyZ1xiVVa/ilRI
MD5:	8FC910B4FF3F6B16CAF939ACAF24E222
SHA1:	722860724F8C017681C750FB249D3842EBEBDCCC
SHA-256:	B6EB01B93296BDD43FFD38A39FFA6CF9A88F99DCF50A92518A8A26AD3C5B59BE
SHA-512:	52A50FD9AFF7C60BA09C640065C885E5397F5A0DDBED08D68D756824D0469D5F94B7741A392F7A8FE46A4A2527178A6A71AD5FD041E582B657DE7FC1423D01E5
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/paging.js
Preview:	function previousPage(fromIndex,itemsPerPage,querySize,urlParameters). {. var prevOffset = fromIndex - itemsPerPage;. if(prevOffset < 1). prevOffset = 1;. goToPage(prevOffset,querySize,urlParameters);. }. . . function nextPage(toIndex,querySize,urlParameters). {. var nextIndex = toIndex + 1;. goToPage(nextIndex,querySize,urlParameters);. }.. function goToPage(offset,querySize,urlParameters). {. // compose the url with the required query parameters to execute the query.. var url = composeQueryUrl(urlParameters);. url = addQueryParameter(url, 'offset', offset);. url = addQueryParameter(url, 'querySize', querySize);. window.location.href = url;. }...function composeQueryUrl(urlParameters). {. var url = getContext() + "displayReport.do?" + urlParameters ;. url = addQueryParameter(url, 'method', 'querySubmit');. return url;. }.. .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\playPauseLoadingControl[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	64464
Entropy (8bit):	5.411741687509476
Encrypted:	false
SSDEEP:	1536:awlNPuvF7vDht+kWXM76V4THGUoHsbk1p2:fupFpUMuV4TmUo8IY
MD5:	B4A57922FA85692DEDE8F7E483544872
SHA1:	40C6E148EC5F0259D4E2ECA8E6056746A3B29FF8
SHA-256:	EA16648CF37210A9CEBE707910FABA6EF51F94827B83AB12D1B692DA4A8DE1FF
SHA-512:	23B9211F3CBD172896AC36AE24D2D14026DE89A88B80EFDAED8FC8AEF210CAC718A824F4B467763D68B8F8E9920C572B7E77BB4171287519DA59C4E2D6C3A056
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/external/playPauseLoadingControl.js
Preview:	/****/ (function() { // webpackBootstrap./**/ .var __webpack_modules__ = ({..// 27:.// (function(module) {..function _typeof(obj){"@babel/helpers - typeof";return _typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function _typeof(obj){return typeof obj}:function _typeof(obj){return obj&&"function"==typeof Symbol&&obj.constructor===Symbol&&obj!==Symbol.prototype?"symbol":typeof obj},_typeof(obj)}/@license MIT-promiscuous-.Ruben Verborgh*/(function(func,obj){// Type checking utility function.function is(type,item){return _typeof(item)[0]==type}// Creates a promise, calling callback(resolve, reject), ignoring other parameters..function Promise(callback,handler){return handler=function pendingHandler(resolved,rejected,value,queue,then,i){// Case 1) handle a .then(resolved, rejected) call.if(queue=pendingHandler.q,resolved!=is)return Promise(function(resolve,reject){queue.push({p:this,r:resolve,j:reject,1:resolved,0:rejected})});// Case 2) handle a resolve o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\poweredbynavis[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 96 x 30
Category:	downloaded
Size (bytes):	840
Entropy (8bit):	7.620548433478473
Encrypted:	false
SSDEEP:	12:FPEHm/ODO78egyhlDgp5Spt3E16s1goQVvyBlluO2HprKoHWulRSCXxDNh:KHH9yhlDgp5SzEF1goXVuOEprDWupX17
MD5:	001B2FD09963257BCD14F6F70911A349
SHA1:	64F6A7E64A22AA066C5DF9964F09C0EFE7B69148
SHA-256:	FF29F424A854E8676B65241160D3074E64874D191A66E1428DBEC847627D241C
SHA-512:	453FE3D7782D94F01B42EE1B990E55F649338307FE53EB6D9D8327EBE08B29FF0EFD4F7CD61FE9DF0BCF448353232FCD012DA7E1A3D6E87FFADE5446FA0EE2A7
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/images/poweredbynavis.gif
Preview:	GIF89a`......v.LV\]..n.......lqs..:AC..........Y.$)13...!.......,....`........I..8...`(.d.%Lb.,{4.7,.....k..8@``.b....A..4..c!z\|$.Sc.....K-W.l8w..OH ......pN...2a~8.Q0\|\...I{[F.s..x.j@.6L...+.Vf\|K....J0/.z^xI.eu.:.n.....&s..P..:.J.../^..W..f..Id0.`...q%.sS[..........1...ti..O..[.I.z.......o.'.n..R.R...P.@.&....^.X E.....^.....H..99a....... f..,G....K.A..x.`MPJ.z...'. .,.`...B4D.2."..0X.`Y.4.S.BME........mvu.\.@l..bg.).d..$.MP...h.j.N..A.XMH.mb..\.)...L.+.-A.S..$.y....A..M...J.....m...(..[...Dj.N...l..+(H.xwo_.XG.......H>.Q....P'...\|.V.<......C.^X:.5-.p=....JS..w..@....P.S.g.qA...`h..c.:.^{.a....I.l. ..a..P!.K.P.s.&4..l.h....x.rw...x. .^Y.U0.H..`@b8:....FV..&...^4.8.t.i.QyRv@e....5..h.[k..Lu9.SS..c.w!pSm.Q..Q.,..e..U....."..Mh.x.C."......Y.`...Z...:'..b.....p.....I.......:*q.V..3.p..{B....;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\spacer[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/images/spacer.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\table[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3121
Entropy (8bit):	4.389319456372845
Encrypted:	false
SSDEEP:	48:BbslPatvs+f9j9+LgyoNtvJ5wqo1e+8xrGFuBtk5d:BbukpQLgFV5i8tGkBgd
MD5:	CD904863939CD75DAD1BFDB1A36A431B
SHA1:	32EC3B95BE42F6E0AC747F1478F75608B0644CA3
SHA-256:	B24D85405A28CBB6D6BABF95D9C1B23EAA054D2077925DD69B03D92C00A2DF9D
SHA-512:	29D3787C87613262E47D6C424AE493C7E088A71E39BDBD9A6ED1F8A95AE8AABE2EF19D77BAC5EEBC8407066B4B44F3DF1450B4D161F5859C809F17319C03C782
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/table.css
Preview:	/**********************************************************************/./ TABLE.CSS /./ Content tables are those use to display forms, reports or /./ lists of items. /./********************************************************************/../*********************** table globals *************************/./ Used for all content tables. /./********************************************************************/..tableTitleRow.{. background-color:#BBB;.}..tableTitleRow th.{. padding:0px;.}..tableTitle.{. color:#333;. font-weight:bold;. font-size:11px;. text-align:left;. padding:3px;. width:100%;.}..tableActions.{. white-space:nowrap;. padding:0px 3px;.}../************************* formTable ***************************/./** Used to contain and display forms.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tooltip[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1853
Entropy (8bit):	4.990032959746764
Encrypted:	false
SSDEEP:	48:m7FnbglVswTnbW3Xn00nydnb41V06wrnbWa:m7FbgkwTbW3X00ydb4RwrbWa
MD5:	9562D87852136AA9CF0D7253D07A4C1A
SHA1:	A591A0A83463B5EED951C547743CDEBFAD847827
SHA-256:	0C3EAC0FEFD876E244B82EF05E99C18351F5D0EB34A9175BDF93978CD9B41B24
SHA-512:	5AE32B60E7768E0C89309FB2D10306D11DBFC6B97AA469DDE57A935993E0A7A625F7CF290D8544D0BFC42B56D3D5FCE5C09EB9BBCFDA9F21AA2EE0D4FD35B6DB
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/tooltip.css
Preview:	/**********************************************************************/./ TOOLTIP.CSS /./ Controls appearance of application tooltips. /./********************************************************************/../************************** imports ****************************/./ Import any module css required by this css /./**********************************************************************/....tip.{..FILTER:progid:DXImageTransform.Microsoft.Alpha(style=0,opacity=90);..-moz-opacity:0.9;. .position:absolute;..top:1px;..left:1px;..background-color:#6DAD21;..padding:3px;..font-size:10px;..font-family:verdana,arial,sans-serif;..color:#FFFFFF;..display:block;..visibility:hidden;.}..tipPointer.{..FILTER:progid:DXImageTransform.Microsoft.Alpha(style=0,opacity=90);..-moz-opacity:0.9;..top:1px;..left:1px;..visibility:hidden;..position:absolute;.}..tipShadow.{. .FI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\web_1_people-success_404x262-1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 404 x 262, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	190122
Entropy (8bit):	7.983133695049005
Encrypted:	false
SSDEEP:	3072:BRnqzPt79NCz677WQKe/RQaRzIOpFqcag0OFZWo8X7bTsAsDq5JmCwNLZr7a2A6c:zqz1hNC05NkOpcwFZ38XLs76mmIbe
MD5:	E98EDCF663AF48E06AB87A6DD2E11CE9
SHA1:	0310D689C2E86A7A6F36E84417DC2530B9FA32BC
SHA-256:	716870A7BB5249E2CEDB19065D8FF0D2803D129EE959E397DC6A022EF80A0670
SHA-512:	C748D10B2F1C9BF2BFF2B6A4243221CF9173028FE7D77071620063D52DA885E32344A553494D298BDE5DA305AFF3B01CBF4B347A1EB909A975AB7032604BFAD0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/5b5e56663a8c418eb89e4d9c18910427/web_1_people-success_404x262-1.png
Preview:	.PNG........IHDR....................qIDATx...e.z'...ww.<'............!$JH..$.$F.FLa...?0E..P..&.\%..l?...f.{.;'O....@_t+b...9.l......j"bE\|...}_.....3.1F.!.._..Q.....T..u..f........B./d...7...g......4j.Y.z.;C..s../......;0.i..'{W..<.c=r.q...Z.\|o...b.Zl..\|...<p(.z.Bp{.p.j.#C7...9vO....4.1#.yz.......k.7...y....{.U...<aN.S.^....c.....^!..d.%j&.W..`0.....?7.....qo.k./w............\..al....ZmGx......s.......#.m...C.."r..._.....CD..^.OM..=7P...s.wZ......I}..U1...^....%p.8.5yW.....C..{rG.wh..0..B.3:..&5...\|.o.#b.$.>...l.m.....=...=......&V.......~.=M...s..\|Bx..v...<........~.=..NMo-....U....7.Q..m...........!.D.2.cD...}...".w.]9..^.. .N.c.;O.e."kmY.&.[;..D...V.....A....{%c.@.A.Y?.\|to.c...R..3=..b.t....kz...whq{n.....%..d....h.3...O>.!.....6....PsV.......1...`.N33 B.../..n.iX+......u..9j.k..."VE..lg...]....>_..F...:.;......a.}.p....}O.(<g...=.F3-..h.;'..d.!.&x.6K.y......`....q..P.{tn..)..^./@:&..K.....aC.Y..*...ll..Z.'..Wb^..y.k....`...b..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\43kvwrxr86[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5132
Entropy (8bit):	5.101838348485578
Encrypted:	false
SSDEEP:	96:f/ExB3xg5M6xJylRxuNCxZxXGx15xbex0dNTxN18jeEHL:nExB3xKxJAxuAxZxXGxLxqx0dNTxNur
MD5:	597308EBDCC626CEF01502759949F741
SHA1:	2DC11F91D553032423E88BCC2799A76F9B925189
SHA-256:	7B5DAB9170430BE31A28E797994CEADF7DBBB943E3168DADE597E425A70B6376
SHA-512:	CCF8119E3F765B9AF02B79CECC43836F699642FFD1773BC3F333B7FD9FA7063838E930D9B167D13A3405D7C9F751066A5885465FDCC7BF390300C88C39D454C8
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/embed/medias/43kvwrxr86.jsonp
Preview:	window['wistiajsonp-/embed/medias/43kvwrxr86.jsonp'] = {"media":{"assets":[{"type":"original","slug":"original","display_name":"Original file","details":{},"width":3840,"height":2160,"size":1963086513,"bitrate":78354,"public":true,"status":2,"progress":1.0,"url":"https://embed-ssl.wistia.com/deliveries/4cfb299bb410043f9e166e14f97e6b5f.bin","created_at":1559603811},{"type":"iphone_video","slug":"mp4_h264_1331k","display_name":"360p","details":{},"container":"mp4","codec":"h264","width":640,"height":360,"ext":"mp4","size":33343314,"bitrate":1331,"public":true,"status":2,"progress":1.0,"metadata":{"max_bitrate":287191,"average_bitrate":177479,"early_max_bitrate":382159},"url":"https://embed-ssl.wistia.com/deliveries/9d79ee9e658d4ffdb7b85db498e0f88abc1d9ed3.bin","created_at":1559603811,"segment_duration":3,"opt_vbitrate":1200},{"type":"mp4_video","slug":"mp4_h264_362k","display_name":"224p","details":{},"container":"mp4","codec":"h264","width":400,"height":224,"ext":"mp4","size":9069809,"b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\H7LQIMH5.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	237
Entropy (8bit):	5.218205340944087
Encrypted:	false
SSDEEP:	6:qT5BNImLRLwaHKGW3t+q2XRPD/5kuhdwBM+gqHaR/0MWXfGv:qTLNLxwMKGg8q2X9DxrdwBWNL8Gv
MD5:	E258C2BE0577848B4FF2643945FBCAE5
SHA1:	8C8B4CF592A89CA9A91CA03D5B9975360D8410B4
SHA-256:	23BD1825FA6B2FB2B6F7C24B78BD16061624D3904979CF9C617AB50E87EEF07E
SHA-512:	0BF9750C8935CDC64C7C5213597B74CAB70F1F9061D192A9CD055B862AC0597546D0B627BEEF356BAA5713C1F7867487695028A7C1C82B6A353D6857408A2224
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/
Preview:	<!doctype html public "-//w3c//dtd html 4.0 transitional//en">..<html>..<head>..<META HTTP-EQUIV="Refresh" CONTENT="0;..URL=http://webaccess.gaports.com/express/index.jsp">..<title>WebAccess</title>..</head>..<body>..</body>..</html>....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\JTURjIg1_i6t8kCHKm45_cJD3gnD-A[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23256, version 1.1
Category:	downloaded
Size (bytes):	23256
Entropy (8bit):	7.977753236160612
Encrypted:	false
SSDEEP:	384:2gMWysI22L2wL/yhGTJO87uvLzyBFvQ3dol9ET1Em9FOgBhkIkYaUpIJ8eQ0iUiJ:2gMWX12LvDyhF87GzUvSCjYD9FOgvsYl
MD5:	8DC95FAB9CF98D02CA8D76E97D3DFF60
SHA1:	FA51AFC9A31F67078FAA9124BEF881655DF4317B
SHA-256:	25F8F00A6FE95DED91A8E33E70154AEE1562760D0D969368D4BAD84BFE85F8D0
SHA-512:	992131CBE01D3DC13831557DD59368B6870BEE453D0C753A5814D001B11327DB60CDEB8D71E4B579E1A5C0238F08E07DF1267CB645738C96197C808E24443A4D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD-A.woff
Preview:	wOFF......Z........@........................GDEF.......G...X.g.^GPOS..........2....yGSUB.............,.OS/2...L...O...`S6.Mcmap..............h.cvt ...`...b.....:.Gfpgm.......F...mM$.\|gasp................glyf......2...[H.xz.head..Q....6...6.<.ehhea..Q.... ...$....hmtx..R........>....loca..T........(.J.-maxp..V8... ... .h.Zname..VX........)!Etpost..WD........D.z.prep..Z..........K..x.%....P......@:D...$.. ]!....h.....2/.$.....D.^.F..ua.].N....%>./...x...p[I...'=..3[.G._..........WpL....... `.#o.)g9g........2._=..==._.D@..x......o....~.....{..)N$.0.Q...M...?..OQ.X..xo.i..Z...s...n".hI.K.%.a...m..U..l.......6...s...6..<...Z....@myrT...q.${....@.Sl1.@.......N/...k=`?...X..3G$.Z.@=^WK.....c..[a..@[hG.T.I...jF...NVqB..V..+....(...7h.^.i.rB.k.`'{.>.W....B..B.n!.W.h.F.'.=a...r.@.....?.j..0...3....."?..s.....dW.1Ws..\+d.N........n....[h.V!.6!........+.._..".h.e.TV.....X%4.Zh.]hf.PO..g#.4~.0.2]w.u..".....$......-Q.%4...C....hf>........6"..A.)S.....dK...N...._X.G....3.....*.uA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\JTUSjIg1_i6t8kCHKm459WlhzQ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23480, version 1.1
Category:	downloaded
Size (bytes):	23480
Entropy (8bit):	7.981253427621622
Encrypted:	false
SSDEEP:	384:lEfDbJfERirQIhTVId2GTJO8Z84zUE8EW3md2T0LuYXDbMdK3OLmvTHc5qawV:lEf3JPrQI8d2F8WDE9w0FLTbMdK+Cvj3
MD5:	8102C4838F9E3D08DAD644290A9CB701
SHA1:	5AF1938D1327395F47C84E57B6BA7756234D2262
SHA-256:	60CEBEA4C9183F51FBD323F14DD729E18768BE4F6395467013216AE36526CF9C
SHA-512:	E8A0D6B72163E407DE82170E4560044CAE90116D1DD3CFA20F140E4379C8AABDC5BEAC6DD965D0E925CA673E41C42A858975C47F1F8152637958569D239E91FC
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhzQ.woff
Preview:	wOFF......[........8........................GDEF.......G...X.g.^GPOS..........2.....GSUB.............,.OS/2...\...N...`S..Ucmap..............h.cvt ...p...\..../R.Hfpgm.......F...mM$.\|gasp................glyf......3X..].,..$head..Rt...6...6.F.nhhea..R.... ...$....hmtx..R....%...>.x..loca..T........(..0maxp..W.... ... .h.Yname..W4........-5H.post..X$........D.z.prep..Z..........K..x.%....P......@:D...$.. ]!....h.....2/.$.....D.^.F..ua.].N....%>./...x..ut.I......e+..o...g.^..13333333333.-.e/.cgYAs....R.{.G..^.L......j.......R.z..D..o...~......$.`.BY.21.W.......9...f.C..(..M.!..D....1rT...w6cG.J....U.......]..>........q..jhT\l..;,M.zYK..x:.n.R...(........g)..~...Xl#`......-.#..T...]..Tw........k.7....I.....@..$..r....X.\..L......_.H.2".V... .1..."._d.#R..4c"...2> ..A..D;..e>".\|Tt.1..........8...._.K..+........Y~'r.A.....D.../..W..ob.....[.8K.8Gtq..0...\|....D.KE+.."..V.....\vr.._-.Se..=..A.1$...<.E.CL..%QB.8.9.....,.Jv.=,...%.i..:UV..U.b..]N.D..O..'...1.$.....<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\WebResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	28801
Entropy (8bit):	5.275368091249163
Encrypted:	false
SSDEEP:	768:OCFBkOQ3GMeQ1bI5exAMae4e9j8ZfopwJ:OCFBkOQ3G7ubIsxA0P9j8ZfX
MD5:	8C9ED695ADACBEC524B7426267349E0C
SHA1:	3B67271FC171CE88D04623221B82763585218D9F
SHA-256:	6F3270704B4C7C7A04573D79075DDF7EEBA886D50A9B033A1435B0FFC05F8765
SHA-512:	7DD818B0C95FE8DC73B5E490E2C2BED63B2E2DD813255C528E9B50AAA0A9C19F3E19D3DF4A83256E61561CEE0AE9247AF7BF688ED6C83DE2FA20251CCA919100
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/WebResource.axd?d=TzRGlCddaaqtz0Im2nSJhCRH4aTg4-avzaBJbXi4OnCnQ5NqPK_FNg0GCfj6vlwp1z-Z7_S3Vv8Haapc1VunMOvFKDdkqe0tiMt4Qr85W957vKJNmJCEqxVWX0MrMlCeaQGQ5ij00H7RXo2yCqyzTKjkekMnErQrTnKd2-NUpHE1&t=636540400180000000
Preview:	(function(n){if(typeof epi=="undefined"\|\|typeof epi.EPiServer=="undefined"\|\|typeof epi.EPiServer.Forms=="undefined"){console.error("Forms is not initialized correctly");return}if(typeof n=="undefined"){console.error("Forms cannot work without jQuery");return}var t=epi.EPiServer.Forms.Utils,i=epi.EPiServer.Forms.Data,r=epi.EPiServer.Forms.Extension,u=epi.EPiServer.Forms.Validation,f=epi.EPiServer.Forms.Navigation;epi.EPiServer.Forms.__DebounceTimer=null;epi.EPiServer.Forms.__Initialized=!(epi.EPiServer.Forms.__Initialized===undefined);n.extend(!0,epi.EPiServer.Forms,{Utils:{debounce:function(n,t){return function(){var i=this,r=arguments;clearTimeout(this.__DebounceTimer);this.__DebounceTimer=setTimeout(function(){n.apply(i,r)},t)}},loadExternalScriptOnDemand:function(n,t,i){for(var o=document.getElementsByTagName("head")[0],u=0,f=n.length,e=null,r;u<f;u++)e=n[u],r=document.createElement("script"),r.type="text/javascript",r.async=i\|\|!1,r.defer=i\|\|!1,r.src=e,o.appendChild(r),u===f-1&&this

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\a446ffaa267af444d29c503af3499302b74e39e9[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, frames 3
Category:	downloaded
Size (bytes):	323300
Entropy (8bit):	7.964679050501411
Encrypted:	false
SSDEEP:	6144:Owuvsj9NgHirbIza6aHmtn/ueF82iJa+idwfPjTOr6MfGZ5QnyaMMfGN:Ow5qwI26aHmtnGeF8GwfPnOGKLON
MD5:	3596295B38180C66E79146874B7FF4B7
SHA1:	2F093448351828A01E3552D1A3CE0E30B2ABC22E
SHA-256:	F17A655513BE24B5C3A17F0B158C40AADBE7539BB6EF31B6B9B8C8B91E4A8F1C
SHA-512:	A7F1D6153EF330874DCDB09166860A62E680C544E4316067F3F3FDA6F387383770C38D4EE9300AC10266385AD17E6BEAA8F116453996E7C5565427C717C94600
Malicious:	false
Reputation:	low
IE Cache URL:	https://embed-fastly.wistia.com/deliveries/a446ffaa267af444d29c503af3499302b74e39e9.jpg?image_crop_resized=1280x720
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.... .s....u.=.\|......U...~.~vD.E.fi.....F.x.R......kr.....NU..\......ibVH8........u5+.0.q..S..:.(.i..R0....N.L7....FO..h#.Q...wjAn.....O.I0..".#.6.....]m.N.#..V...ri.,F:....f@....pQ.^{`..1....F.....f.(.R).5S.ZE...h0.....}...XO..;S.l....Z...@!Ga....1..Tg..R..0.......z.K.s.."....h.l..h.^gr4B.q.H.....-...r....h)+nF.....i.w..T....X.;.X...{..I".N9.*H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\a446ffaa267af444d29c503af3499302b74e39e9[2].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x360, frames 3
Category:	downloaded
Size (bytes):	105053
Entropy (8bit):	7.9601578760335565
Encrypted:	false
SSDEEP:	3072:WRqB7KyJWEbwxPqzpssujBvky2pdPVH/PwB:6qRW/lI+BvER3wB
MD5:	812F7661A19420148974BA4ADCEE4669
SHA1:	327648987825B056ACC9A2C921D6D761B7242718
SHA-256:	079AA2221F9A201B6CB9F46EA3C3111377B5C68B7AE0FE5A84FA952D0B4BF5BA
SHA-512:	25527B96C1D7F09BF0FA70D3E7A6D09B2ED9A1E41C85B023C4E88DC01F987B88837FB7114978363BCDD32A6F99066E86A0EEC84A88491131E9D0319B78E7E21C
Malicious:	false
Reputation:	low
IE Cache URL:	https://embed-fastly.wistia.com/deliveries/a446ffaa267af444d29c503af3499302b74e39e9.jpg?image_crop_resized=640x360
Preview:	......JFIF.............C....................................................................C.......................................................................h...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....`.....=T.=.h.08.sS-.=1.W..I....Qa.`....%...m`.d......QEa. ..>."..#...;2.G.i~...d.4....A...OAL6.pv.=...Kr;T..8...1M;.Y..(.uq..=...^..@\|.......c.y.....e.$.,;.<...].......=`.0s@Z.... .g..........n@..).n.2.....Q-...O.H...^..V....Jz[..y.......S.._.`O.....A^.e.@.m.NM&.&.F8K....w..`U..@...s.=-....K.M.QK0.t...(..Z>G..r....;...G0%'...a.q.L..:.J.-.=)M.F.jM.j.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\animate[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	25427
Entropy (8bit):	4.912353770243002
Encrypted:	false
SSDEEP:	192:uNavX0fZtAXf4j3GQ20de0te8H9nlNApz81cV+DVa/ndCJZZPd3WKmj4CYPyNpu6:ujf4qGc0QsFtdk0j3qOkS
MD5:	1C7AD0A97D2DC2DA70B8D855AE946CAE
SHA1:	7F3596852663437B7F89231CC750628A0D86E403
SHA-256:	CB09AB0572C6A6549A782E2843218C00285CB737AE50FE29A5061CA96AFF0234
SHA-512:	C8A8A7FD2FB0793981FAA0CD80ED876B58E0959784662360CC65B523F88D0A3C25067C00F3DB353D2D432013C4D2B9A81CFD42E41AABA0FEFC9581598883C958
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/content/css/animate.css
Preview:	@charset "UTF-8";..../!.. animate.css -http://daneden.me/animate.. * Version - 3.5.2.. * Licensed under the MIT license - http://opensource.org/licenses/MIT.. .. Copyright (c) 2017 Daniel Eden.. */.....animated {.. animation-duration: 1s;.. animation-fill-mode: both;..}.....animated.infinite {.. animation-iteration-count: infinite;..}.....animated.hinge {.. animation-duration: 2s;..}.....animated.flipOutX,...animated.flipOutY,...animated.bounceIn,...animated.bounceOut {.. animation-duration: .75s;..}....@keyframes bounce {.. from, 20%, 53%, 80%, to {.. animation-timing-function: cubic-bezier(0.215, 0.610, 0.355, 1.000);.. transform: translate3d(0,0,0);.. }.... 40%, 43% {.. animation-timing-function: cubic-bezier(0.755, 0.050, 0.855, 0.060);.. transform: translate3d(0, -30px, 0);.. }.... 70% {.. animation-timing-function: cubic-bezier(0.755, 0.050, 0.855, 0.060);.. transform: translate3d(0, -15px, 0);.. }.... 90% {.. transform: translate3d(0,-4px,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\autocomplete[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	21234
Entropy (8bit):	5.05334159162696
Encrypted:	false
SSDEEP:	384:ij2pH0WUucrAKRwvuil9JDaPSKeFCBcviPhixbgAUkaUpEOnY0HEu:ig0XucrMpJDaPSKeYPoRgFSPnY0HX
MD5:	4FE758327035EDBCC04974E861924924
SHA1:	CF79C079F04031CDF833CC9DA29EFA00E956F984
SHA-256:	80D5649CE6635E1CCC16EF6E4B5EFA1C3B970557120BCEDC9DB5B49229128760
SHA-512:	2AA65CD91FC344E89AB0B367A88812A1ED392FA14DAEEBD3BBF22B97486087C627284A5BAB96931D2DD707F65180D4F763330B8C607B9344FE5D664F9B1A52E6
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/autocomplete.js
Preview:	/. @(#)autocomplete.js $Revision: 1.6.2.3 $ $Date: 2011/04/29 04:13:04 $.. Copyright Navis Corporation 2003.* All Rights Reserved.. Confidential Information of Navis Corporation.* Unauthorized use is strictly prohibited.. This work contains valuable confidential proprietary trade secret.* information of Navis Corporation and is protected by specific.* agreements and federal copyright. This work or any part thereof.* may not be disclosed, transmitted, copied, or reproduced in any.* form or medium without prior written authorization from Navis.* Corporation../../.* autocomplete implements the LOV class of object used in N4 in the..place of the standard select box...* @version $Revision: 1.6.2.3 $ $Date: 2011/04/29 04:13:04 $.* @author: Darren Luvaas./../*********************************************************************/./ Used by form inputs to autocomplete data entry by loading /./ strings from an associated <select> input. **/./

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\bootstrap-switch.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	5614
Entropy (8bit):	4.730153182629456
Encrypted:	false
SSDEEP:	96:3hJLz0WjHUcmWjuqWUxNT0OFWnEIvJlI8+8ATb3Wa+PzPJAE0gFNoKo4vRCPn+La:Rxzb7IWKa+bxAmJQnAxF2DRc/q
MD5:	D1B6128D901BAEF2780DCB9C6E6FF51A
SHA1:	F743588E28CA4797824BEB4421EC228711AE6DA6
SHA-256:	20764FDA67E653BEEDC4A141C991816D36FA0EDA395D61AF75CE27027B23E5C7
SHA-512:	15D8BF0C6F62F04ECE0C86A5A1A81276292826460EF9E5770EE7CE67F91A5DC0B9C4AECE5C48000857C51F743F00EBB308A06B3BB2B1514980381620B5C64D68
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/bootstrap-switch-master/css/bootstrap3/bootstrap-switch.min.css
Preview:	/*.. bootstrap-switch - Turn checkboxes and radio buttons into toggle switches... .. @version v3.3.5.. * @homepage https://bttstrp.github.io/bootstrap-switch.. * @author Mattia Larentis <mattia@larentis.eu> (http://larentis.eu).. * @license MIT.. */.....bootstrap-switch{display:inline-block;direction:ltr;cursor:pointer;border-radius:4px;border:1px solid #ccc;position:relative;text-align:left;overflow:hidden;line-height:8px;z-index:0;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;vertical-align:middle;-webkit-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;-o-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s}.bootstrap-switch .bootstrap-switch-container{display:inline-block;top:0;border-radius:4px;-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}.bootstrap-switch .bootstrap-switch-handle-off,.bootstrap-switch .bo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\brightedge3[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUXJ/l45:Da5
MD5:	55D25E9DC950D5DB4D53A3B195C046C6
SHA1:	75E91AE3E549DAB12ED1C9787ADE9131AEF1C981
SHA-256:	A0D3A0AFF7DC3BF32D2176FC3DCDA6E7ABA2867C4F4D1F7AF6355D2CFC6C44F8
SHA-512:	E508D5D17E94D14B126164082342A9CA4774F404E87A3DD56C26812493EE18D9C3D6DAACCA979134A94A003066ACA24116DE874596D00D1E52130C1283D54209
Malicious:	false
Reputation:	low
IE Cache URL:	https://a.b0e8.com/brightedge3.php?id=f00000000202132&p_id=862N4884L884R46A4N88PR8A8AAAAAAAAH&bf=e678d92c50ddc5329c0e32efd32864f2&url=https%3A//www.navis.com/&ref=&bn=1&bv=3.43&title=Navis&metadesc=Navis%2C%20a%20part%20of%20Cargotec%20Corporation%2C%20is%20a%20provider%20of%20operational%20technologies%20and%20services%20that%20unlock%20greater%20performance%20and%20efficiency%20for%20the%20world%u2019s%20leading%20organizations%20across%20the%20shipping%20supply%20chain.%20Navis%20combines%20industry%20best%20practices%20wit&metakeywords=tos%2C%20terminal%20operating%20system%2C%20software%2C%20vessel%20performance%2C%20n4%2C%20macs3%2C%20bluetracker%2C%20stowman%2C%20tos%2C%20terminal%20operating%20software%2C%20terminal%20software%2C%20supply%20chain%2C%20container%20terminal%20planning%2C%20logistics%2C%20terminal%20operating%20system%2C%20n4%2C%20Get%20More%20N4%2C%20Get%20More%20&s_id=862N4884L884RP8446L8PR8A8AAAAAAAAH
Preview:	GIF89a.......,.................D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\browserSniff[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	15400
Entropy (8bit):	4.865798690069456
Encrypted:	false
SSDEEP:	384:wSI5ZU+hn7vayhcncZhFtPksve0O7Xaz8DgUfz:QU+R2ScncZhFtPksTO2zCnb
MD5:	B565005A4FF0B8BD2B0B686D07C2D812
SHA1:	E90D083AE0689E8FDA7E9FFAFAF2A0A2E1700E54
SHA-256:	B3B090E2B5ED092EC7A186DB6AC9841B5CE32368835DE56206A84DBAD3E8EAC6
SHA-512:	5BB48CB1EE7F131F25B8DFCA0623790AE3BA4DFF6659F038525FB0DBAD9CDFEDA17958076973E58AB65B24CA44C77C31F27EB1CA59EB183F5ABF3650FC0DB57B
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/browserSniff.js
Preview:	// Ultimate client-side JavaScript client sniff. Version 4.02.// based upon: Ultimate client-side JavaScript client sniff. Version 3.03.// (C) Netscape Communications 1999-2001. Permission granted to reuse and distribute..// Revised 17 May 99 to add is.nav5up and is.ie5up (see below)..// Revised 21 Nov 00 to add is.gecko and is.ie5_5 Also Changed is.nav5 and is.nav5up to is.nav6 and is.nav6up.// Revised 22 Feb 01 to correct Javascript Detection for IE 5.x, Opera 4, .// correct Opera 5 detection.// add support for winME and win2k.// synch with browser-type-oo.js.// add is.aol5, is.aol6.// Revised 26 Mar 01 to correct Opera detection.// Revised 02 Oct 01 to add IE6 detection.// Revised 08 Oct 02 by Tim Dobbelaere (http://tim.dobbelaere.com).// to add WinXP (is.winxp), Windows.NET (is.windotnet).// correct Mozilla & Netscape browser/user distiction <<< use user d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\common[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5576
Entropy (8bit):	4.491397305963433
Encrypted:	false
SSDEEP:	96:tWYfgyjVfn1H41WQhlZ06JJDu6lEJllWF7nXFPQwFwt:tgCpchlGAduKErlyXFPQME
MD5:	E934016F9E4AE4D43A1C314A612CCEE9
SHA1:	EFD5F184A9B9CDC61E513CECA5A61DCAE99CFFC0
SHA-256:	F6C2EE7FFA0D7602377975AD037180BFEABF4D32B43944462F43054076289EB3
SHA-512:	2979669746E6E89CB7B26425F77369B67A02C1F67D1E26EB9188AD3DEA1E145DD8E5B9D179FCC83997CB8FCE0460FEBE6F539FF0F3EE7B5AB00871431A5AD13A
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/common.js
Preview:	/**********************************************************************/./ This script contains utility functions called by many other /./ functions throughout the application. /./ /./********************************************************************/./ /./ This file depends upon the following JavaScript files: /./ -browserSniff.js /./ /./********************************************************************/../********************************************************************/./ Locate objects in the DOM. /./**********************************************************************/..function findObj(myId).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	5.2420083994729145
Encrypted:	false
SSDEEP:	24:55OOYN+H+5OOYsb5OOYXa85OOYUTe5OOYN7FMOYsl:nOOW+HEOOLVOOgauOOxTkOOCGOLl
MD5:	9CE0002D9F8D0BFAF667E6F797B7B881
SHA1:	51028A5CA30EE731BF83C07ED5C256B7BD17E5F2
SHA-256:	D3C0906E7609269C73574CF5991BA3D06B8FE848D7BDE74B620AE25C49EE8259
SHA-512:	4847B525B695C73DA1B4D74EA64E9E85ABF2B487A3F560358FF5435C23F4D7CBA2996560AB5B86AF6C0082B8611A37D663F1EA73A6AFC51B240575B0E2703494
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_cJD3gnD-A.woff) format('woff');.}.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459WlhzQ.woff) format('woff');.}.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 500;. src: url(https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD-A.woff) format('woff');.}.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_bZF3gnD-A.woff) format('woff');.}.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_dJE3gnD-A.woff) format('woff');.}.@font-face {. font-family: 'Open Sans'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\email-decode.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1239
Entropy (8bit):	5.068464054671174
Encrypted:	false
SSDEEP:	24:ch63Cf5W8QPIHRZ3hwVFS39bYGwNef1yTZsNUkQ1sZmSuLqNWRco5Jcn5IKM6cuY:C6SQnw/x+SR8ZZkQbp1RZ5JwiKMm7Zc
MD5:	9E8F56E8E1806253BA01A95CFC3D392C
SHA1:	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728
SHA-256:	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
SHA-512:	63F0F6F94FBABADC3F774CCAA6A401696E8A7651A074BC077D214F91DA080B36714FD799EB40FED64154972008E34FC733D6EE314AC675727B37B58FFBEBEBEE
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Preview:	!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href")\|\|""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\find[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	5993
Entropy (8bit):	5.393428277547384
Encrypted:	false
SSDEEP:	96:2jW0N3qYl7oTNWp+uciVr6GS+TaPfIm6P3aEjwnItSK/LIx:Mb8ucidW+TifIm6P3vjwcSK/LIx
MD5:	90DE0B17536023316CA9F8D5895F0571
SHA1:	EF351E6F5B8EB9C3BE434A32CE1B10C60A51CA82
SHA-256:	C74FBF06FBC387F21C3DDE88CFDB524DBFDF7C65892353943680275334C77BC0
SHA-512:	88389FC1706B46763C056DCA94CD7E3C5DAD885CBB2331667D5CB5484D98FC05A760C2E12FF842BEC90E7645BCC044CA09146691CBB3B2C2A8C5C6974318F6BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://dl.episerver.net/13.4.4.1/epi-util/find.js
Preview:	function FindApi(){this._applicationUrl="/",this._serviceApiBaseUrl="",this._trackId="",this._trackParam="_t_",this._dontTrackQueryParam="_t_dtq",this._allowTrackingCookieName=null,this._bufferTrackRequest=!0,this.setApplicationUrl=function(t){this._applicationUrl=t},this.setServiceApiBaseUrl=function(t){this._serviceApiBaseUrl=t},this.setAllowTrackingCookieName=function(t){this._allowTrackingCookieName=t},this.setTrackParam=function(t){this._trackParam=t},this.setDontTrackQueryParam=function(t){this._dontTrackQueryParam=t},this.bindWindowEvents=function(){var t=this;window.history&&(window.onbeforeunload=function(){var e=document.location.href;e.indexOf("q=")>0&&-1==e.indexOf(t._dontTrackQueryParam+"=")&&window.history.replaceState(window.history.state,window.document.title,e+(e.indexOf("?")>0?"&":"?")+t._dontTrackQueryParam+"=true")}),window.addEventListener("load",function(){var e=t._toArray(document.getElementsByTagName("A")),r=document.createElement("A");r.href=document.location.h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\font[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	833
Entropy (8bit):	4.283738169022541
Encrypted:	false
SSDEEP:	12:UMaii3iJ45wLcTJcph1eVxdCxS9QyZ/TbsNhPw/dc9f18te9f18tt:Am6TSqyS9QETchPwK9f1Z9f1G
MD5:	03453ED3B55645BDACBFE4B8DBCD37F6
SHA1:	EB0E1D4CC985C8645416471F037ED474604615B7
SHA-256:	25903575FE4DD927B0A1E46E1D67F13618BAF9BFB6DBA1CA373FA0D55E93B160
SHA-512:	774BEA8DD0A5C08AA830226C85A42672CD166B75A68194F365EFB15F28B012A0D27CC5AA61EC1DC2177647F7D17EF125ADD30F410724C78A9C8C96E3953D4B2E
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/font.css
Preview:	/**********************************************************************/./ FONT.CSS /./ Controls the appearance of all fonts used in the application. /./ All pages should call this file. /./**********************************************************************/..body, td, p, li, input, textarea, a, button, option, select.{. font-size:11px;. font-weight:normal;. font-style:normal;. font-family:verdana,arial,sans-serif;. color:#333;.}..error.{. color:#cc0000;. font-weight:bold;.}..warning.{. color:#996600;. font-weight:bold;.}.h1.{. color:#333;. font-size:12px;. font-weight:bold;. margin:0px;.}.h2.{. color:#333;. font-size:12px;. font-weight:bold;. margin:0px;.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\form[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CR line terminators
Category:	downloaded
Size (bytes):	1113
Entropy (8bit):	4.712564132482775
Encrypted:	false
SSDEEP:	24:uFd+/SuxPSQ3FnvW4Q6gV1glB6j1ALcbxoqMeoua9uzd5TnqTBFPy:uFd+/SESQ3FnvWn5V1gz/Iaqfoua9uxJ
MD5:	758D0E2D8655E37AE92D30D0E7B9DAF2
SHA1:	A1F9E64192B440151571A5EBB2C0AB1D2E539B4E
SHA-256:	A5BFF6D7C540DFF4E548DC0002CA53B7692A73A28592CCA471F436B404EEFCA5
SHA-512:	7CF77AC0817542F3ECEEA41FD98C0E4C9EFF57598EEEE3E83D4F2D0ADD8DC61660660CAE95C1D0CD693D66032E2488479AD393BC51B1692D7556B2554D99707B
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/modules/form.css
Preview:	/**********************************************************************/./ FORM.CSS /./ Controls the appearance of form elements. /./**********************************************************************/.form.{. margin:0px;.}..txtInput.{. width:100%;. background-color:#F9F9F9;. vertical-align:middle;.}..textArea.{. width:100%;. background-color:#F9F9F9;.}..lov.{. display:none;. position:absolute;. top:0px;. left:1px;. FILTER:progid:DXImageTransform.Microsoft.Alpha(style=0,opacity=80);. -moz-opacity:0.8;. background-color: #EDEDED;. z-index:1000;. border-right: 1px solid #000;. border-bottom: 1px solid #000;. overflow:auto;.}.select.lov option.{. color:#000;.}..inputWidget.{. vertical-align:middle;. border:none;. margin:none;.}..disabled.{. background-color:#E4E4E4;.}..inputError.{. background-color:#CC0000;. color:#FFF;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\globalEvents[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3702
Entropy (8bit):	4.715541521109457
Encrypted:	false
SSDEEP:	48:fFiaRwO+XvX3WCrLa7W1L2AYVKfo1FU6MVpaWc8lm19845tjtXMR0QWw:fFmvX3WCrSx82w
MD5:	6D023FDC78B62260752B193E0779AFD6
SHA1:	5422E841ABFFDE835239BB6C109B981DA97C199B
SHA-256:	DE5C1D359F25B404AF281462830B54AEAB6D7065042ED5C5172AEC8661363C3F
SHA-512:	BEAA00E7237938AC54F40571D45F788C907FAB8DD4096720E6F1EA93715EB31E59B1B81160BCFB428813EDF15BFC946CADD5441EB5C606C209EEABDD9D341578
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/javascript/globalEvents.js
Preview:	/. @(#)globalEvents.js $Revision: 1.9 $ $Date: 2006/12/04 04:55:01 $.. Copyright Navis Corporation 2003.* All Rights Reserved.. Confidential Information of Navis Corporation.* Unauthorized use is strictly prohibited.. This work contains valuable confidential proprietary trade secret.* information of Navis Corporation and is protected by specific.* agreements and federal copyright. This work or any part thereof.* may not be disclosed, transmitted, copied, or reproduced in any.* form or medium without prior written authorization from Navis.* Corporation../../*********************************************************************/./ The following script is used to contain page-level event /./ bindings. /./ /./********************************************************************/./**

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	90553
Entropy (8bit):	5.51511660620421
Encrypted:	false
SSDEEP:	1536:9FgZsqyPmSN0MS5+HqWJvOwFEdDvFhJis0R4JEH1U9FKPm1Z9LpC+oZTUw:9qZs5eM0wBp1kEd+Dw
MD5:	0E5147522065997B229B2A64AC38D4E4
SHA1:	10D9A2ED9886A96F521C9E765E1AA91667ECEC9D
SHA-256:	0709F0746C79A0F71AA081F284C713A68E596A1F11DDFEBDB03DE6AAB10695AA
SHA-512:	4D6FAB87758352C74D2ACD6A0DCE7B32644D02B54A7B9CE7C982AC658FA60C9DB07F11A9F1E68C967F972844736FA3327DA4AACE3EC7865A489F17F73AE4FA91
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-MJV6S56
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"3",. . "macros":[{. "function":"__e". },{. "function":"__gas",. "vtp_cookieDomain":"auto",. "vtp_doubleClick":false,. "vtp_setTrackerName":false,. "vtp_useDebugVersion":false,. "vtp_useHashAutoLink":false,. "vtp_decorateFormsAutoLink":false,. "vtp_enableLinkId":false,. "vtp_enableEcommerce":false,. "vtp_trackingId":"UA-42962273-1",. "vtp_enableRecaptchaOption":false,. "vtp_enableUaRlsa":false,. "vtp_enableUseInternalVersion":false. },{. "function":"__v",. "vtp_name":"gtm.triggers",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":true,. "vtp_defaultValue":"". },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__u",. "vtp_component":"PATH",. "vtp_enabl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\icon_Optimization1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1000 x 839, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	8352
Entropy (8bit):	7.50820391396626
Encrypted:	false
SSDEEP:	96:VRxPhNOCT6pU+GMBa5FvIiAn3b76COzttOdiBDkmS6Wf0qReuHYbbbFssqfxBWq0:nxkK+FByvGn3zOJAcSiOPrf3HF1K
MD5:	E43EC949B7538A49B180532C547770E5
SHA1:	27C4260722C0722429755B48D54BD82007B5CCCE
SHA-256:	E546C70F6F91EBE3A2789594F0BCED439FB23BA6FF80158EB6EF81C78C191426
SHA-512:	DFC19B9AC86639875EB233486BC0DEF327E4EBB9ACB39E7D9963459040B385CA1AF588D25BB31DEC2D4059936EF02E28B67BD1482F7008A39C9244720D750EA2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/images/icon_Optimization1.png
Preview:	.PNG........IHDR.......G.......T.. gIDATx...m......J..$ !....$......H@B$ a......._.........~.._`.~................................................................................................................................................................................................?..ktq....gt.E.......3..5....[.....K.3.......G.O.w.{.U..`.......E#....3.%......9.f......x.....'...$.....u....?O.~:....{lap....y.p.<..{+...F._.-......K:.,..>..t.X,...[..`...bO.Kl.0?.m..)..0/.M..?..........}.;...\....A."..I...._#'......7........=?......>D~<G..I9.D..u..IA.F..G...9o..8.gt.~..}..]..`l...8...8E7..q.0:...m....w/...6A..<.....u.../j..Q9?...#......`0"....[rl_cc;.]z......O.Ox.;..Io$...Om...nJhg\|V\|+...}j...'>sN~%.......x..?..+..p..~J.ezf...F......}.K..8_.....=..........t...%.~.t.X'...>.%.#l\|':....F../......}.$.A.......y.=.ce\|.;....s...3.@.,...}j...~1<N...r..cb.F.Q..M........7.k&}V......I..J...s.a8G..`R..g..yz..._......c.!..F.3...5.........>D......~.2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\logo_48[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\main[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1732
Entropy (8bit):	4.157363498082571
Encrypted:	false
SSDEEP:	12:UMvKiahelxtYjbEdhpG0roIZBQCjRJIPyfWMyhn13ws5mRGOoLWEiJv8uJ+kEpar:RK7wlxtLB2PyYD5mRGOowJ5Ep0xNG2HB
MD5:	7C943FBDEB188A9D13D2616DD7CCC784
SHA1:	AAC8C2685CAF5EDA4E68DC944C16C8FE33FB81BE
SHA-256:	745843BEED43B2062F3BF779BEA14BCE257DCEB178CEDA547D19E2423147CABB
SHA-512:	D65D634E065ADB1CD779E51D3BE5BF71B054C039F952872103F61F70DD98D38E57519B26B05564E418EE2C1D49EF7C2C7A7091097B2E36DA0CAFEB8CD0326959
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/css/main.css
Preview:	/**********************************************************************/./ MAIN.CSS /./ This is the primary CSS file, used by all pages that appear /./ in the main application window. /./********************************************************************/../************************** imports ****************************/./ Import all the modular stylesheets used by main content pages. /./ Do not change the order of these imports. /./**********************************************************************/.@import url("modules/font.css");.@import url("modules/menu.css");.@import url("modules/actionbar.css");.@import url("modules/tooltip.css");.@import url("modules/content.css");.@import url("modules/navPane.css");.@import url("modules/button.css");.@import url("modules/table.css");.@import url("modules/form.css");.@import ur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	8522
Entropy (8bit):	4.723047001435356
Encrypted:	false
SSDEEP:	96:rZJVfA+p6BqmyTQZ2VKAsuqIRajnYsTLrVfU44lTdEG+nAyesRjiJjC5qo:rZTfMBeQhV4lTi991iIco
MD5:	E9726BE670758E3E481BE90A10FA4E6E
SHA1:	73D54040492EB3051C8B5C537C7DF3720768E8E7
SHA-256:	B58210709468C2DD80BF7C8DBD783A4459A9B83249972718E44C2F4299EDF1DE
SHA-512:	8C9945C925643494EEC1BA563033BA5D58CA2DD073B5BF4DE2FC2C3DC9FABE6571C989B6158ACDA64BFD5A2533B3A29A65C5BEB2F5B80C6DDFDB0BDA65EDFBFD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/Content/js/main.js?v=1
Preview:	.function wowJS() {.. var wow = new WOW({.. offset: 50,.. mobile: true.. });.. wow.init();..}..//function isOnScreen() {..$.fn.isOnScreen = function () {.. var win = $(window);.. var viewport = {.. top: win.scrollTop(),.. left: win.scrollLeft().. };.. viewport.right = viewport.left + win.width();.. viewport.bottom = viewport.top + win.height();.. var bounds = this.offset();.. bounds.right = bounds.left + this.outerWidth();.. bounds.bottom = bounds.top + this.outerHeight();.. return !(viewport.right < bounds.left \|\| viewport.left > bounds.right \|\| viewport.bottom < bounds.top \|\| viewport.top > bounds.bottom);..};....function spetCounter() {.. $('.stat-number').each(function () {.. $(this).prop('counter', 0).animate({.. counter: $(this).text().. }, {.. duration: 4000,.. easing: 'swing',.. step: function (now) {.. $(this).text(Math.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\mega_promo_ncc_2[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 370x300, frames 3
Category:	downloaded
Size (bytes):	7032
Entropy (8bit):	7.702852448750285
Encrypted:	false
SSDEEP:	192:lNorq0VhWLoZ2tNy2aygsTTTPz8DwIdTTT67uTg+ZJS:fCTs7Lyygk77uT/U
MD5:	B862067F563147AFFB5D6AA3E2CF7CE9
SHA1:	0967501AC3E33FDBC24BC00AEF157C9B03148A5F
SHA-256:	22AE71C4F073FD9E57DEC0AD4CE22207C6B471FD84071ED2CA76C872F933C4B3
SHA-512:	FAA0F932380F458ED4A28D7016A5A8EE4612D988384CDE30F370196971E93B2609E3615CF3B6409C6E4AD0F1429ACC0F9ED272F290D83F71757BD88C1808C06B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.navis.com/contentassets/2f2def53d86e4a40ae3ccfbe5d77752e/mega_promo_ncc_2.jpg
Preview:	......JFIF.............C..............................................!........."$".$.......C.......................................................................,.r.."...................................................................................[....[....[....[....[....[....[....[....[....[....._.`...................M.M.`...................M.M.`...................M.M.`...................M.M.`........t<.....%.......<S...1........7I6M.J.&.........O...../.#.>..>..u.\|.L..y}}=.>L...N..7.G....t.....$.6.+h.`..:.pGX.vf....}.N..#.^=j.c./.yg.O.S.}\|.\|....(j.b.~f..[o..~...c..g"_@...&.&.i[D..........o...sy....%.f.G.y.s.j.W..T\|.......X..Vc..x....+ ...k.....nt..M.M.`........O......C>...I}wq.O...........j....?`9.......:......&..m.l............/'n...c.....nS...C...}...(9...y..p....&.&.i[D.....$k..E..... j]B.l...m.o....=/.s...%..`w}"R..t...7I6M.J.&......I.J...,{...5mDN...L[S.w3...[...~.#.\|...]....p........&..m.l...................&..m.l...................&..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\popover[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	206394
Entropy (8bit):	5.422456540358311
Encrypted:	false
SSDEEP:	3072:NNAZHcg6CxtQUOdU56giGeFsn/VOkGnROYlauLL5:NSZ8g6+tQJUjHGnRd
MD5:	D4C39BC2B87048814EDB117FB750C1E0
SHA1:	2E3FC9BBA4129DF860FDB40BD4B5365BEE4BFEAA
SHA-256:	1FD438A3754C24ABC775D24C2F4656A80C340823E9E0B63F6E249652DDBEF377
SHA-512:	E39391BBCDC76B26E87B8DE8AC07A1C334B885A3804AC0C0F559E5A9E076A5B7A2AF3E6E40F9CB1FD9A3046D61126D5626A756EDA7AE144449202A1303B8EBBF
Malicious:	false
Reputation:	low
IE Cache URL:	https://fast.wistia.com/assets/external/popover.js
Preview:	/****/ (function() { // webpackBootstrap./**/ .var __webpack_modules__ = ({..// 27:.// (function(module) {..function _typeof(obj){"@babel/helpers - typeof";return _typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function _typeof(obj){return typeof obj}:function _typeof(obj){return obj&&"function"==typeof Symbol&&obj.constructor===Symbol&&obj!==Symbol.prototype?"symbol":typeof obj},_typeof(obj)}/@license MIT-promiscuous-.Ruben Verborgh*/(function(func,obj){// Type checking utility function.function is(type,item){return _typeof(item)[0]==type}// Creates a promise, calling callback(resolve, reject), ignoring other parameters..function Promise(callback,handler){return handler=function pendingHandler(resolved,rejected,value,queue,then,i){// Case 1) handle a .then(resolved, rejected) call.if(queue=pendingHandler.q,resolved!=is)return Promise(function(resolve,reject){queue.push({p:this,r:resolve,j:reject,1:resolved,0:rejected})});// Case 2) handle a resolve o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\popupWindow[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2361
Entropy (8bit):	4.623752167774135
Encrypted:	false
SSDEEP:	24:WzOHXWqMnn3Ttr58ouZzoWdco3V5SwFik0aoCao3V/lsfyG3pk0aoCao3V/lsflx:WzO3WqMn3rEdiwFmg7G3Pg6x
MD5:	7D56837100E6A814BAD710C290958F9E
SHA1:	01A2E84EC66A1547EF09BB304F59794F7FA58099
SHA-256:	00D5D0E15A9FD37611A796DD5B3F73D9114F0C20BFE18458C3D3560434DDAB13
SHA-512:	C4356B8A60D8839C89CBC32B196D7B698EC904699BE3076C34C66BFE7B0805AB36B808A667FDB7F0378DFC8BBB2DA4D958FFBF4D4E7A9E984099C0DB93F6F8F8
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/includes/popupWindow.js
Preview:	/**********************************************************************/./ JavaScript for poping up new windows. /./ /./********************************************************************/./ /./ This file depends upon the following JavaScript files: /./ -none /./ /./**********************************************************************/...function popWin(targetURL,h,w,winName,props) {. var winProps,myWin;. var tool='no';. if((winName == 'print')&&(is.safari)){. tool='yes';. }.. winName = (winName) ? winName : 'popup';. winProps = (h != null) ? 'height=' + h + ',' : 'height=400,';. winProps += (w != null) ? 'width=' + w + ',' : 'width=600,';. winPr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\s[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	http://webaccess.gaports.com/express/images/s.gif
Preview:	GIF89a.............!.......,...........D..;

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/03/21-16:17:10.209291	TCP	882	WEB-CGI calendar access	49718	80	192.168.2.6	104.26.6.110
06/03/21-16:17:11.111578	TCP	2925	INFO web bug 0x0 gif attempt	80	49716	104.26.6.110	192.168.2.6
06/03/21-16:17:11.374346	TCP	2925	INFO web bug 0x0 gif attempt	80	49717	104.26.6.110	192.168.2.6
06/03/21-16:17:32.080467	TCP	882	WEB-CGI calendar access	49713	80	192.168.2.6	104.26.6.110
06/03/21-16:17:33.901585	TCP	882	WEB-CGI calendar access	49714	80	192.168.2.6	104.26.6.110
06/03/21-16:17:35.913499	TCP	882	WEB-CGI calendar access	49718	80	192.168.2.6	104.26.6.110
06/03/21-16:17:38.611507	TCP	882	WEB-CGI calendar access	49713	80	192.168.2.6	104.26.6.110

Network Port Distribution

Total Packets: 117
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2021 16:17:08.282505035 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.282649040 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.325522900 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.325546980 CEST	80	49714	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.325649023 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.326534033 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.326891899 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.369716883 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.679749012 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.679775953 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.679884911 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.807969093 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.808001995 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.808125019 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:08.939526081 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.939552069 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:08.939666033 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.070668936 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.070738077 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.070776939 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.070807934 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.070846081 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.070883036 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.130692005 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.131683111 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.133948088 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.135338068 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.141660929 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.173736095 CEST	80	49714	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.174535036 CEST	80	49715	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.174679041 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.175164938 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.176619053 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.176733971 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.177208900 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.178237915 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.178503990 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.178812027 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.184617043 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.184813976 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.185264111 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.200269938 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.200350046 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.200373888 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.200419903 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.200642109 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.200686932 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.200712919 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.200745106 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.201517105 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.201603889 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.206156969 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.218099117 CEST	80	49715	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.219885111 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.221622944 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.228251934 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.249109030 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.477128983 CEST	80	49714	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.477166891 CEST	80	49714	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.477219105 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.477257967 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.481024981 CEST	49714	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.508323908 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.508394957 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.508431911 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.508464098 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.508465052 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.508507013 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.508538008 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.512181997 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.512234926 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.512260914 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.512281895 CEST	80	49717	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.513542891 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.513575077 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.514017105 CEST	49716	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.514539003 CEST	80	49715	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.514576912 CEST	80	49715	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.514765978 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.514806032 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.519903898 CEST	49715	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.522988081 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.523026943 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.523045063 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.523061037 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.523103952 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.523139000 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.523905039 CEST	80	49714	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.525973082 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.526004076 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.526150942 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.526201963 CEST	80	49713	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.526591063 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.531037092 CEST	49718	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.548713923 CEST	49717	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.549709082 CEST	49713	80	192.168.2.6	104.26.6.110
Jun 3, 2021 16:17:09.556557894 CEST	80	49716	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.562711000 CEST	80	49715	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.573971987 CEST	80	49718	104.26.6.110	192.168.2.6
Jun 3, 2021 16:17:09.591645956 CEST	80	49717	104.26.6.110	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2021 16:17:00.546792030 CEST	49448	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:00.595483065 CEST	53	49448	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:01.902146101 CEST	60342	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:01.943564892 CEST	53	60342	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:02.818176985 CEST	61346	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:02.859169960 CEST	53	61346	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:03.672178984 CEST	51774	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:03.721543074 CEST	53	51774	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:04.645418882 CEST	56023	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:04.696572065 CEST	53	56023	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:05.552086115 CEST	58384	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:05.601408005 CEST	53	58384	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:07.020237923 CEST	60261	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:07.069302082 CEST	53	60261	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:08.219753027 CEST	56061	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:08.272259951 CEST	53	56061	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:09.225436926 CEST	58336	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:09.242629051 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:09.274035931 CEST	53	58336	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:09.291480064 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:10.396441936 CEST	54064	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:10.439426899 CEST	53	54064	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:11.336635113 CEST	52811	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:11.399486065 CEST	53	52811	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:11.559454918 CEST	55299	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:11.611854076 CEST	53	55299	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:12.345547915 CEST	63745	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:12.409971952 CEST	53	63745	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:12.932252884 CEST	50055	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:12.981148005 CEST	53	50055	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:16.130600929 CEST	61374	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:16.180830002 CEST	53	61374	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:17.548250914 CEST	50339	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:17.597038031 CEST	53	50339	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:18.441297054 CEST	63307	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:18.482672930 CEST	53	63307	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:19.281550884 CEST	49694	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:19.323652983 CEST	53	49694	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:20.385874987 CEST	54982	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:20.427262068 CEST	53	54982	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:25.902492046 CEST	50010	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:25.951567888 CEST	53	50010	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:26.287250996 CEST	63718	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:26.342637062 CEST	53	63718	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:26.807941914 CEST	62116	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:26.851500034 CEST	53	62116	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:27.765886068 CEST	63816	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:27.816900015 CEST	53	63816	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:33.898458958 CEST	55014	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:33.965545893 CEST	53	55014	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:37.276257038 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:37.317718983 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:37.813323021 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:37.857460976 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:38.317327976 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:38.358741999 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:39.040855885 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:39.083451986 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:39.599733114 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:39.651021957 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:40.090884924 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:40.140887022 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:40.550472975 CEST	51818	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:40.605654955 CEST	53	51818	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:41.600413084 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:41.649491072 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.116749048 CEST	56628	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.126805067 CEST	60778	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.130208969 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.165467024 CEST	53	56628	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.171324015 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.175384045 CEST	53	60778	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.249507904 CEST	53799	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.253943920 CEST	54683	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.268951893 CEST	59329	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.291882992 CEST	64021	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.298305035 CEST	53	53799	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.303903103 CEST	53	54683	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.317205906 CEST	53	59329	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.345679045 CEST	53	64021	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.801443100 CEST	56129	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.804101944 CEST	58177	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:42.863900900 CEST	53	56129	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:42.868837118 CEST	53	58177	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:45.408024073 CEST	50700	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:45.460575104 CEST	53	50700	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:45.611197948 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:45.655237913 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:45.978455067 CEST	54069	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:46.042891026 CEST	53	54069	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:46.175215960 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:46.218826056 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:46.351268053 CEST	61178	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:46.399959087 CEST	53	61178	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:46.909616947 CEST	57017	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:46.957263947 CEST	56327	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:46.975368023 CEST	53	57017	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:47.008277893 CEST	53	56327	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:47.270174026 CEST	50243	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:47.319098949 CEST	62055	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:47.320575953 CEST	53	50243	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:47.383482933 CEST	53	62055	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:48.152573109 CEST	61249	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:48.201194048 CEST	53	61249	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:48.723992109 CEST	65252	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:48.776736021 CEST	53	65252	8.8.8.8	192.168.2.6
Jun 3, 2021 16:17:55.236676931 CEST	64367	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:17:55.285692930 CEST	53	64367	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:11.898530006 CEST	55066	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:12.017153978 CEST	53	55066	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:12.642488956 CEST	60211	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:12.692769051 CEST	53	60211	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:13.060400963 CEST	56570	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:13.127068996 CEST	53	56570	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:13.563688040 CEST	58454	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:13.706765890 CEST	53	58454	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:15.031153917 CEST	55180	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:15.080044985 CEST	53	55180	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:17.002460003 CEST	58721	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:17.052701950 CEST	53	58721	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:17.851561069 CEST	57691	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:17.900908947 CEST	53	57691	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:18.117458105 CEST	52943	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:18.167408943 CEST	53	52943	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:18.568968058 CEST	59489	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:18.617532015 CEST	53	59489	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:19.774902105 CEST	64022	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:19.824765921 CEST	53	64022	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:22.248498917 CEST	60023	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:22.297702074 CEST	53	60023	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:24.341567993 CEST	57193	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:24.479172945 CEST	53	57193	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:25.045608997 CEST	50248	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:25.233331919 CEST	53	50248	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:39.550360918 CEST	64413	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:39.600895882 CEST	53	64413	8.8.8.8	192.168.2.6
Jun 3, 2021 16:18:50.167295933 CEST	60429	53	192.168.2.6	8.8.8.8
Jun 3, 2021 16:18:50.218147039 CEST	53	60429	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 3, 2021 16:17:08.219753027 CEST	192.168.2.6	8.8.8.8	0xa0ae	Standard query (0)	webaccess.gaports.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:26.287250996 CEST	192.168.2.6	8.8.8.8	0xc6d5	Standard query (0)	webaccess.gaports.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:40.550472975 CEST	192.168.2.6	8.8.8.8	0x6ec0	Standard query (0)	www.navis.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.126805067 CEST	192.168.2.6	8.8.8.8	0x676a	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.249507904 CEST	192.168.2.6	8.8.8.8	0x20b3	Standard query (0)	marvel-b2-cdn.bc0a.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.253943920 CEST	192.168.2.6	8.8.8.8	0xf51b	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.268951893 CEST	192.168.2.6	8.8.8.8	0x5ff	Standard query (0)	fast.wistia.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.291882992 CEST	192.168.2.6	8.8.8.8	0xd2fc	Standard query (0)	dl.episerver.net	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.801443100 CEST	192.168.2.6	8.8.8.8	0xdf42	Standard query (0)	cdn.b0e8.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:46.351268053 CEST	192.168.2.6	8.8.8.8	0xc41d	Standard query (0)	a.b0e8.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:46.909616947 CEST	192.168.2.6	8.8.8.8	0x799f	Standard query (0)	dc.services.visualstudio.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:46.957263947 CEST	192.168.2.6	8.8.8.8	0xdf2d	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.270174026 CEST	192.168.2.6	8.8.8.8	0x3094	Standard query (0)	embed-fastly.wistia.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.319098949 CEST	192.168.2.6	8.8.8.8	0xdd1a	Standard query (0)	www.google.co.uk	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.152573109 CEST	192.168.2.6	8.8.8.8	0x8a17	Standard query (0)	distillery.wistia.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.723992109 CEST	192.168.2.6	8.8.8.8	0x5ef4	Standard query (0)	pipedream.wistia.com	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.248498917 CEST	192.168.2.6	8.8.8.8	0x18ed	Standard query (0)	fg8vvsvnieiv3ej16jby.litix.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 3, 2021 16:17:08.272259951 CEST	8.8.8.8	192.168.2.6	0xa0ae	No error (0)	webaccess.gaports.com		104.26.6.110	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:08.272259951 CEST	8.8.8.8	192.168.2.6	0xa0ae	No error (0)	webaccess.gaports.com		104.26.7.110	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:08.272259951 CEST	8.8.8.8	192.168.2.6	0xa0ae	No error (0)	webaccess.gaports.com		172.67.73.251	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:26.342637062 CEST	8.8.8.8	192.168.2.6	0xc6d5	No error (0)	webaccess.gaports.com		104.26.7.110	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:26.342637062 CEST	8.8.8.8	192.168.2.6	0xc6d5	No error (0)	webaccess.gaports.com		172.67.73.251	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:26.342637062 CEST	8.8.8.8	192.168.2.6	0xc6d5	No error (0)	webaccess.gaports.com		104.26.6.110	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:40.605654955 CEST	8.8.8.8	192.168.2.6	0x6ec0	No error (0)	www.navis.com	www.navis.com.dxcloud.episerver.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:40.605654955 CEST	8.8.8.8	192.168.2.6	0x6ec0	No error (0)	www.navis.com.dxcloud.episerver.net	www.navis.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:42.175384045 CEST	8.8.8.8	192.168.2.6	0x676a	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.175384045 CEST	8.8.8.8	192.168.2.6	0x676a	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.298305035 CEST	8.8.8.8	192.168.2.6	0x20b3	No error (0)	marvel-b2-cdn.bc0a.com	cdn.bc0a.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:42.298305035 CEST	8.8.8.8	192.168.2.6	0x20b3	No error (0)	cdn.bc0a.com		35.201.125.192	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:42.303903103 CEST	8.8.8.8	192.168.2.6	0xf51b	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:42.317205906 CEST	8.8.8.8	192.168.2.6	0x5ff	No error (0)	fast.wistia.com	dualstack.f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:42.345679045 CEST	8.8.8.8	192.168.2.6	0xd2fc	No error (0)	dl.episerver.net	dl.episerver.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:42.863900900 CEST	8.8.8.8	192.168.2.6	0xdf42	No error (0)	cdn.b0e8.com		35.190.5.192	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:45.460575104 CEST	8.8.8.8	192.168.2.6	0x7604	No error (0)	sni1gl.wpc.gammacdn.net		152.199.21.175	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:46.399959087 CEST	8.8.8.8	192.168.2.6	0xc41d	No error (0)	a.b0e8.com		34.95.105.148	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:46.975368023 CEST	8.8.8.8	192.168.2.6	0x799f	No error (0)	dc.services.visualstudio.com	dc.applicationinsights.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:46.975368023 CEST	8.8.8.8	192.168.2.6	0x799f	No error (0)	dc.applicationinsights.azure.com	global.in.ai.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:46.975368023 CEST	8.8.8.8	192.168.2.6	0x799f	No error (0)	global.in.ai.monitor.azure.com	global.in.ai.privatelink.monitor.azure.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:46.975368023 CEST	8.8.8.8	192.168.2.6	0x799f	No error (0)	global.in.ai.privatelink.monitor.azure.com	dc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:47.008277893 CEST	8.8.8.8	192.168.2.6	0xdf2d	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:47.008277893 CEST	8.8.8.8	192.168.2.6	0xdf2d	No error (0)	stats.l.doubleclick.net		142.251.5.154	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.008277893 CEST	8.8.8.8	192.168.2.6	0xdf2d	No error (0)	stats.l.doubleclick.net		142.251.5.155	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.008277893 CEST	8.8.8.8	192.168.2.6	0xdf2d	No error (0)	stats.l.doubleclick.net		142.251.5.157	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.008277893 CEST	8.8.8.8	192.168.2.6	0xdf2d	No error (0)	stats.l.doubleclick.net		142.251.5.156	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:47.320575953 CEST	8.8.8.8	192.168.2.6	0x3094	No error (0)	embed-fastly.wistia.com	d.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:47.383482933 CEST	8.8.8.8	192.168.2.6	0xdd1a	No error (0)	www.google.co.uk		172.217.19.99	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.201194048 CEST	8.8.8.8	192.168.2.6	0x8a17	No error (0)	distillery.wistia.com	prod-east-stats-tap-alb-627711272.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:48.201194048 CEST	8.8.8.8	192.168.2.6	0x8a17	No error (0)	prod-east-stats-tap-alb-627711272.us-east-1.elb.amazonaws.com		54.86.117.43	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.201194048 CEST	8.8.8.8	192.168.2.6	0x8a17	No error (0)	prod-east-stats-tap-alb-627711272.us-east-1.elb.amazonaws.com		52.87.45.133	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.776736021 CEST	8.8.8.8	192.168.2.6	0x5ef4	No error (0)	pipedream.wistia.com	prod-east-pipedream-alb-988701200.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:17:48.776736021 CEST	8.8.8.8	192.168.2.6	0x5ef4	No error (0)	prod-east-pipedream-alb-988701200.us-east-1.elb.amazonaws.com		52.6.75.166	A (IP address)	IN (0x0001)
Jun 3, 2021 16:17:48.776736021 CEST	8.8.8.8	192.168.2.6	0x5ef4	No error (0)	prod-east-pipedream-alb-988701200.us-east-1.elb.amazonaws.com		34.237.200.61	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	fg8vvsvnieiv3ej16jby.litix.io	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		52.0.129.236	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		34.236.95.28	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		50.16.76.135	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		34.230.166.132	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		18.208.14.26	A (IP address)	IN (0x0001)
Jun 3, 2021 16:18:22.297702074 CEST	8.8.8.8	192.168.2.6	0x18ed	No error (0)	a4d6c1c8368a911ea98860aeb4e6dc37-182063218.us-east-1.elb.amazonaws.com		100.25.172.5	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

webaccess.gaports.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49713	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:08.326891899 CEST	1054	OUT	GET /express/secure/today.jsp?Facility=GCT HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive
Jun 3, 2021 16:17:08.679749012 CEST	1055	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:08 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private Expires: Wed, 31 Dec 1969 19:00:00 EST Set-Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3; Path=/express; HttpOnly CF-Cache-Status: DYNAMIC cf-request-id: 0a73d54007000017626c188000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fuAWZBPQUXlbF6MvSckqus2tuB1ubLj1dbOjL86bMQ8YqXHqnJ0g6jykGoF%2Bu2yezq3qT6Q5PDAwDZ%2BdXy5ZLqErlHfAoX5kslJp0yTBnGy%2FrvDwjXzE6MnCHvO09RMIwac%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65998b133e351762-FRA Content-Encoding: gzip Data Raw: 32 65 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 55 4d 6f e2 30 10 3d 27 bf 62 9a 0b 41 7c b5 d7 86 20 6d 51 2b 75 85 76 0f a0 bd 54 3d 98 64 42 9c 1a 1b c5 26 29 da f2 df 57 8e 1d be 4a 40 ea ae b4 1c 42 3c f3 66 9e 67 de 8c e2 ba f6 37 94 51 4e 57 0a 18 e1 8b 35 59 60 e8 7d 27 05 99 56 46 6f 34 bc e9 f5 dc 8c 14 c4 a0 ee 4b ca 63 51 f6 53 2a 95 c8 37 fd 44 e4 25 c9 63 ff ae 1d b8 83 41 af 37 1a 0e 0c 70 54 67 4f d5 92 8d dc 61 8a 24 1e b9 8e eb 5c 23 74 9d 82 e4 40 e5 e3 fb 8a f0 18 63 08 21 21 4c 62 e0 ba 4e b2 e6 91 a2 82 43 4a 63 9c 90 0d e6 d2 6f c3 6f d7 71 b4 e1 39 f6 3d a6 8d d3 b1 d7 0e 4e 8d e3 b3 c6 a9 31 0e 06 c7 e6 99 36 bb ce d6 dd 31 46 29 e1 0b 9c 91 b9 5f a6 34 4a db 9a 54 46 33 32 87 10 62 11 ad 97 c8 55 7f 81 ea 91 a1 7e 7d d8 3c c7 7e 4b 46 8a cc 5b 15 43 74 0d 1b 1d 60 e5 35 ac dc 61 05 87 10 5a 8a cc bf 45 8a 16 d8 d2 a6 24 b1 36 50 64 3e a1 fc ad a5 91 12 d5 8c cc 9f 6c 41 b6 0c ad 1a 70 51 82 44 05 2a 45 1d 01 11 23 52 a2 d4 31 25 55 51 7a 50 b2 e3 44 44 22 b4 c6 d3 d6 7d 75 b4 5d e8 57 31 3f c8 12 21 04 91 24 81 75 46 17 9d f2 93 93 d7 be 79 8e e4 2d 38 64 1c 7f 99 91 5f 20 dc 07 1e 30 c6 98 90 35 53 17 f8 f8 57 0b 3c c3 b7 75 b7 87 b3 7d a2 53 c2 f7 13 5e 8f bc 19 59 58 92 37 04 b2 5a e5 62 95 53 a2 10 aa e1 85 82 4a 3a 67 a8 e5 4b 45 b9 1b 6a 0f 3a 90 70 3b d7 07 7c 4b 51 e0 4c 4c 1e fc 24 17 cb 09 95 aa ab 84 fe 33 b4 d5 32 42 08 b7 10 d8 53 b6 3b 25 22 f7 69 78 db cd 42 13 d1 17 2b 9d 51 f6 19 f2 85 4a 03 a0 30 84 3a eb 67 67 a7 63 28 1c 9a 80 7f 0a 7b a1 af 7d 89 0c 23 85 b1 85 55 38 38 07 2c 08 5b 23 dc 84 e0 79 50 83 ab bb 1a 0c 84 c0 b1 84 9f 2b d3 d0 33 09 14 be ab 6e 63 e6 b6 49 88 05 61 be 77 5c ea 4b f6 1a 9a 57 cf a2 ce 64 09 f9 9a 31 e3 d5 cd cb 3a 77 e6 a0 fb 4a a1 07 77 66 24 b6 ae Data Ascii: 2eaUMo0='bA\| mQ+uvT=dB&)WJ@B<fg7QNW5Y`}'VFo4KcQS7D%cA7pTgOa$\#t@c!!LbNCJcooq9=N161F)_4JTF32bU~}<~KF[Ct`5aZE$6Pd>lApQDE#R1%UQzPDD"}u]W1?!$uFy-8d_ 05SW<u}S^YX7ZbSJ:gKEj:p;\|KQLL$32BS;%"ixB+QJ0:ggc({}#U88,[#yP+3ncIaw\KWd1:wJwf$
Jun 3, 2021 16:17:09.206156969 CEST	1073	OUT	GET /express/includes/ImageSwap.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.525973082 CEST	1092	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2128-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d543770000176276b00000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZdZpjQQ69DwCqkMfTZ2%2BsGMC1PXnr7z68%2Fzw%2BgnTpZdlmWVJ0Vm2%2Fo2zbRA0vf28WdZD%2F8b%2FgWUICucuG34fK%2FRC9kmCRgYezqOmztXtZ86t%2BD6h1B5gNybb0g4Z1GY1wIQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b18b9391762-FRA Content-Encoding: gzip Data Raw: 32 66 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 54 cb 6e d4 30 14 dd e7 2b 4e 67 d1 3a 4c 95 29 88 15 21 a0 4a 20 34 0b 0a a2 48 2c 46 b3 70 63 27 73 ab c4 8e 1c 87 4e 55 cd bf 23 db f1 3c 4a 5b 84 a8 84 17 96 1f d7 e7 9e 73 1f 9e bd 78 62 60 fe f9 fc d3 47 5c fe 38 ff 3a bf f8 84 a7 4c 5f cc 92 99 7f f2 7d 25 51 e9 a6 d1 37 a4 6a f4 a5 a1 ce 82 7a 0c bd 14 b0 1a 9d 91 8d e6 02 d4 f2 5a f6 20 65 35 ec 4a e2 c3 97 cf 00 b0 0f c5 95 40 7f c3 3b 07 64 57 b2 c5 0d d9 55 7c 68 a4 12 d2 48 01 6e 41 8a 2c f1 06 1e d8 52 2b b3 fb 50 ff 38 9e 10 78 ab 2c 5f a3 5f e9 a1 11 b8 92 41 27 a9 9e 84 04 57 b7 d0 57 d7 b2 b4 b0 2b 6e 7f 83 1a 5f 59 43 75 2d 0d b8 0a e2 bc e8 37 7f c7 ea 19 05 ba a1 55 ab 87 5e ea 9f d2 14 13 47 67 de d6 ec 64 41 6d 7d c1 5b b9 3c 39 3d 59 54 d4 c8 8e db d5 cc 2d c2 69 9a 4f 1e 87 1a 6c 31 a1 b6 fe 26 7b ab 8d 64 de f6 bf 08 7c 8e 31 4b 92 9f dc 40 a0 80 d0 e5 d0 4a 65 f3 24 a9 06 55 5a d2 2a 16 39 4b 91 dc 25 00 55 4c 64 a1 6e 53 dc 21 71 84 a8 62 47 ee b0 3e 37 86 df a6 b8 4b 02 d1 dd 19 0a 28 79 03 bf 66 69 ee ef 37 7e 76 ae af 9d eb ad 6d d6 48 55 db 55 be bd e6 28 c0 4d ed 99 f5 e1 b8 d2 86 11 0a 9c e5 20 bc 05 8f 6f 40 d3 e9 43 fe 17 d7 cb 91 c2 dc 51 8f 14 0e 4d a6 d3 65 d6 9b d2 79 5b d0 72 47 72 93 6c f6 e2 d1 e8 92 5b c9 f4 bc ad 4f a1 3f e8 72 0c 8c 63 da e5 e3 82 e2 62 9d c3 c5 28 01 66 b3 8a 94 88 3d 44 0a 95 e1 ad ec 43 48 8f 02 90 9b 5d 2c 72 84 63 d6 a1 80 f3 94 91 12 72 fd a5 62 93 f7 93 34 c5 3b 9c e1 f8 18 1d 37 52 d9 2c 00 8d 21 88 ea 47 a8 03 93 85 87 ea 87 ab de 1a 52 35 eb a6 2f d3 65 16 bc c1 fb 89 ee 76 36 67 a7 9d 0f d6 e6 31 15 da b4 bd ff de 1a 7e 2b 4d cf 2e 2e 5f a7 a3 28 b6 2e 84 f7 b9 4c 1d 5d 91 f1 a6 89 fc d6 3e e7 bc 69 82 41 74 51 69 83 98 d9 a3 b5 7b e5 f2 2b 32 ef e6 a1 2c 07 1c 7f bd a0 e5 9f c0 44 16 58 ee 80 c3 fe 31 e4 fd Data Ascii: 2f1Tn0+Ng:L)!J 4H,Fpc'sNU#<J[sxb`G\8:L_}%Q7jzZ e5J@;dWU\|hHnA,R+P8x,__A'WW+n_YCu-7U^GgdAm}[<9=YT-iOl1&{d\|1K@Je$UZ*9K%ULdnS!qbG>7K(yfi7~vmHUU(M o@CQMey[rGrl[O?rcb(f=DCH],rcrb4;7R,!GR5/ev6g1~+M.._(.L]>iAtQi{+2,DX1
Jun 3, 2021 16:17:09.549709082 CEST	1102	OUT	GET /express/css/modules/actionbar.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.882013083 CEST	1162	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2708-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d544d2000017625b9a7000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uqB1hO77K9yD03AG5bJwcjCQ2NgtZtsKUAmL%2FRODxbWOXg9beNh8r1MFf8x6QkeoYCQfvZxwnmu40P3uYkxVPw2SY2VCH8cAPvDiKDwx3hDLtquloTyZTd5MMKTcLiL1Uvw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1aed611762-FRA Content-Encoding: gzip Data Raw: 32 61 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 56 5f 4f db 30 10 7f 6e 3e c5 49 bc 55 6d 0a 74 94 91 3c 95 b6 48 93 b6 21 0d f6 01 2e f1 25 b1 48 7d 91 e3 96 32 d4 ef 3e 39 09 25 49 69 19 d0 6d f6 43 92 73 ee 77 ff 7e 3e 7b d0 3d d0 18 38 03 fb 80 f1 e4 f6 cb f5 f7 cb f1 0f 77 72 73 03 6f 1e 75 a8 9f 39 09 08 1e 00 d5 03 64 18 13 dc 4b 93 c0 9c d4 22 40 dd 03 c3 9c 16 2f ac 21 d0 84 22 d4 8b 79 00 01 6a b7 0d 75 98 00 5f c3 02 0c 8d 64 75 89 1a fe 30 59 45 84 11 eb 4a d3 fa 9e 03 66 19 a1 96 2a 06 a9 c0 24 04 21 2b 43 ca 00 6a 42 77 47 b2 0e 13 a1 bb 89 e0 56 38 8f 4e 27 60 2d 48 f7 03 36 86 e7 de 49 b6 82 9c 53 29 e0 e8 e2 ca 4e df e9 dc 27 d2 50 3f cf 30 24 4f f1 bd c6 cc 77 3a e1 42 e7 ac bd 8c a5 32 a4 7d 67 5d 03 9e ca 65 0d d9 70 56 87 8d a2 c8 df ac a5 14 99 9d 8b 5a c6 49 63 35 3c b5 d3 df e3 f3 f3 1f 18 de c5 9a 17 4a f4 43 4e 59 7b 47 f4 c9 ce 5d e1 64 28 84 54 b1 77 9c ad e0 e4 38 5b d9 08 4b bd cf 27 76 fa 4e 27 a1 c2 9f d3 62 b5 15 2e c8 79 dc 83 a6 08 9d 47 c7 56 70 d0 5d 92 36 32 c4 b4 8f a9 8c 95 37 97 42 a4 e4 77 07 16 e5 99 d5 5f a5 ba b3 69 6b d9 6d fc 73 ab 51 a6 ce a3 e3 ac f7 32 15 12 42 41 7a bc e1 2a bc 89 a9 96 90 76 0b 5a ae 02 47 c5 77 89 08 19 2a 4a 7b 4f ac 9d a3 54 c5 b6 75 ff 0a 53 5b 51 7c 88 af 35 32 2a 56 f4 cc 60 41 11 2e 52 53 24 ba 65 b0 c9 e3 6d 8b d3 f3 e9 f9 64 f6 22 db 66 b3 d9 6c 3a 7d 8d 6d c3 82 68 11 2b d3 cf e5 2f f2 9a cc 1b 8d 46 fe 6b 85 8e 98 4d bd d0 dd 0f 17 ba 44 fc b7 85 6e 45 d1 28 74 ab 7d 8c 2f ec f4 8b 9d f5 3e 2a ac b7 ec ed ed 57 57 76 9c f9 ff 9d 06 6e 6e d0 2c f2 6f 94 e7 18 53 91 22 9b 83 1a 46 d5 b8 ac b4 52 1d 0e 87 e5 77 1b db ca 76 e4 26 e4 ec a1 e8 bc 1b 13 15 58 3d f3 2f e1 19 5a 99 aa c3 15 fa a5 b4 d5 fb ca ec f9 0d d7 6d cf 3d 2b 9b ea e1 9b da 84 95 d1 9c 3e 1d b9 a8 42 02 54 02 02 4a 70 29 b9 a0 3d 67 a4 d1 a2 d6 0f e6 ed bb 8a bd 9a 48 55 3f c7 dd 77 5e 7b 0e b4 6d Data Ascii: 2a9V_O0n>IUmt<H!.%H}2>9%IimCsw~>{=8wrsou9dK"@/!"yju_du0YEJf$!+CjBwGV8N'`-H6IS)N'P?0$Ow:B2}g]epVZIc5<JCNY{G]d(Tw8[K'vN'b.yGVp]627Bw_ikmsQ2BAzvZGwJ{OTuS[Q\|52V`A.RS$emd"fl:}mh+/FkMDnE(t}/>*WWvnn,oS"FRwv&X=/Zm=+>BTJp)=gHU?w^{m
Jun 3, 2021 16:17:10.121349096 CEST	1164	OUT	GET /express/css/modules/form.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.452696085 CEST	1176	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1113-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d547100000176243259000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Pn%2Btrgqd%2BljfOs78ZAO9UZS28pdgvjGpoAa0%2BzuY7PK1vK2izZespI16ufUipqoVfxjZZOBFUkg6Pm7Va3I3YbVoHMyZ5v5c1%2FGqqjpzg3jO3neKrJJDkCjQ6JyTw%2FDPlWk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1e7ca91762-FRA Content-Encoding: gzip Data Raw: 31 63 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 52 6d 6b db 30 10 fe 05 fe 0f 82 30 d8 c6 ec 38 b0 75 8d 4a 3f 14 c7 86 c0 ca a0 2d 6c 5f 65 eb ec 88 c9 3a 21 5d 12 a7 23 ff 7d 28 56 d6 6c 6b 18 1b d5 7d 10 f7 f6 9c 9e e7 34 7d fb 42 67 9a 4c c3 c5 aa cf 77 b7 59 71 7f cf fe ef 9c 42 15 68 c8 a1 f6 8c 56 c0 84 b5 20 9c 30 0d 30 6c 59 8b ae 67 a0 a1 07 43 3e fb 2b d4 cb 10 0c 43 93 ef 49 c0 ee 85 eb 94 e1 b9 1d ae 92 7d 92 d1 40 4b 63 d7 14 b3 5b 25 69 c5 67 79 fe ea ea e0 d7 a2 f9 d6 39 5c 1b 99 36 a8 d1 f1 49 35 0f 36 66 37 e0 48 35 42 a7 42 ab ce f0 5e 49 a9 61 84 85 81 6e 1c 88 7f 86 dd 27 99 c6 4d 6c 93 ca 5b 2d 76 dc a0 81 b1 d1 a2 57 a4 d0 70 51 7b d4 6b 8a 61 42 3b 32 0a 8e 86 96 f8 ec e8 55 cb 4f 0f e5 1d b7 0e 3b 25 f9 e2 eb b2 17 1d 3c 38 61 7c 10 25 bb 55 8d 43 8f 2d 65 37 da ae c4 6b 4f 3b 0d d7 f9 3b b4 a2 51 b4 bb be cc df 8c 38 69 8f 8f 69 8c f2 3c bb 3c 43 84 4d ca 45 b0 31 fd 98 2a 23 61 08 cc f3 d8 80 4e 82 4b 9d ea 56 c4 d9 cc 0e cc a3 56 92 4d 7e af a8 91 08 fb e7 4b 70 03 ae d5 b8 e5 62 4d 18 34 f3 a0 a1 a1 a0 1c 43 1b f4 89 02 46 71 0f 8d fb 24 53 61 d3 5f 94 ec e0 b8 ef 33 1b 7c 7a c7 89 f6 f1 e7 8c 81 7d 92 49 e5 45 ad 41 46 a8 3f 77 5a be 0f f6 34 b9 74 0e dd d9 ea a2 c8 7f 12 3c 7e 8a aa 1a fd 16 0d a5 5b 38 88 56 a3 96 27 6c 84 33 ca 74 67 51 ab 8f 8b f2 43 f1 0b ea 7c 7e 71 71 1c f4 1c f0 0f a9 09 ec b3 59 04 00 00 0d 0a Data Ascii: 1c2Rmk008uJ?-l_e:!]#}(Vlk}4}BgLwYqBhV 00lYgC>+CI}@Kc[%igy9\6I56f7H5BB^Ian'Ml[-vWpQ{kaB;2UO;%<8a\|%UC-e7kO;;Q8ii<<CME1*#aNKVVM~KpbM4CFq$Sa_3\|z}IEAF?wZ4t<~[8V'l3tgQC\|~qqY
Jun 3, 2021 16:17:10.661714077 CEST	1182	OUT	GET /express/javascript/lovHandlers.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.008935928 CEST	1204	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1695-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d549320000176298ac9000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eUX64R227iuhs7azNHe0ofDwPzoPP9Sl7bgRCC%2F9DYqQRAQfWfEpmkjjaNLZKnZIkoTEdWICn0w44nurt6c62zRauYJHGsYEANvoHIp7Er%2FtCOyApiFPhp6xzq5W65eoAk4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b21ebf11762-FRA Content-Encoding: gzip Data Raw: 33 34 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 54 61 6f db 36 10 fd 2c fe 8a 43 17 c0 b6 52 c8 4e 3b 0c 9b bd 00 49 1c 03 0b e0 da 41 e2 f5 cb 30 0c b4 78 b2 2f a3 48 ed 78 72 a6 16 f9 ef 03 25 3b 31 d0 76 6d 3f 49 3c f2 3d be 7b f7 c0 61 aa 52 b8 e8 ff 30 b0 7e f7 9b 76 c6 22 87 ec 21 c0 c9 1d ee 28 90 77 63 38 cb ce e0 04 4e ae b5 e0 18 de 8c 46 6f 87 a3 5f 86 6f de c2 d9 4f e3 b3 9f c7 3f 8e e0 44 45 92 a9 af 1a a6 cd 56 60 a1 77 14 60 ea b9 f2 ac 85 bc 6b 51 2a 85 4b 6b e1 2e 1e 09 70 87 01 79 87 66 0f 75 05 19 74 42 da c2 8d 2b 3c 97 1d ce 17 9f 92 a9 14 7e 77 ba 96 ad 67 fa 80 06 ea 80 40 01 82 30 e5 62 1b a8 d8 6f 69 4d b2 e7 5e 6d 29 c0 a3 e7 bf 21 f7 4e 34 b9 00 3b 6d 6b bd b6 18 2b 2f f7 56 ec 2b 26 14 cd 0d 08 6b 83 10 30 67 14 95 02 7d 45 12 68 67 a2 86 8a bd 60 2e 68 60 dd 40 a8 30 a7 82 72 95 82 de 30 62 89 4e 42 7b b2 40 83 ac 2d e4 07 c7 b2 23 95 9e 41 bb 06 2a cd 02 b2 45 46 5f a8 14 4a dd 80 f3 02 6b 04 43 21 b7 3e a0 79 1d 65 ba 50 92 48 5c e4 be a2 f8 f5 0c 8c 15 7b 53 e7 68 80 a2 b8 46 a5 10 3b 88 7b 25 1a aa 4b 78 24 d9 fa 5a a0 62 f2 0c 8f 1c 49 1c 1c 6c ed ba 2a d8 97 5d b3 ed 8c 9e db cd 54 3a 54 6a 18 dd 3d 4a cd 8b bf 45 ed f2 78 2e 80 78 20 47 d1 5e fa 80 8f 60 1a a7 4b ca 61 be 7c 1f b2 76 3a 17 3b e4 98 b2 ef cd 1b 5c 74 52 c7 30 b5 ba 81 05 3e 4a 4c c6 5e 56 b2 5a c2 f5 72 ac d2 24 59 78 87 47 7a 6f de dd ce 67 ef 66 8b d5 e5 ea 66 b9 80 c5 72 35 bb 1f ab 14 6e 35 eb 12 05 39 1c a3 e2 ef ea b8 05 d0 2e 8a 7f 0d e4 72 5b 1b 04 0d af 0c 56 e8 62 88 5e 01 fe 5b 69 67 7c 1b 25 64 69 c0 bb 38 43 88 3c 01 2d e6 12 e3 13 2b f3 e5 fb 8e ff 0e ff a9 89 b1 bb 76 63 fd 5a db bd a1 d9 43 88 35 5d 8b cf 7d 59 59 14 dc 97 36 28 cb aa 35 b8 2d 0c 95 3a 38 de 4a 9d fb 5d e8 0f d4 47 b5 d3 0c da da 7b b4 70 0e c6 e7 75 8c 60 b6 41 99 d9 2e 8d 57 cd 4a 6f 16 ba c4 7e ef 7e 36 9f 4d 57 bd c1 a4 45 59 Data Ascii: 340Tao6,CRN;IA0x/Hxr%;1vm?I<={aR0~v"!(wc8NFo_oO?DEV`w`kQKk.pyfutB+<~wg@0boiM^m)!N4;mk+/V+&k0g}Ehg`.h`@0r0bNB{@-#AEF_JkC!>yePH\{ShF;{%Kx$ZbIl*]T:Tj=JEx.x G^`Ka\|v:;\tR0>JL^VZr$YxGzogffr5n59.r[Vb^[ig\|%di8C<-+vcZC5]}YY6(5-:8J]G{pu`A.WJo~~6MWEY
Jun 3, 2021 16:17:11.011837006 CEST	1205	OUT	GET /express/skins/gpa/logo.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.337860107 CEST	1230	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 12519 Connection: keep-alive ETag: W/"12519-1535742675345" Last-Modified: Fri, 31 Aug 2018 19:11:15 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes cf-request-id: 0a73d54a84000017628ebd6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HBqfeFO%2FpsVa%2Fde%2FA8GvUaKc8zIWNZ6D2qi4SViGer40iqagjqgIv4QhItpzBCqFMSnAUFkxBcxohlkbj71z9CWLRWvxpAufpMvYSRIdpvk7h2jtz8ombW8aMWsrTbT8bEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b24090e1762-FRA Data Raw: 47 49 46 38 39 61 20 01 92 00 f7 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 2b 00 00 2b 33 00 2b 66 00 2b 99 00 2b cc 00 2b ff 00 55 00 00 55 33 00 55 66 00 55 99 00 55 cc 00 55 ff 00 80 00 00 80 33 00 80 66 00 80 99 00 80 cc 00 80 ff 00 aa 00 00 aa 33 00 aa 66 00 aa 99 00 aa cc 00 aa ff 00 d5 00 00 d5 33 00 d5 66 00 d5 99 00 d5 cc 00 d5 ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 33 00 99 33 00 cc 33 00 ff 33 2b 00 33 2b 33 33 2b 66 33 2b 99 33 2b cc 33 2b ff 33 55 00 33 55 33 33 55 66 33 55 99 33 55 cc 33 55 ff 33 80 00 33 80 33 33 80 66 33 80 99 33 80 cc 33 80 ff 33 aa 00 33 aa 33 33 aa 66 33 aa 99 33 aa cc 33 aa ff 33 d5 00 33 d5 33 33 d5 66 33 d5 99 33 d5 cc 33 d5 ff 33 ff 00 33 ff 33 33 ff 66 33 ff 99 33 ff cc 33 ff ff 66 00 00 66 00 33 66 00 66 66 00 99 66 00 cc 66 00 ff 66 2b 00 66 2b 33 66 2b 66 66 2b 99 66 2b cc 66 2b ff 66 55 00 66 55 33 66 55 66 66 55 99 66 55 cc 66 55 ff 66 80 00 66 80 33 66 80 66 66 80 99 66 80 cc 66 80 ff 66 aa 00 66 aa 33 66 aa 66 66 aa 99 66 aa cc 66 aa ff 66 d5 00 66 d5 33 66 d5 66 66 d5 99 66 d5 cc 66 d5 ff 66 ff 00 66 ff 33 66 ff 66 66 ff 99 66 ff cc 66 ff ff 99 00 00 99 00 33 99 00 66 99 00 99 99 00 cc 99 00 ff 99 2b 00 99 2b 33 99 2b 66 99 2b 99 99 2b cc 99 2b ff 99 55 00 99 55 33 99 55 66 99 55 99 99 55 cc 99 55 ff 99 80 00 99 80 33 99 80 66 99 80 99 99 80 cc 99 80 ff 99 aa 00 99 aa 33 99 aa 66 99 aa 99 99 aa cc 99 aa ff 99 d5 00 99 d5 33 99 d5 66 99 d5 99 99 d5 cc 99 d5 ff 99 ff 00 99 ff 33 99 ff 66 99 ff 99 99 ff cc 99 ff ff cc 00 00 cc 00 33 cc 00 66 cc 00 99 cc 00 cc cc 00 ff cc 2b 00 cc 2b 33 cc 2b 66 cc 2b 99 cc 2b cc cc 2b ff cc 55 00 cc 55 33 cc 55 66 cc 55 99 cc 55 cc cc 55 ff cc 80 00 cc 80 33 cc 80 66 cc 80 99 cc 80 cc cc 80 ff cc aa 00 cc aa 33 cc aa 66 cc aa 99 cc aa cc cc aa ff cc d5 00 cc d5 33 cc d5 66 cc d5 99 cc d5 cc cc d5 ff Data Ascii: GIF89a 3f++3+f+++UU3UfUUU3f3f3f3f3333f3333+3+33+f3+3+3+3U3U33Uf3U3U3U3333f3333333f3333333f3333333f333ff3ffffff+f+3f+ff+f+f+fUfU3fUffUfUfUff3fffffff3fffffff3fffffff3fffff3f++3+f+++UU3UfUUU3f3f3f3f3f++3+f+++UU3UfUUU3f3f3f
Jun 3, 2021 16:17:31.904557943 CEST	1777	OUT	GET /express/n4addendum.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMT If-None-Match: W/"9069-1619547716000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.971411943 CEST	1782	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"9069-1619547716000" Last-Modified: Tue, 27 Apr 2021 18:21:56 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c2100001762a1b82000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hvcXMKrX%2Bp57rlIHQmyp%2FTfcgFThAAY%2Fkiqo6FJz41mMn1k%2Bq991B083WbChZmp0SwNZ7AerDi7sX5V%2FOGXzCWq6gJj%2BdLlcfnlLazPkI67jBiMgy%2FmdGSsciRRenucc8Ec%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba69fc71762-FRA
Jun 3, 2021 16:17:31.972403049 CEST	1783	OUT	GET /express/css/modules/navPane.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"3126-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.026026964 CEST	1791	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"3126-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c650000176250273000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=k%2F5AM6OUHKJZ19IbrAcIOjaNXBeXqKFsG%2B5Osqwpj4R1BdXttJby8vaTkyTiQwqf5B99YSSdMBhL5PU%2Bwn36M6VjafbEO6hEZr%2B0hK0xJK5CsoINRd0FRFlrr%2BS1VUH8Xvo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba708ff1762-FRA
Jun 3, 2021 16:17:32.027582884 CEST	1792	OUT	GET /express/css/modules/tab.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2768-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.079648972 CEST	1796	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2768-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c9c000017627811d000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=V7zFH0xlqUT7EvO5Cs6Qqh67WJYzAqo6ODbcrZS%2FGaTGBMOmVdAyrZDmiYFEgFNXi3wEyQCMEFwLVO2QgWmosOO1P7qJKiq9PKc27OBpk%2FSgnu090XN6CyIOy75BFBuoDBA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba759db1762-FRA
Jun 3, 2021 16:17:32.080466986 CEST	1798	OUT	GET /express/css/modules/calendar.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2243-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.160410881 CEST	1810	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2243-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59cd200001762b1005000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EXA0sqru2U%2B1Ot4G9RZeYn4LgEygqdUsInYQyRWopywMpOWa8a6rvpDzIlEyYXZ3dYP%2BtqccclQOROTpaSsJfpmHEx5gFuKt3S60MdqQG5bV03MpHWjTKEgmmbFTm160LpY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7ba921762-FRA
Jun 3, 2021 16:17:32.161423922 CEST	1810	OUT	GET /express/javascript/autocomplete.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"21234-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.245268106 CEST	1821	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"21234-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59d2100001762b593c000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OBNlOAL6Gcy6RsqIZBGebENoLCPs3fJS9vCPY4AbpYAhDGhr3xD6UysYvyxvuI89osAUxDez8gxB45QnqUhvVXT3%2F%2FsZRC4U0TaUCRUhZgb2iTvI5HTel%2FbIVL%2FOrCHid60%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba83bc81762-FRA
Jun 3, 2021 16:17:32.261384964 CEST	1823	OUT	GET /express/images/down.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"175-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.313924074 CEST	1827	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"175-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d86000017628b8f5000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=WdSqTeUknZlKPEyX3e1R42LlSjUKxvkJ1%2FCj2xylM7FLgSAeXByrlWAf%2FVKH84RSGyY4pb8AOHBzYwlMLxUlv4hTa2H5lLKZ0X1Mlogzp5I0k4H40K2c5offohJ8PUpyn%2Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba8dd171762-FRA
Jun 3, 2021 16:17:32.394179106 CEST	1827	OUT	GET /express/images/icons/export.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.448714972 CEST	1830	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:32 GMT Content-Type: image/gif Content-Length: 313 Connection: keep-alive ETag: W/"313-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4136 Accept-Ranges: bytes cf-request-id: 0a73d59e0b00001762a9a22000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bj52V3rnPrbqx8QbxEepiet47e5xNavo393jAHut9a7muTVPXYHSiX831hfUT5rMQURj55OIZJOD%2BfFOvvTacbKDV4k81pTqY4jlcp7h4I9Ohk80bPsYsJIh7mgRRG1QtrE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba9aee31762-FRA Data Raw: 47 49 46 38 39 61 14 00 14 00 c4 1f 00 9e 9e 9e 73 73 73 5c 5c 5c 85 85 85 63 63 63 a5 a5 a5 eb eb eb 7e 7e 7e 99 99 99 79 79 79 b1 b1 b1 49 49 49 8c 8c 8c 4d 4d 4d 6a 6a 6a 91 91 91 37 37 37 6d 6d 6d e1 e1 e1 e7 e7 e7 95 95 95 a8 a8 a8 ab ab ab 50 50 50 d3 d3 d3 cb cb cb 56 56 56 df df df d9 d9 d9 94 94 94 be be be cc cc cc 21 f9 04 01 00 00 1f 00 2c 00 00 00 00 14 00 14 00 00 05 b6 e0 27 8e 64 69 9e a8 e9 ad 6c eb 7a a4 67 cc 12 b7 65 53 ae 5f f0 28 57 08 81 c3 41 00 20 00 48 40 a3 27 92 59 12 81 42 12 30 70 1c 94 cc 8f 13 6a 41 22 02 91 43 24 b2 c8 fe 10 84 61 80 a2 e9 78 00 82 72 cc 60 a9 3c 12 03 01 fa a0 60 c4 cd 1c 0f 15 5d 07 10 0b 1a 03 7d 17 10 66 19 02 15 15 04 04 1a 51 08 05 97 4b 31 18 01 0a 0a 50 07 69 88 16 05 3c 9a 01 48 0e 11 0f 01 07 09 02 14 16 a5 3e 1b 11 92 04 03 1d b9 0f 02 03 b1 66 12 0f 07 07 0f 14 77 03 79 0f be 31 12 b9 cd ae 93 bd a4 66 0b d4 d4 0d 10 86 0b 17 db b2 4d 2f df 2b 29 e2 e3 e4 21 00 3b Data Ascii: GIF89asss\\\ccc~~~yyyIIIMMMjjj777mmmPPPVVV!,'dilzgeS_(WA H@'YB0pjA"C$axr`<`]}fQK1Pi<H>fwy1fM/+)!;
Jun 3, 2021 16:17:33.695452929 CEST	1869	OUT	GET /express/n4standard.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/about.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMT If-None-Match: W/"19654-1619547716000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49714	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:09.130692005 CEST	1064	OUT	GET /express/css/modules/tooltip.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.477128983 CEST	1076	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1853-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5432b00002bddc7b94000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Ie9TYDbFvqtJFkc1%2F%2Bp0kkDs8qzc1uHMzAKB3dL0cVncykQpXAHObc3tgtBwHYQDsrFo4ZK%2BYAIotVp0JM1P%2B3hacIyDBkPLnosTfonUFzRWAxx%2BLAMYc8XoHwEe1XiqAFE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b184a382bdd-FRA Content-Encoding: gzip Data Raw: 31 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 93 51 6b dc 30 0c c7 9f e3 4f 61 d8 cb 36 2e b9 64 83 41 1d fa 50 ee 56 38 e8 68 d9 e5 61 af ba d8 49 44 1d cb 93 7d ed d2 b2 ef 3e 92 de d8 18 c7 56 ae b7 52 bd d8 16 b2 f4 d7 4f 68 fe f6 48 36 17 f3 f1 90 d5 e5 e5 45 b5 ba ca 16 eb b5 3c c0 7e 4f b5 20 17 99 6c 90 e0 bd 01 06 57 1b 49 cd f8 b2 58 43 44 72 32 12 d9 88 3e 64 7f 4f 75 9c 06 ff 95 4b 62 ef 89 63 78 28 fd 18 58 ab e9 83 04 37 c8 9e f4 d6 1a 59 87 20 d9 7c dd 22 1b 2d 37 83 8c 1d 86 c9 29 9f a5 43 91 45 f4 e2 5e 24 e7 ab 8b ea e3 67 e5 99 5a d4 6a f9 65 d5 43 6b 2a 06 17 1a e2 3e fb 84 35 53 a0 26 66 67 d6 77 f0 3a c4 c1 9a d3 7c 46 1e 6a 8c c3 e9 49 fe a6 14 49 da d3 5d ba 73 a9 3c 3b 29 85 94 89 a7 80 e3 ec 14 6c 02 d9 6d 34 a5 48 22 79 55 f8 6f a5 48 ac 69 e2 ee ba 81 fa ba 65 da 3a 9d d6 64 89 d5 ab 0f cb b3 e5 bb a2 14 89 07 ad d1 b5 ea fd 14 d8 90 8b 69 c0 3b a3 8a fc 97 a3 81 1e ed a0 6e 0c 6b 70 30 03 46 b0 b3 00 2e a4 c1 30 36 a5 48 76 59 cf 27 2b 45 a2 31 78 0b 83 da 58 aa af 4b 91 dc 60 c0 0d da 51 7c 87 5a 1b 57 8a ef 13 a0 2b 42 17 0d ff 47 4e fb 89 ec 11 b4 0f e7 83 c8 75 07 9a 6e c5 fd c8 fc 89 2a 8b 51 a5 94 7f ea 2c f6 97 7f ec 34 f3 c9 0e e0 fe 3c 9d 3d 71 02 86 99 b8 7a c1 cb b4 58 ec f0 1f 67 99 a6 b0 5b 83 6d 17 95 23 ee c1 1e bc 61 3f d1 bd f8 35 fb 01 f4 27 5c b7 3d 07 00 00 0d 0a Data Ascii: 1b6Qk0Oa6.dAPV8haID}>VROhH6E<~O lWIXCDr2>dOuKbcx(X7Y \|"-7)CE^$gZjeCk>5S&fgw:\|FjII]s<;)lm4H"yUoHie:di;nkp0F.06HvY'+E1xXK`Q\|ZW+BGNunQ,4<=qzXg[m#a?5'\=
Jun 3, 2021 16:17:09.481024981 CEST	1077	OUT	GET /express/includes/popupWindow.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.817701101 CEST	1148	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2361-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5449500002bddcc111000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4tIHPi6NiFXSPWRkJrFuT5Hm%2FER8celbEC6nBzeJ1zCUY6iXbXQ%2FAU1W2I6rvFFwPbWJdvP2SwGhx%2BQZ7IOyXHEeHCKNdZb6aN46jW2BPl0ytee9krTwSWfxc30cnEC%2Byx0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1a78612bdd-FRA Content-Encoding: gzip Data Raw: 32 36 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 94 4d 6f db 30 0c 86 ef fe 15 dc a5 4e 56 2f c9 a1 c8 c1 86 51 0c d8 a1 18 b6 61 d8 07 72 56 6d 3a 16 a6 52 82 24 d7 c9 86 fe f7 81 b2 9d da 4d 03 0c 5b 0e c3 30 1d 62 85 e2 4b d1 7c 9f 64 f9 f2 4c 6b 19 2d f9 01 6f c5 bd f8 5c 58 69 3c 54 da 82 d1 46 d2 16 1a 03 84 2d b4 92 4a dd ba 05 9c 5c e3 52 7f b8 46 a5 ce f9 82 e7 eb 0a be d4 d2 41 25 15 42 89 06 a9 74 d0 18 4d e0 6b 84 4a 2b a5 5b 1e dd 78 a0 52 a1 4b 4f cc ea 15 69 c2 73 74 f5 b7 8d 3d 8a aa 86 0a 2f 35 31 4d 1b 49 33 2f ec 16 fd d7 4f ef 92 3a 69 93 56 d2 07 71 87 89 b1 da b8 39 fc 88 00 ee 85 65 d6 3e 72 24 b9 db 6f 24 65 7d d4 6b ad f2 98 74 cc 01 59 cd 66 bd 1a f2 1c 62 63 25 f9 78 7e 71 31 93 6e e1 44 25 ac 9c cf b9 5e a7 da a3 0b b2 87 28 02 38 e8 60 28 31 87 eb 43 34 85 d8 68 d3 98 90 3f 74 c2 b9 35 bc c8 81 1a a5 38 3b ae 51 6e 6b 9f c7 70 09 35 5c 42 9c c4 ac ec a3 57 ab 55 32 d5 5f f2 65 93 02 ad 2c 7d 1d f4 ed a3 be 0b ae 9f 93 c7 fc 26 b7 c2 06 09 ef 3b d5 d1 2d fd 2c af 21 6c b8 68 d5 28 e5 0a 8b 48 39 e9 44 e9 42 b0 23 bc bf 43 6a b8 24 e9 c4 a2 93 df c5 ad c2 7c 8f 2e 71 85 d5 8a 6f 73 dd 57 2f 7c e3 38 cd 4b af b0 97 94 d2 62 e1 b5 95 c8 47 a1 93 08 20 78 06 79 ff 87 b1 d0 06 c7 ae 0f 8e 0f 2d cf b3 41 b2 a8 74 d1 b8 59 08 58 f4 8d 25 e8 ed 7f 98 62 f4 5e 97 42 3d 01 49 d8 ad 7b 86 a2 1b be 67 c3 1f af 39 e1 29 57 dd e8 6e 82 b9 3c b1 60 a4 d9 05 27 d6 ab 95 d9 0d d3 dd 04 56 02 25 7d 4a 0a f1 d5 38 83 eb 73 12 37 c2 79 fc e4 32 47 14 1d db 13 0f 8d 3c 92 16 00 29 a5 50 7a 7b 13 88 4a 0f 9c 99 5d 16 fa 9b 9c 86 56 b2 67 88 1b 15 da 30 5a e9 81 b7 69 9d ee 70 7d a2 cc 71 cf 05 92 47 9b ee d1 65 58 6e 31 75 0d 7d 43 ca 02 44 c8 14 a5 a4 b3 0e a2 b0 0b fc f0 ae 21 51 6a 4b 58 a6 dd 4f 72 04 8c ab 75 1b bc 7d 13 5a 9a 42 33 f1 ef 97 18 41 85 ce fd c7 e4 5f c5 24 d8 fb 7b a4 fc 04 49 Data Ascii: 265Mo0NV/QarVm:R$M[0bK\|dLk-o\Xi<TF-J\RFA%BtMkJ+[xRKOist=/51MI3/O:iVq9e>r$o$e}ktYfbc%x~q1nD%^(8`(1C4h?t58;Qnkp5\BWU2_e,}&;-,!lh(H9DB#Cj$\|.qosW/\|8KbG xy-AtYX%b^B=I{g9)Wn<`'V%}J8s7y2G<)Pz{J]Vg0Zip}qGeXn1u}CD!QjKXOru}ZB3A_${I
Jun 3, 2021 16:17:09.820899010 CEST	1148	OUT	GET /express/css/modules/content.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.151787043 CEST	1165	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2627-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d545dd00002bdd43828000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Yzo7%2FkQ0cTKq0BqfMW7joVi8zofHKIE1Wi4R0TtiYK43UZc16MG85YF3xVtCAir1ez8bshALMYTCCrOHr3O2cIZUHk1ornjv9V8IpLUahyiDy%2FAMdPhMV8CJy1ku6hUz7N8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1c9e392bdd-FRA Content-Encoding: gzip Data Raw: 32 36 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 56 51 6f da 30 10 7e e7 57 9c 34 4d da aa 92 80 b6 27 fa b4 b2 a2 3d 4c 5d d5 b2 e7 ea 92 5c 1c 6b c6 b6 ce c7 28 9a f6 df 27 3b 50 a0 d0 96 b6 d1 82 94 08 fb fc 7d f7 7d 97 e3 c8 4f 3a ba f2 5e 1e 1f 30 fe 71 39 bd b8 9c 66 e3 9b 1b 78 c5 b5 0d f5 33 50 05 c5 12 d0 2e c1 a3 22 58 68 69 00 a1 74 56 c8 0a 78 b4 64 32 80 b1 b3 c2 ce 04 90 86 1e 81 42 ef 09 19 6d 49 e0 ea 14 b7 06 a9 19 67 da aa 53 98 21 2b 6d c3 29 34 5a 35 46 ab 46 c2 29 90 94 d9 2e 54 37 5e 3d 89 b5 ce 6d 8a 85 a1 96 fc 79 df 93 59 e2 92 1e ea cf fd 8e 48 64 42 d0 16 10 14 e3 f2 de b8 c3 66 75 a3 30 5b 71 5f 45 ae de 9f 5e 24 f1 58 55 da aa d1 c0 df 9d a5 85 02 cb 5f 8a dd dc 56 fd d2 19 c7 a3 77 93 c9 e4 ac f7 77 f7 74 f2 61 05 91 9f 40 45 42 3c d3 96 02 2c 1a 92 86 38 69 4d ca 0a 77 17 75 6e 6b 4f 62 21 08 93 94 0d 05 18 0e 06 ef 61 a1 ab f8 2a d9 2a 77 0c 0d c5 6a c3 49 9e 18 d2 d6 28 46 b5 39 b6 bb ab 85 4d 66 5f 98 f0 81 ac 61 d2 b5 09 d9 ce fb 48 d4 6f 84 15 f1 b5 5b ac 8e 6d 19 a4 67 a8 68 34 67 f3 21 cb f2 2c cb d3 f7 90 0b 16 e9 36 8c b7 6b b7 38 57 53 6d 28 53 ba fe b8 e7 31 93 27 94 51 fb e8 ef d7 c0 bb a0 45 3b 3b 2a 9c 88 9b b5 fb bf 89 45 97 68 fa 68 b4 da 6c 1d c8 f9 d6 50 2d 63 c7 96 f8 75 e9 9f bb 6a d9 9e bf 15 e7 bf 53 2d 2b 1d 87 c8 38 1a d8 1d db 75 84 db a3 8b 31 9b 6a ec 14 ed 80 37 e2 fc c3 c3 c9 93 d7 e7 d7 56 33 81 1c 53 d2 e5 1e 7d 72 e9 cd fc bc 65 ce cb 12 d8 a7 5e 35 fa c5 e7 f8 39 7b b2 81 26 ce c9 1b ba 61 4b 40 fb d6 fe cf ae b8 cf bd cb ae 68 69 0e 36 c6 86 af cb c6 68 09 77 7b e3 a8 d9 95 46 4e 78 66 78 ad 67 d7 15 53 20 2b 18 5d 86 da 31 54 ba ae 23 48 a0 32 ae 85 87 43 7b 77 80 75 3f bb 82 a0 cc c3 81 9f f8 4f fe 0e 86 47 8c 2f 65 5c 81 e6 0a 15 7d a5 50 3e 01 04 83 23 11 d1 10 3f 36 74 5e 86 e4 f7 b3 6a ff fb f4 db 6a 6f da 90 98 1d 3f 1b f6 0f d5 04 d4 d9 43 0a 00 00 0d 0a Data Ascii: 264VQo0~W4M'=L]\k(';P}}O:^0q9fx3P."XhitVxd2BmIgS!+m)4Z5FF).T7^=myYHdBfu0[q_E^$XU_Vwwta@EB<,8iMwunkOb!a*wjI(F9Mf_aHo[mgh4g!,6k8WSm(S1'QE;;EhhlP-cujS-+8u1j7V3S}re^59{&aK@hi6hw{FNxfxgS +]1T#H2C{wu?OG/e\}P>#?6t^jjo?C
Jun 3, 2021 16:17:10.175268888 CEST	1166	OUT	GET /express/css/modules/header.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.498203993 CEST	1177	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1517-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5473f00002bdd67a75000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VXRzFD%2F4iMPUmljnCojz7VLitquIeAlyopPagufj3LyCtABEM5ihLY8%2B680HSnZ1i6R%2Bbs26pZhmOdAPJhRn2cMUqorc8353MnVFpjYAXT9DXV1iD72pglpmFL%2FflkbtOgc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1ecc1c2bdd-FRA Content-Encoding: gzip Data Raw: 31 66 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 53 51 6b db 30 10 7e b6 7e 85 a0 2f db 88 e5 66 a5 19 c8 4f cb da d2 c1 1e 46 9b 3d 0f d9 3a 3b 47 14 9d 90 e5 24 5b c8 7f 1f b2 1d 96 25 59 57 46 e9 09 24 74 67 7d fe ee bb bb ec dd 0b 59 c6 b2 78 f0 fb db 8f 37 b7 0f e2 d3 e3 23 ff 1f 3b 80 7a 19 56 ff c0 e2 f7 a0 34 78 fe 55 59 30 fc 59 19 7e 6b 40 f3 8a 3c 9f f7 4f 95 07 35 e2 68 4b d3 6a b4 f5 de 1d 54 d1 88 d7 c8 50 f4 3f 9c a9 e2 0b da c5 88 ff 79 ff ae ca 80 2b 60 5b 96 14 e4 35 f8 34 90 93 63 b7 e1 0d 19 d4 fc e2 ee 3a ae 9c 25 25 19 f2 f2 62 32 99 e4 2c 09 b0 09 a9 86 92 bc 0a 48 56 5a b2 10 bf 69 7d 43 5e 3a 42 1b c0 e7 2c a9 c8 86 b4 c1 9f 20 c7 97 6e 93 b3 c4 29 1d 55 90 fc ca 6d 78 e7 4b 58 a2 b1 71 46 fd 90 85 a1 72 91 b3 64 3d c7 00 69 e3 54 09 d2 d2 da 2b 97 b3 64 05 3e 60 a9 4c aa 0c d6 56 2e 51 6b 03 39 db ed 13 7c a0 35 db b2 28 61 a1 ca 45 ed a9 b5 3a c5 a5 aa 41 b6 de bc 11 22 13 22 eb ee 4d 16 c5 8f db fb b8 3d d0 7a 5a cf d0 80 a8 b1 7a 9b 1f 43 78 70 a0 82 ec 8f 74 73 12 77 d4 60 a7 41 41 21 d0 b2 8f 1f 91 dd 87 76 4c b4 01 4d 14 7e e0 3a a8 fa 61 1a 57 ff f6 bc b6 31 72 a0 e6 38 aa 79 00 27 e7 b4 02 3f 80 1e 23 b4 56 83 37 68 3b b9 9e 6c 79 de 36 e0 39 da 8a b8 eb 5a 9e 3f bb e5 03 f1 a1 8e 07 20 68 79 98 c3 d0 f3 e2 b5 86 5a 44 02 9f 6d 45 dd d8 b2 6d 27 d4 e0 9a a9 c2 c0 a0 d3 52 f9 1a ad bc 72 a7 55 1d ea 72 33 8d 2b 3f 01 e0 41 0f 18 fb 86 7e 02 e4 ae b3 93 12 5e ee 5f 9c e9 81 73 13 70 86 03 c7 65 3d e2 a7 6e 35 90 fb cb cc fc ce 3d 35 50 85 9e fb 8e fd 02 64 ef 1c 4b ed 05 00 00 0d 0a Data Ascii: 1faSQk0~~/fOF=:;G$[%YWF$tg}Yx7#;zV4xUY0Y~k@<O5hKjTP?y+`[54c:%%b2,HVZi}C^:B, n)UmxKXqFrd=iT+d>`LV.Qk9\|5(aE:A""M=zZzCxptsw`AA!vLM~:aW1r8y'?#V7h;ly69Z? hyZDmEm'RrUr3+?A~^_spe=n5=5PdK
Jun 3, 2021 16:17:10.656577110 CEST	1181	OUT	GET /express/javascript/common.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.974594116 CEST	1191	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"5576-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5492100002bddc7840000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uA93hAva7Hlabe5l%2B0ZI5CTrxfK8HyBws0XPshLswG2gRNL5Ykho6jZE7Ih0VmrGYTZrduc%2BVIv8Kf2yLMKzgk4yDntksAcVDEcV3nFqtT1yktDLKICMfPEZV4Ked4XBdpY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b21cc842bdd-FRA Content-Encoding: gzip Data Raw: 35 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 58 5d 6f db 36 14 7d d7 af b8 f3 43 2d 2f a9 54 ec 31 9e 30 34 b1 07 64 68 93 a0 e9 0a 0b c3 1e 68 f1 ca 66 4a 93 02 49 d9 31 82 fe f7 81 a4 28 cb b1 5d ac 89 db 54 80 61 49 3c bc 1f 87 87 97 a4 d2 5f 8f 74 a5 51 6a ff e0 e3 9c 69 d0 85 62 95 81 42 0a 43 98 d0 50 1b c6 99 59 43 59 8b c2 30 29 34 14 84 73 a4 30 5d c3 82 88 35 48 33 47 05 00 d0 35 b5 41 9b b9 92 f5 6c 2e 6b 03 66 8e 40 aa 8a b3 82 d8 b6 04 0e 5e 5d 53 cf bc 3a a6 8e c9 d5 f1 a2 f2 b4 97 8c 23 50 ac 50 50 0d 75 25 85 63 ab 94 9c cb 15 13 33 f8 8b 2c c9 ad 1f 1a 0b d5 67 07 b8 7a 3d 55 72 a5 51 dd 0a 56 96 c9 9d 7e 72 54 3f 1b ed c7 1f c2 77 b2 20 06 41 4e ef b0 30 1a 98 a7 7c 74 fd 3e 79 a1 0c c3 a4 81 92 09 7a 3d bd 8b 17 eb 4b 3a 88 1e a2 34 e5 52 7e 0e 53 29 84 09 46 3a 24 10 30 44 cd d0 34 a9 d8 99 79 39 8a 00 96 44 01 3d 45 3e 8c 22 80 52 2a 88 ed 1b 96 bd 19 02 fb bd 22 0a 85 49 4a 45 16 a8 13 8e 62 66 e6 43 60 27 27 83 08 e0 21 b2 19 52 c8 60 0b f6 0f fb 37 a1 b2 a8 17 28 cc d0 41 58 09 71 78 93 cc d0 8c 39 da db f3 f5 25 f5 d1 c3 2f 19 f4 6a 41 b1 64 02 69 6f e0 7a 79 f3 f6 42 0e 19 d0 bd 3d 87 2d 48 a1 a9 95 00 9b 88 7d fc 12 d9 df 97 0e 5f 33 34 37 2e ce 31 8f b5 2a ae a7 77 a7 0d 25 63 7e 0a 78 5f f0 9a e2 98 7b 2a 0b 45 56 1c ea 6a 97 46 41 83 2b db 14 0c 44 b0 b1 00 19 c4 1b 73 f0 47 a7 e5 0c fa e7 d7 a3 bc 6f 63 5c cd ed 6c 6e 42 49 0c 99 5d 91 05 5a 26 82 cd c4 c8 bf ab 0a d5 05 d1 18 0f e0 d5 2b d8 c5 b6 a6 ff 0f d8 fb de 0c 9d 47 40 16 a0 7e 18 af 24 c5 61 e4 19 6c 32 f5 ed c3 c7 74 8e 97 28 4c 8c 96 31 3f c8 4c 27 0c 37 f6 11 32 58 31 41 e5 2a c1 65 a3 86 8e 55 dc 31 78 ab 8a 31 f7 06 d3 d4 a3 b4 a3 59 cb 5a 15 08 e8 87 1f 64 09 ce 20 e0 d2 58 4f 56 b1 d6 59 27 a6 61 78 af ad 4d c8 40 d4 dc 4b 23 bc c0 c4 dd 61 d0 e9 26 d7 31 77 91 1d bd 96 8c d0 a0 5a 30 81 30 79 9d 43 21 a5 a2 4c 10 Data Ascii: 514X]o6}C-/T104dhhfJI1(]TaI<_tQjibBCPYCY0)4s0]5H3G5Al.kf@^]S:#PPPu%c3,gz=UrQV~rT?w AN0\|t>yz=K:4R~S)F:$0D4y9D=E>"R"IJEbfC`''!R`7(AXqx9%/jAdiozyB=-H}_347.1w%c~x_{EVjFA+DsGoc\lnBI]Z&+G@~$al2t(L1?L'72X1AeU1x1YZd XOVY'axM@K#a&1wZ00yC!L
Jun 3, 2021 16:17:10.979486942 CEST	1201	OUT	GET /express/javascript/dropShadow.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.306339979 CEST	1225	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2700-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d54a6600002bdd5a328000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EVwmlDo%2F8Wfpdj6ad7DfDIDL93rvhjTEayhrp8jpnbof295ztu4E9IrsviatOdDbaKujZzPMSq3r0IZXi0D8XpkPUP8FcLm5riWJidZcJrjVAjykAJy1ubaSG2QTQqMO040%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b23d9b92bdd-FRA Content-Encoding: gzip Data Raw: 34 35 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 56 db 6e db 38 10 7d 16 bf 62 d6 1b 20 b6 1a 48 49 16 dd 8b 5d 77 db 26 46 1b a0 75 8a d4 8b 5d 3f d2 e2 c8 9a 96 26 05 92 b2 aa 2d fa ef 0b 52 f2 ad a9 13 14 fb 60 58 a4 e7 1c cd 39 33 1c 3a 8d 59 0c 2f fa 3f 0f 84 d1 e5 87 82 0b 5d 27 1f 2d 9c dc e1 9a 2c 69 35 84 8b e4 02 4e e0 e4 9a 3b 1c c2 e5 f9 f9 2f e9 f9 1f e9 c5 25 5c fc 36 bc fc 7d f8 f4 57 38 61 9e e3 4a 97 8d a1 65 e1 60 ca d7 64 e1 4a 9b 52 1b ee 48 ab 80 62 31 bc 94 12 ee 7c 88 85 3b b4 68 d6 28 3a a8 ca 49 a0 72 c4 25 dc a8 5c 9b 55 8b d3 f9 7d 32 16 c3 5f 8a 57 ae d0 86 fe 45 01 95 45 20 0b d6 19 ca 9c 6c a0 34 ba a0 05 b9 8e 7b 56 90 85 5a 9b 4f 90 69 e5 38 29 0b 6b 2e 2b be 90 e8 77 76 ef 2d 8d 2e 0d a1 e3 a6 01 67 b8 40 b0 98 19 74 2c 06 7a 24 25 e0 4a f8 1c 4a a3 1d 66 0e 05 2c 1a b0 25 66 94 53 c6 62 e0 4b 83 b8 42 e5 6c 88 cc 51 a0 e1 12 b2 8d 63 c9 5e 96 da 00 57 0d 94 dc 38 70 05 1a d4 39 8b 61 c5 1b 50 da c1 02 41 90 cd a4 b6 28 ce 7c 9a ca ae c8 39 bf c8 74 49 fe 5b 1b 30 58 1a 2d aa 0c 05 90 4f ae 61 31 78 05 fe b7 15 0a aa 56 50 93 2b 74 e5 a0 34 a4 0d d4 c6 93 28 d8 d8 da aa ca 8d 5e b5 62 43 8d b6 72 13 16 a7 8c a5 b1 b7 f7 7a db 35 de 00 0e 4b 54 5e 5b a8 8c 5e 7c c4 cc ab e0 0e 32 ae 60 81 2c 8e 2a 8b 02 9c 86 8c 5b 07 36 20 2d 2c b0 20 25 3c 9c d6 a8 3a 60 12 ea f7 62 8d c6 f7 e1 8f 76 24 bc 68 c5 0c e1 4a f2 06 a6 58 3b df 3b 6d e6 2c 86 9b 77 ef df 4e de 4d a6 b3 97 b3 9b db 29 4c 6f 67 93 0f 43 16 47 91 77 86 94 f7 de f7 87 75 a6 ca 9c 36 de bf b0 d7 89 6a 74 05 35 d9 c2 4b f1 49 03 ef c4 9c 01 17 22 44 e6 5a 4a 5d 93 5a 06 da 28 4a 53 78 35 79 7d 33 6d 57 ae 20 9b b4 10 18 83 c2 7a cf ca fe 60 b4 1f 84 ae dd 7e af 2d 85 c2 8c c1 a2 db 85 6f f6 f7 41 06 bf 07 0b bb 47 81 69 0a 93 e9 b5 77 fd c0 85 53 5b e8 fa 34 34 b7 76 4d 89 3f a6 f0 db 2c b6 da d2 34 bc 2c 65 0c 7c 2b 41 fb 81 d9 2d Data Ascii: 450Vn8}b HI]w&Fu]?&-R`X93:Y/?]'-,i5N;/%\6}W8aJe`dJRHb1\|;h(:Ir%\U}2_WEE l4{VZOi8)k.+wv-.g@t,z$%JJf,%fSbKBlQc^W8p9aPA(\|9tI[0X-Oa1xVP+t4(^bCrz5KT^[^\|2`,*[6 -, %<:`bv$hJX;;m,wNM)LogCGwu6jt5KI"DZJ]Z(JSx5y}3mW z`~-oAGiwS[44vM?,4,e\|+A-
Jun 3, 2021 16:17:11.327986002 CEST	1228	OUT	GET /express/images/up.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.661987066 CEST	1280	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 172 Connection: keep-alive ETag: W/"172-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes cf-request-id: 0a73d54bc100002bdd9c9c3000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uHibRlUVuYCJv4toHQ5XEZt%2Fr7LGsEHT0onYIl6VlPUZ%2B9AtUTMgLIsiU2SlZFsCmdr5vaesop6s%2FDBYetaxkFJc9GsXHv3Ror%2B3a25s%2Bd1lxPfyPrvON6s0S9JRn9WdIf0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b260fad2bdd-FRA Data Raw: 47 49 46 38 39 61 08 00 0c 00 c4 00 00 00 00 00 02 02 02 06 06 06 08 08 08 41 41 41 f0 f0 f0 11 11 11 03 03 03 f8 f8 f8 fa fa fa 09 09 09 1c 1c 1c 2e 2e 2e 07 07 07 33 33 33 0c 0c 0c 15 15 15 20 20 20 05 05 05 13 13 13 0a 0a 0a 1d 1d 1d f1 f1 f1 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 17 00 2c 00 00 00 00 08 00 0c 00 00 05 29 e0 75 3d 62 29 0e 84 79 02 8c da 00 c0 22 1a c1 01 03 d5 75 ef d2 7e 2b 02 41 e0 36 29 51 60 11 13 cc a1 02 40 54 3a 55 08 00 3b Data Ascii: GIF89aAAA...333 !,)u=b)y"u~+A6)Q`@T:U;
Jun 3, 2021 16:17:11.885226011 CEST	1406	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: webaccess.gaports.com Connection: Keep-Alive
Jun 3, 2021 16:17:12.211294889 CEST	1468	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:12 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: keep-alive Last-Modified: Thu, 13 Apr 2017 16:11:34 GMT ETag: W/"47e-54d0e9428d616" Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d54def00002bddaeb8b000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iyIUBgxQm1R5ycV9IEpj4d1LQCwcANRCddG3tW9t6nCCABzNuX9A6YdmLbdnUd22CNoEua2lp1yQ3P0OY0kTdE6eEnSo3YuCtDx0qBo2HbFbnmunKgZsM5XjDl0fwaLrTes%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b29796c2bdd-FRA Content-Encoding: gzip Data Raw: 31 36 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 92 bb 4e 42 41 10 86 87 84 ce 86 58 68 8b 9d 9d 4f 60 7c 0a 0b 3b 1b 13 7b 63 69 69 d4 56 0b 0b 04 35 a1 92 4a 62 21 88 48 42 bc a0 41 2e e7 a0 92 53 00 02 39 08 22 28 37 11 76 7f e3 1e 40 28 c4 5b 61 e3 97 4c 66 67 26 ff ec 64 67 89 74 a4 23 83 81 48 47 46 9a d5 13 0d 11 d1 28 11 19 88 c8 48 5a 5e a0 27 1a 1c d0 ac 0d fe f9 7b 38 07 67 4d 70 ce 5b 21 03 67 4c f3 5d 06 f0 cf 1a f5 b9 e2 e3 5a a5 70 87 44 c0 85 52 3e 8d 46 bd 8a 8c e2 c7 6d e8 08 6a d4 07 35 7a 8e 5c 5c 46 22 e8 46 a5 90 e9 cc d7 4d 22 e0 c1 c2 18 c1 be 38 29 62 d9 b5 0d e5 74 17 be 9d 65 48 0e 0b a2 5e 1b e4 83 2d 94 ee 53 a2 ce 9a 8d 1e 7d 32 ec c1 d2 04 61 7d 6a 18 f1 80 0b 8a 6f 0f 91 43 2b 24 e7 26 2e ed 6b 90 9c 16 c4 fc 0e 84 f7 37 10 76 98 71 e5 b6 8a 39 db a4 23 c7 42 6b 9a 1e 81 6d 7e 1c 39 c9 8d e7 72 01 95 62 16 e5 07 55 d8 63 26 86 94 ec 45 b5 98 c5 53 2e d9 f3 1e 2f b5 32 94 33 3b 4e cc 73 30 ad cc 60 35 98 ec ec e5 ab 34 ea 35 e4 63 21 dc 5c fb 71 51 6a 69 df f6 da f2 da 99 bd e7 fa ee 8d ff e4 13 89 fe 8c 31 b0 6f c8 e9 97 bc 02 9c 9d 82 1b 7e 04 00 00 0d 0a Data Ascii: 169NBAXhO`\|;{ciiV5Jb!HBA.S9"(7v@([aLfg&dgt#HGF(HZ^'{8gMp[!gL]ZpDR>Fmj5z\\F"FM"8)bteH^-S}2a}joC+$&.k7vq9#Bkm~9rbUc&ES./23;Ns0`545c!\qQji1o~
Jun 3, 2021 16:17:30.500962973 CEST	1769	OUT	GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive
Jun 3, 2021 16:17:30.826843977 CEST	1770	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Last-Modified: Fri, 23 Sep 2005 20:23:59 GMT CF-Cache-Status: DYNAMIC cf-request-id: 0a73d596a700002bdd8f39f000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lWBfNEB7fXngB%2Fd6u0vmGiNoNRgeXNYRq5JAmhxzFDD1gkfGWiXbYtJjNPb5dZypidpqow30ZsF3Xd9Lm1bu9t1hvusQkx3wVbAwBKsoIi44TEPMBSk7nvfnX9LqzFgeOMA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65998b9dddad2bdd-FRA Content-Encoding: gzip Data Raw: 63 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 3c 8e cb 0a c2 30 14 44 f7 85 fe 43 cc be bd 82 ae b4 2d 14 29 28 f8 26 ea 3a 4d ae 36 52 9b d0 5c 51 ff 5e 5a 1f ab 19 e6 30 cc 24 03 6d 15 bd 1c b2 8a 6e 35 73 f7 b2 36 8a f1 08 e0 31 52 00 9a f4 07 8c e3 21 a3 56 36 de 90 b1 8d ac 01 b0 e1 59 18 24 1d ed 15 a5 ee 74 55 88 9c cd 85 d8 46 c5 ee b0 38 a6 7c 8f e7 16 7d c5 d9 6c b3 16 c5 5a a4 7c 38 0d 83 c3 7e 99 56 44 6e 02 f0 c0 52 2a 85 de c7 17 e9 6c 4b 3e 56 f6 06 f8 74 2d 7a 0f a6 d1 f8 8c af de f5 6b 64 a8 c6 ec 84 65 de 37 12 f8 04 61 90 c0 ef 40 69 f5 ab 0f fe e6 7b 31 0c de 00 00 00 ff ff 03 00 28 98 81 37 ed 00 00 00 0d 0a Data Ascii: cd<0DC-)(&:M6R\Q^Z0$mn5s61R!V6Y$tUF8\|}lZ\|8~VDnR*lK>Vt-zkde7a@i{1(7
Jun 3, 2021 16:17:31.409764051 CEST	1771	OUT	GET /express/index.jsp HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.752535105 CEST	1773	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:31 GMT Content-Type: text/html;charset=ISO-8859-1 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC cf-request-id: 0a73d59a3500002bdd9c9c4000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=03J1WNJsxu7m0p7N14BRurBr7FVz8mQuU8cihBPWXL7WBsEZjUZjKb%2FkxzTpXMzk09WqkU7NvDh23m2Sk5HVWOaHTWvat63CY1CMOv3jOotOA%2FM8IMgZ%2B8gq974hCfFQ8tE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65998ba38ba02bdd-FRA Content-Encoding: gzip Data Raw: 33 62 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 55 51 73 da 46 10 7e ee fd 8a 1d 3d 10 18 40 18 3a 4e 6c 63 e1 71 09 4e dc 31 24 c1 72 da b7 ce 21 2d d2 35 a7 3b f9 6e 85 61 3a fe ef 9d 93 84 0d 4d 9c 78 da b4 53 f1 80 6e 6f 77 bf 4f fb 7d d2 31 c6 18 3b 4d 29 93 23 76 9a 22 8f 47 ec 87 f2 c7 d8 e9 74 12 9e c3 db 30 7c df 9d 7c b8 b9 fc 18 78 ef 0d 4f 32 ee c1 f8 dd 2c 9c cc c2 c0 9b e9 ee 98 47 29 7a a3 3a 3b 25 ca bb 78 5b 88 55 e0 8d b5 22 54 d4 0d 37 39 7a 10 55 ab c0 23 5c 53 cf 01 0e 21 4a b9 b1 48 c1 4d 78 d1 3d 7a e8 b1 8b 38 59 e7 c2 a0 dd 81 0c 0b 84 f3 22 81 c1 00 fa 47 27 87 3f 9e f4 0f e0 cd 34 84 fe f1 ab 43 d7 22 43 e2 7b 34 7e ed de 9c 77 c7 3a cb 39 89 85 dc 65 72 39 09 8e 3d 18 3d 0e a0 9c 05 09 92 38 0a 75 cc 37 a7 bd 6a c1 9e ba 4e 6d 64 44 4e 40 9b 1c eb 27 fb 9d af 78 15 f5 40 72 95 14 3c c1 c0 fb 99 af f8 75 15 1d 31 d6 eb c1 2f b8 e0 51 84 d6 c2 e3 16 5c 89 85 e1 66 03 cd a8 05 83 83 83 03 b8 d0 86 0a 41 1b 18 6b 65 0b 49 42 25 3e 9c 4b 09 73 91 a4 64 61 8e 16 cd 0a 63 9f f5 fe d9 e5 28 d9 1c 23 b1 dc 00 a5 08 8a 67 08 7a 09 1c 1c 80 44 02 4a 39 81 41 9b 6b 15 5b 20 0d 06 6f 0b b4 64 4f d8 8a 9b 6d da cc d5 05 e0 bd 16 36 e7 14 a5 68 bc e1 f7 e0 36 59 93 e1 11 95 dc 6e e6 57 8e 9a bb 8d 0a 63 50 11 c4 c2 60 44 da 8d ce 85 79 9e 4b 11 71 12 5a 55 6a af a9 75 c2 96 85 8a ca 50 82 34 ae a2 cd 16 fb 83 2d 85 b1 74 2d b9 4d d1 42 00 77 42 c5 fa ce 97 ba 6a e0 a7 06 97 be 50 31 ae df 2d 9b 5e af e7 b5 86 cc 62 a4 55 5c d6 7c bb c2 eb ec 21 b4 61 d0 1a 32 4a 85 79 7e 83 5d bc 36 f4 5b c3 72 e6 39 a7 27 ab 6d b1 b0 64 84 4a 9a 07 9d 1d ac aa d8 20 15 46 95 f5 43 76 ff 3d f4 99 f2 4f 08 7c eb 09 58 6a 53 ae 72 6d c8 79 85 43 fc 60 88 ad 55 3a 5b c3 09 95 40 aa 6d f5 16 75 5c b7 ba d0 99 b0 e3 7a 65 9c a0 f9 36 9c 5e b9 1a 83 3c b6 29 ba 06 48 51 ab 03 5c c5 ce a7 42 25 12 21 e7 86 67 48 68 76 f4 ae 59 cd cb ae 4d 07 e5 3e 49 9d 1a 66 b6 83 e2 ec 50 18 09 01 34 77 4d 02 6d f0 6a d6 3d 0f da 7b 66 6f 83 77 96 21 a5 3a 0e dc 33 4a be a9 70 1a 5b 9c c0 55 6c 17 2e bd 51 72 2c c3 8f 0c ca 8d 8a 44 b9 53 3f b5 8b 8a 38 e8 bf 1c 0c 5e 0d 8e 8f 0e fb 2f 07 87 ce 80 3a 47 d5 2c 8c ec 80 f7 1b e9 dc 7b 14 95 4c 81 ff 8e a8 cf d1 b1 9a 44 29 c9 57 94 98 96 Data Ascii: 3b7UQsF~=@:NlcqN1$r!-5;na:MxSnowO}1;M)#v"Gt0\|\|xO2,G)z:;%x[U"T79zU#\S!JHMx=z8Y"G'?4C"C{4~w:9er9==8u7jNmdDN@'x@r<u1/Q\fAkeIB%>Ksdac(#gzDJ9Ak[ odOm6h6YnWcP`DyKqZUjuP4-t-MBwBjP1-^bU\\|!a2Jy~]6[r9'mdJ FCv=O\|XjSrmyC`U:[@mu\ze6^<)HQ\B%!gHhvYM>IfP4wMmj={fow!:3Jp[Ul.Qr,DS?8^/:G,{LD)W
Jun 3, 2021 16:17:32.142391920 CEST	1809	OUT	GET /express/javascript/globalEvents.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"3702-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.193761110 CEST	1815	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"3702-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59d0e00002bdd6299b000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lcLldJTLFpN7C0ztaYlsDlrHoNtsT4BGyd0Y26h5VFducjHU%2B0aio7MLKk5qCSC7i9jSvMOAJmSSbpBvVOiYAyJMyRk4EbWU2ilZZEqhHKYROt8dJ8UNXXkTNGLrdb60QTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba818522bdd-FRA
Jun 3, 2021 16:17:32.194751978 CEST	1816	OUT	GET /express/includes/simplecalendar.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"18756-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.246464014 CEST	1822	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"18756-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d4300002bdd90bbe000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=pDG0zbKBlYQxM70CdaUDYXU%2FZKM7dsFsn70yUM7dO%2FdE9zfmWflmA0N9RGGuZcp36IO%2Fz%2BSQ%2BhXxFIXEhGtolE%2FwepMvpq6hUhWoQ3Wjn8qixfC3fKmiYSaKOeQAbZHUAcY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba8691f2bdd-FRA
Jun 3, 2021 16:17:32.259030104 CEST	1822	OUT	GET /express/images/up.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"172-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.310175896 CEST	1826	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"172-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d8300002bdda6ba4000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=l8pRwODwUTtW9gBU8aPafrZK71DYtbh3IwLHgwr7MgHK%2B3txGavkesqx9vdeWK2QAJKAWhGwAW5RlIoDFKqV4oVpbxiYKh%2BiWRNuU9vfdYGIFJJisaaXKkydF1sQRB%2FD1oQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba8da2f2bdd-FRA
Jun 3, 2021 16:17:32.407236099 CEST	1828	OUT	GET /express/images/icons/pdf.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.456654072 CEST	1831	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:32 GMT Content-Type: image/gif Content-Length: 980 Connection: keep-alive ETag: W/"980-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4136 Accept-Ranges: bytes cf-request-id: 0a73d59e1700002bddaebc8000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JNw2EXhKCSZcYNXZ5ZMXWpX0xO3NgEsYcKYqewsHaJJ6R6f6VPiVLmACAHiqsWdcyNbwTq%2FV0QMkFGvhVY92RkdiLORbKWpi66s2n5dNAMBrC6HexlqNXqDrHI5XKpfPOd8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba9bc7c2bdd-FRA Data Raw: 47 49 46 38 39 61 14 00 14 00 f7 00 00 9e 9e 9e 73 73 73 5c 5c 5c 85 85 85 63 63 63 a5 a5 a5 eb eb eb 7e 7e 7e 99 99 99 79 79 79 b1 b1 b1 49 49 49 8c 8c 8c 4d 4d 4d 6a 6a 6a 91 91 91 37 37 37 6d 6d 6d e1 e1 e1 e7 e7 e7 95 95 95 a8 a8 a8 ab ab ab 50 50 50 d3 d3 d3 cb cb cb 56 56 56 df df df d9 d9 d9 94 94 94 be be be cc cc cc 00 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: GIF89asss\\\ccc~~~yyyIIIMMMjjj777mmmPPPVVV
Jun 3, 2021 16:17:33.692537069 CEST	1868	OUT	GET /express/css/main.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/about.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1732-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49715	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:09.175164938 CEST	1065	OUT	GET /express/css/main.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.514539003 CEST	1086	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1732-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5435800004eb551905000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=rbWXcunaNRg1D6YQRsokXxvFk4AunZ5IIBioH1%2Fy%2Bh6TYtCRtQfjx7rAMDZgjF74d0YnHwQtVnxWY%2F7%2FMaH2csWjJggambox4nvOiT1Sw72M7aY3fBUfw6VPfhoC5w4nTq8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b188df64eb5-FRA Content-Encoding: gzip Data Raw: 31 66 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 54 5d 6f d3 40 10 7c cf af 58 15 a1 b6 51 b0 c3 6b 22 24 50 4a a4 3c 14 45 2a fc 80 b5 bd b6 4f ac 77 ad bb 75 53 83 f8 ef e8 6c e8 07 42 0e 85 88 7b 39 9d 6e 3c 3b 3b be 9d 74 7e a2 95 ce d2 b8 c1 f5 bb dd 87 64 73 73 03 7f b7 1e 53 7d ac 5d 00 17 c0 6a 82 d6 bb 06 7d 0f 91 b9 74 4c 0b e8 02 15 90 f5 80 cc d0 62 45 11 87 06 d8 b6 84 fe 57 2a 27 03 4b 83 4e 22 82 5d 8e e6 54 e0 e0 a4 d0 43 f2 0c 55 a7 f1 ea 18 17 b8 a6 55 6f 61 2c fd 27 be ef 86 0f 06 37 86 4e b5 e8 18 3d 04 eb 99 42 4d 64 e1 de b1 c1 85 5c c5 48 6c b4 2e 79 62 d6 95 82 a8 41 5e a3 54 34 b0 a9 2f c8 83 96 f1 10 e8 a7 b8 e4 3f 99 f5 76 ac 07 9d e7 8b b3 a1 31 0a 69 a9 62 49 1e c2 d9 e5 fa f7 80 86 a4 9b 04 60 1e 9f 40 86 7e 12 65 aa 6c ae 9d c4 fc f0 72 12 23 78 bb 47 a1 49 4c d6 99 a9 4c cb c1 8c a7 49 4a f5 cd 31 8a c9 fb 9a b0 a0 69 53 42 8d 71 6c 26 ed d7 02 f9 ca 21 6b 35 ed 1d 32 49 71 e4 27 60 db aa 13 6b 1e 99 7c 7c 84 2a d6 0c f9 19 23 b4 51 31 af 3c 06 4e a1 79 17 eb 41 a6 45 0f ce 02 71 99 00 ec 19 73 82 ac 82 5c 59 7d 58 40 83 be 72 12 16 4f f3 86 2c 4f a0 26 4f c9 bf a6 e0 69 46 28 36 31 fb 3a 8b dc a3 e0 d5 b2 bd 5b 0f e7 0c f3 cf 95 d7 4e 8a 57 43 4f ab 17 db ed 76 bc 4a e7 a0 b7 e4 4b d6 c3 0a 3b 53 c8 b1 0b 31 68 e3 23 84 9a 5c 55 db 9b d7 cb e5 4b 28 d1 71 e7 29 e6 ec b5 7e 71 cc 98 00 7c 0a 4e 2a 40 01 ba 6b 3d 85 10 03 97 24 44 9c 0a f7 b0 7b 0f 2a b0 df c0 c1 31 c7 74 02 8b 89 8f 66 de 65 9d 51 02 f3 74 d0 71 2f e2 81 e8 e2 3c 0a 3a bf 5c cf be cd be 03 5b b4 6d ba c4 06 00 00 0d 0a Data Ascii: 1fbT]o@\|XQk"$PJ<EOwuSlB{9n<;;t~dssS}]j}tLbEW'KN"]TCUUoa,'7N=BMd\Hl.ybA^T4/?v1ibI`@~elr#xGILLIJ1iSBql&!k52Iq'`k\|\|#Q1<NyAEqs\Y}X@rO,O&OiF(61:[NWCOvJK;S1h#\UK(q)~q\|N@k=$D{*1tfeQtq/<:\[m
Jun 3, 2021 16:17:09.519903898 CEST	1087	OUT	GET /express/javascript/ieEmulation.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.846472025 CEST	1150	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"6959-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d544b000004eb51a3e4000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=o4igNRHGtAOqzD%2FTa3qLI0FFMSNRcx5wMuRNl5yEIe7SsYuzSs1myarylsarjZZxUNlU97AIlmQiB%2Fxo5xObjxWk6I53TiiC%2Bohu%2FOmhz3bRQ%2BcarvYUJ7a2J9MgrrAwGoU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1abca24eb5-FRA Content-Encoding: gzip Data Raw: 36 31 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 58 6d 6f db 36 10 fe ee 5f 71 cd 87 5a 1a 1c a5 fd b2 0f 35 02 ac ed d2 ae 43 5b 14 8b b1 35 18 8a 80 92 4e 12 5b 9a 14 c8 93 5f 56 e4 bf 0f 24 f5 6a 3b b1 d3 26 5d 3b c1 b0 0d 91 7c ee 78 f7 f0 8e 77 27 3f dd d1 73 32 3a b1 3f 30 2b b8 01 93 68 5e 12 24 4a 12 e3 d2 c0 5c a5 3c e3 09 23 ae a4 01 52 f0 46 fd c3 85 60 50 6a 45 8a d6 25 1a a0 82 11 40 1f 8a 09 a1 96 cd d4 e3 98 19 4c 21 d6 6a 69 50 3b 10 9c 57 82 11 5a 90 52 73 24 a6 d7 f0 ea 0c 9a a7 0f 95 55 32 b1 c2 99 e0 b4 8e e0 b6 4f 1f ea 2b 9f 1e d4 5d 9a fd ee b4 f2 1e cc b8 40 48 b1 44 99 1a a8 4a 25 81 0a 84 4c 59 97 70 99 c3 ef 6c c1 ce bd 97 ed 54 f3 e4 1a 5b 1d 4b 25 f1 2e b4 fa de cc 7e f7 2e 6c ce 44 aa d0 c8 31 41 c1 16 08 0c 12 c1 93 4f 41 08 73 a4 42 a5 90 29 0d 4c 26 85 d2 40 2c 37 11 c0 ac c0 2d ba b7 7e 4a 54 8a 90 68 64 84 06 94 c4 e8 3f 31 16 cf 02 7b c8 55 06 bf cd de bc 7e ea d4 3f 13 38 47 49 0f 4e 8f 2a 99 62 c6 25 a6 47 f0 f0 21 3c d8 9a 12 b5 51 22 72 c6 08 47 9f 47 56 cd bd 13 e1 b4 3d f8 41 08 9f c1 ad 5a 30 0d b8 20 38 05 2a b8 89 d4 52 a2 fe 55 25 95 03 f0 96 3a 5b a0 a4 60 fc 46 55 c6 ff 37 e3 70 ea 57 e3 82 22 2e 39 75 63 c1 d8 c9 1a 4f 80 74 85 ed f7 36 76 8a 19 ab 04 fd c9 71 39 81 c7 13 78 d4 fb 64 4c 18 bc e6 e7 d1 04 64 25 44 a3 81 43 4e b9 29 19 25 85 d7 00 17 e4 47 af 46 57 f7 48 cc 25 17 02 34 52 a5 25 30 20 5c 11 48 4b af 80 67 96 5a 80 2b 6e c8 84 8e a2 d7 9c 62 a3 93 c6 57 9e b8 1d 53 1d 7a a6 74 82 56 a0 8d ef 4c 2c d9 da b4 12 e5 10 0a 5b 9c ef 23 20 74 1c 77 4e 19 f0 da 33 d6 bd ef 71 f4 f2 d2 8f bf 44 22 d4 97 97 c1 51 67 9e a3 49 4b 5d b0 dc 75 ae 77 dc 75 26 af c9 4b 4c e7 48 53 3f b8 2c 6c cc 0e ec 78 64 bf 66 eb 12 e1 c1 29 3c 0e 9b 35 6e a8 64 1a 25 bd 55 29 d6 eb 6a fb ca fa cd 55 38 bd 57 16 55 06 0d 08 b6 46 7d 01 4c a6 fe ef 7b e0 d2 10 b2 14 Data Ascii: 611Xmo6_qZ5C[5N[_V$j;&];\|xw'?s2:?0+h^$J\<#RF`PjE%@L!jiP;WZRs$U2O+]@HDJ%LYplT[K%.~.lD1AOAsB)L&@,7-~JThd?1{U~?8GINb%G!<Q"rGGV=AZ0 8RU%:[`FU7pW".9ucOt6vq9xdLd%DCN)%GFWH%4R%0 \HKgZ+nbWSztVL,[# twN3qD"QgIK]uwu&KLHS?,lxdf)<5nd%U)jU8WUF}L{
Jun 3, 2021 16:17:09.850696087 CEST	1151	OUT	GET /express/css/modules/navPane.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.175813913 CEST	1167	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"3126-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d545fd00004eb5191b4000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LnJ8NsC08Mn65L2JGSl0CfCsfNIMT%2F92GFTA4Gv69Um2Jt7Lqbx42pnsVNw37rrjqZBjmZJLuX3mfZn7E%2FNESk6q1jx0pEQyzl%2FHdFiMIQ17%2FjrwQRkr8NP0tLTyK%2FV7s7A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1ccaf94eb5-FRA Content-Encoding: gzip Data Raw: 32 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 55 51 6f 9b 30 10 7e 86 5f 61 a9 9a b4 4d 82 d0 45 74 2b 79 ea 52 22 4d 9a aa 4a 4d 7f 80 81 0b 58 75 7c 96 ed 10 b6 aa ff 7d 32 21 09 4d 60 49 db 74 9a fd 90 70 1c 77 e7 fb ee fb 3c f8 7c a2 35 70 07 f6 87 08 5a de 52 01 fe f8 ee 8e bc 62 b5 43 8d 51 18 85 5c 13 2a 25 50 45 45 0a 04 67 04 38 cc 41 18 4d 98 20 a6 00 c2 61 66 bc 82 8a cc e6 66 39 35 0c c5 6e 28 49 05 70 9f bc 76 b5 42 9d a6 57 ae 2f 68 79 6f 18 67 86 81 76 1f dd a7 8d 65 ca 0c 07 f7 d1 b5 79 53 e4 a8 a2 b3 8b 8b 8b 51 fd 3c 43 61 bc 25 b0 bc 30 51 82 3c 6b 59 35 fb 0d d1 79 20 ab 95 4d d2 2c 63 22 8f 48 20 2b 12 5a eb 93 eb 6b a0 2a 2d 2c 3c bc 49 90 a0 ca 40 79 06 65 74 2e 2b a2 91 b3 8c 9c 5d 5d da 3d 6a 7b 24 68 0c ce 7b 9d 68 fa 90 2b 5c 88 cc 6b 4a 9e 84 93 30 fe fe bc 96 50 56 64 5b 61 fb 2c 02 d5 9c f2 95 7d 4e 55 ce c4 26 e1 c6 7f 59 30 03 9e 96 34 85 48 e0 52 51 59 9f 49 41 0a c2 fc 30 30 d7 2f 3c d8 0b 6b ee c8 45 e8 73 9c c2 b1 dd ab 00 06 2a e3 65 90 a2 aa 07 32 12 28 a0 1b ae ce c0 51 81 25 a8 26 fc 6e ac 85 c8 40 71 66 03 3e b9 87 c7 92 e4 1c 13 ca c9 b1 14 9e 16 40 66 c8 39 2e 99 c8 2d f9 38 03 4d 0c 12 ca 79 9b 63 6b 22 fa ef 4c 16 cb 0c db 9b 69 46 7c 9a 1a 56 c2 0d 2d d7 38 6f 51 64 73 9a 43 b4 50 fc a3 ef 0f 7c 7f 50 3f eb 81 15 24 64 c2 80 f2 73 36 fb b4 07 be 02 09 d4 8e 60 f3 6f cf 41 a2 66 75 db d7 68 e9 45 72 f3 96 8a 56 df 9f b6 a8 43 ed ae 55 f2 86 96 47 0f c1 bd 86 8c cc 50 75 cb 6b 0f f4 ef 3c 04 6d 82 97 a0 0c 4b 29 f7 28 67 b9 88 0c ca 3e 5a c7 71 1c 5f 5f 37 22 c2 32 53 44 e7 df d6 50 6e 26 eb b9 6c 1c 50 bb 95 93 6d 4c 9f 4b 8f 58 35 e9 7e 32 f1 e0 3e ba 4e 5b de 9d 6e c5 9a d8 15 6e 5f ef 26 dd 7d bf 5f f9 78 62 f7 d6 43 d5 8a db e9 d0 ab 88 4e b7 9a 39 fb f7 91 b3 b9 78 86 b2 22 5f 65 35 72 5c 27 63 5a 72 fa 2b 4a 38 a6 0f 23 d7 69 50 08 82 0f db 0f 9a 93 ed 00 63 3b b5 Data Ascii: 2bcUQo0~_aMEt+yR"MJMXu\|}2!M`Itpw<\|5pZRbCQ\%PEEg8AM aff95n(IpvBW/hyogveySQ<Ca%0Q<kY5y M,c"H +Zk-,<I@yet.+]]=j{$h{h+\kJ0PVd[a,}NU&Y04HRQYIA00/<kEs*e2(Q%&n@qf>@f9.-8Myck"LiF\|V-8oQdsCP\|P?$ds6`oAfuhErVCUGPuk<mK)(g>Zq__7"2SDPn&lPmLKX5~2>N[nn_&}_xbCN9x"_e5r\'cZr+J8#iPc;
Jun 3, 2021 16:17:10.179707050 CEST	1168	OUT	GET /express/css/modules/shadow.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.519140959 CEST	1178	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"718-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5474400004eb5f608e000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=izHKe4CMOngZY58%2Fjq4ILXf8TaQ2Pqxvx2sElW9HyZgtruo%2BF29TaCG9Wh182adZIq%2FpORzj7DrmdnObzi7EXj0gEEw0YASDrHAITL7RQYtwL6EY6C0tPEbzgNACuXJ%2BstI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1ed8da4eb5-FRA Content-Encoding: gzip Data Raw: 31 31 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 90 b1 4e c3 30 10 86 e7 dc 53 58 62 01 44 9c 64 b5 d5 a1 6a 41 54 02 21 91 4a b0 3a b6 93 58 75 7c 96 ed 42 53 d4 77 47 a1 1d 18 18 10 ea c2 bf dc e9 1f be d3 77 c5 f5 99 52 40 31 0d 52 df cf 97 4f 2f 74 51 d7 e4 2f f9 8e 5a a0 4b 01 6d 24 c2 7b 2d 82 70 52 13 6c 49 ec 85 c2 77 a2 ad 1e b4 4b 91 fe 02 75 1e 41 a0 c7 d3 f0 01 84 64 77 ab 87 f5 ed 33 f3 01 3b a3 d8 f2 75 35 88 4e af 83 70 b1 c5 30 d0 47 23 03 46 6c 13 9d 5b df 8b cb 98 46 ab 67 e5 0d 7a 21 4d 1a 67 55 79 c5 27 4c 3e e0 3e 3f 95 ac a4 15 87 cc 63 34 c9 a0 63 a2 89 68 b7 49 73 c8 12 7a 56 fa 1d 87 cc ea 36 9d d6 46 c8 4d 17 70 eb 54 2e d1 62 60 17 e5 57 38 64 6f 26 9a c6 d8 09 da 1b a5 b4 e3 90 ed 73 e3 94 de b1 8a c3 01 80 aa 80 be 3e fe f2 1f 08 29 13 bd 15 23 6b 2c ca cd cf 82 07 f8 04 96 24 3e 9e ce 02 00 00 0d 0a Data Ascii: 111N0SXbDdjAT!J:Xu\|BSwGwR@1RO/tQ/ZKm${-pRlIwKuAdw3;u5Np0G#Fl[Fgz!MgUy'L>>?c4chIszV6FMpT.b`W8do&s>)#k,$>
Jun 3, 2021 16:17:10.656898022 CEST	1181	OUT	GET /express/javascript/globalEvents.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.974834919 CEST	1193	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"3702-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5492100004eb54631a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=y6rt%2FscSkO%2FsinDaemhJCtU7LK6GGrNop71sxui9EJZMmN3YNqF9zHzPpgveZ2xaJj0ocuppVMcaT%2FNS52foEy0uxFPtUs5%2Babgg7P%2FlOwjKFU51VCD8KfVADQpttTogFaE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b21c96f4eb5-FRA Content-Encoding: gzip Data Raw: 34 39 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 57 6d 8f d4 36 10 fe 4c 7e c5 88 9e 60 b3 2a c9 41 a1 52 6f 75 55 e9 1d d0 ab 0e ae 82 a3 fd ec b5 27 59 83 e3 b1 6c 27 cb 52 f1 df ab 89 b3 af 39 5a b5 3d 24 fc 61 d7 f6 cc 3c f3 78 3c 63 3b e5 34 9b c2 4f 93 6f f2 da d0 5c 98 67 1d da 18 8a 77 01 8e 5e 63 a7 83 26 7b 02 0f 8b 1f e0 08 8e ce 45 c4 13 78 74 7c fc 7d f9 f0 51 79 fc 18 8e 1f 9f 3c 79 72 72 fc 10 8e 32 46 39 23 b7 f2 ba 5e 44 78 25 3a 1d e0 8c bc 23 2f a2 26 cb 56 df 65 53 78 6a 0c bc 66 95 00 af 31 a0 ef 50 0d a6 b6 d2 0a 6d d4 c2 c0 85 ad c8 37 c9 8e aa 31 58 36 85 b7 56 b4 71 41 5e 7f 44 05 6d 40 d0 01 42 f4 5a 46 b3 02 e7 69 a1 e7 3a 0e d8 d7 0b 1d 60 49 fe 3d 48 b2 51 68 1b a0 13 a6 15 73 83 3c b3 f5 eb 3c 39 af 31 0a bf 82 e8 85 42 08 28 3d c6 6c 0a fa 1f 28 81 b0 8a 39 38 4f 11 65 44 05 f3 15 04 87 52 57 5a 66 53 10 b5 47 6c 38 b4 bd 66 85 0a bd 30 20 d7 11 2b 76 58 92 07 61 57 e0 84 8f 10 17 e8 91 aa 6c 0a 8d 58 81 a5 08 73 04 a5 83 34 14 50 7d cb 34 6d 68 74 8c 3c 90 e4 34 ff 93 07 8f ce 93 6a 25 2a d0 4c 6e 95 4d 81 57 c0 b2 06 95 6e 1b 58 ea b8 a0 36 82 f3 9a 3c 2c 3d 83 58 58 87 35 ad aa f2 d4 a4 c5 f6 7b b4 59 6e 91 4d cb 2c 2b a7 b7 d4 ca 04 05 d7 0b 84 8a 8c a1 a5 b6 35 04 e9 b5 8b 1c d5 36 a0 82 48 eb fd 03 27 6a 7c 60 b0 43 03 c8 f9 0a a9 ed 42 cd b5 55 da d6 a1 80 ff d4 76 a1 fe 67 db 81 ba cd 58 dd 1e ab 94 7a 95 36 08 0a 1d 5a 15 a0 75 64 39 f7 76 76 e3 57 d1 89 37 69 47 58 35 9c 7c 26 56 0f 2c 59 bc 0d 56 5f 5b d8 b3 4e 78 50 24 e1 94 7f 5b 2e e6 59 96 29 92 05 d9 86 da 80 d4 a1 4f c2 ab 0e fd 6c 4f d4 c6 41 d2 c6 b5 40 1a 2d df a7 d9 33 ee ee 19 28 5a da 24 3b a7 a5 dd 13 b5 2e 09 de ba 0d 12 d9 88 1f 62 83 b6 1d f0 d2 c4 4b b4 ed 2c 5b 6a ab 68 59 90 35 24 14 9c c2 52 db ab be 3f cb b2 aa b5 b2 2f f4 81 f4 24 cf fe cc 00 ca 92 d7 8a 26 69 b3 75 5f 66 45 f0 f2 99 Data Ascii: 49fWm6L~`ARouU'Yl'R9Z=$a<x<c;4Oo\gw^c&{Ext\|}Qy<yrr2F9#^Dx%:#/&VeSxjf1Pm71X6VqA^Dm@BZFi:`I=HQhs<<91B(=l(98OeDRWZfSGl8f0 +vXaWlXs4P}4mht<4j%LnMWnX6<,=XX5{YnM,+56H'j\|`CBUvgXz6Zud9vvW7iGX5\|&V,YV_[NxP$[.Y)OlOA@-3(Z$;.bK,[jhY5$R?/$&iu_fE
Jun 3, 2021 16:17:10.980211973 CEST	1202	OUT	GET /express/includes/simplecalendar.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.305036068 CEST	1219	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"18756-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d54a6400004eb56f90a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lDfq4u2P9JS9AM3hyrWOc%2B2cKDuU5nHdDEA7EogdBFLnTiBDsoSIv9cvvdotEYLvPvXn4q67nKbpL0uezk7n6aS3h4Ks%2Fzu7nsfYzJdXNYDtujyG%2BWwDalBLgl6Zm%2BfsdWI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b23dee34eb5-FRA Content-Encoding: gzip Data Raw: 31 34 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 3c 6b 73 db 38 92 9f a9 5f d1 e6 d4 46 62 2c 8b a4 6c e7 21 99 4e 65 e2 4c 4d b6 92 c9 d6 c5 b3 7b b9 a9 a9 2b 88 84 24 26 14 a1 05 21 cb da 19 ff f7 ab c6 83 04 29 52 b6 33 7b 73 a7 0f b1 84 47 77 a3 d1 6f 00 71 fc a7 3d e7 e9 37 7c 7a ce eb 8d 58 32 0e 13 78 4f 09 7c 5a 11 2e 7a ce 27 b6 e1 31 85 09 6c b7 db 91 60 82 64 d9 ae c0 ae 54 8c 62 b6 ea 39 57 44 60 f7 73 ff d4 1f 07 41 d8 73 ae 7e bc fe f0 1e de 90 8c e6 09 e1 3d e7 ef 94 17 29 cb 21 1c 85 3d a7 e7 7c 66 1b 20 9c c2 9c 53 0a 82 c1 a6 a0 20 96 69 01 31 4b 28 a4 73 d8 b1 0d 70 2a 48 9a ab f6 25 25 09 e5 23 35 33 61 90 33 01 39 a5 09 4e ce d2 fc 2b fe 5d ed a0 48 05 85 c1 8c 42 9e c6 08 91 6d 16 cb 23 ef db 58 81 cc 78 ea f7 9c 1b c2 41 a4 2b ca 36 e2 8a 66 64 07 11 84 41 10 4c c1 f7 61 95 66 59 5a d0 98 e5 49 31 84 78 49 f2 85 5e 88 5e 43 96 7e a5 43 28 a8 40 02 03 98 33 0e 62 49 21 d6 8c c1 d6 9c de 50 0e 64 23 18 24 69 41 d6 6b 8a 0c eb 39 be 0f 6b 4e 33 46 12 48 57 64 41 0b 45 4a ba 5a fc bc 86 08 72 ba 85 77 d8 3e 78 31 0c c7 de b4 e7 c8 9e 51 c1 63 88 a0 af a6 f8 9b f5 68 91 ce fb d3 72 ee 15 db e6 5d b3 b1 af 31 3f c1 26 0b 42 42 04 fd 81 f1 15 11 10 81 bb 5a f9 49 e2 ef 76 bb 9d 3b d5 24 6f 0a 9a c0 6c 67 38 a6 d6 b5 4c 13 0a f3 4d 1e 8b 94 e5 45 8d a5 ef 12 88 60 4e b2 82 1a 08 c8 9f 9c 6d a1 10 04 59 94 c0 8c b3 6d 41 39 14 79 3a 9f 53 0e 71 46 8a a2 e7 18 78 f0 bd ea 1f 78 bf f5 1c 90 dc 1f 25 6c 05 11 24 2c de ac 68 2e 46 0b 2a de 66 14 bf 7e bf 7b 97 bc 0a 27 c1 b4 1c 9a d2 33 88 60 50 8e 25 59 06 4f 9e c0 91 81 e3 d5 87 e7 45 7d 78 46 76 94 17 87 67 3c c3 19 25 5d 38 d4 c6 e6 35 e9 39 6f 0e 3f 30 9a 7d 85 a8 5a f2 ef bf 57 6b 32 df f3 e2 ac 1a be ce 88 98 33 8e cc c9 c9 4d ba 20 82 f1 b2 71 da 73 ee d4 de 18 8e 2b 39 29 f9 3b ed 39 6a 8b 10 97 1e 53 00 a7 ff dc a4 5c 8b fd 96 Data Ascii: 1432<ks8_Fb,l!NeLM{+$&!)R3{sGwoq=7\|zX2xO\|Z.z'1l`dTb9WD`sAs~=)!=\|f S i1K(spH%%#53a39N+]HBm#XxA+6fdALafYZI1xI^^C~C(@3bI!Pd#$iAk9kN3FHWdAEJZrw>x1Qchr]1?&BBZIv;$olg8LME`NmYmA9y:SqFxx%l$,h.Ff~{'3`P%YOE}xFvg<%]859o?0}ZWk23M qs+9);9jS\
Jun 3, 2021 16:17:31.917172909 CEST	1777	OUT	GET /express/skins/gpa/n4client.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMT If-None-Match: W/"13807-1524595664000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.971807003 CEST	1783	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"13807-1524595664000" Last-Modified: Tue, 24 Apr 2018 18:47:44 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c2d00004eb52d8ef000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=k60ImhLMk9Nd9qRlQHIQvXrLxYcq9Ol2Fejxv0m1aA8XagnbfsEu7zQlc8IRhV7Ce7Z22v25rCzEhofM0sMLa7rofclvVdGberLJyOsNQv664ZAWFx4%2BHcDIX%2BKtYQMKuf0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba6aa4f4eb5-FRA
Jun 3, 2021 16:17:31.973251104 CEST	1784	OUT	GET /express/css/modules/content.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2627-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.022211075 CEST	1790	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2627-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c6500004eb52d8f7000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gra2VvmpU%2FE46MoE2Jw%2BTx4nfmn3USQtY1IcJevV823%2BeUDwM3pMdgaS7E3SDHORzqXkj3lcZuiAL8S6zPBJoCG%2BtNGo0%2BWCgJ61twNbcAoxt09GRP7whlA2a45R%2B1GwNtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba70b614eb5-FRA
Jun 3, 2021 16:17:32.023396969 CEST	1790	OUT	GET /express/css/modules/form.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1113-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.076324940 CEST	1795	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"1113-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c9700004eb524afd000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8SR1oLM%2FeTZwkR2Q8tXz0L2%2F7D1JyFPGjgGFGnCzfSENiXrrnD45W%2BpNGCsA7NO3xV6rmWcTTdqp44YGiFQsHNuwGoVCFwUNZqmcaCDEFkWdzjv98eG8K4BNJsSRb7OfGbs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba75c424eb5-FRA
Jun 3, 2021 16:17:32.077182055 CEST	1796	OUT	GET /express/css/modules/modalDialog.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"863-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.131912947 CEST	1801	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"863-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59cce00004eb53c260000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FOtiAh%2F7LaOthKoKLyWdwg90OjUolPr5Gtsme653nbw20%2FJDRnzK2KDo1vqeFzW1o1yOnOcXBm0NmDsF4WNVa7L%2FEmH91Q7gOlk3l9ZtX1vqhL6y%2F4WobZsjo8ROzHTYgK0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7bd4d4eb5-FRA
Jun 3, 2021 16:17:32.132997990 CEST	1802	OUT	GET /express/javascript/browserSniff.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"15400-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.185236931 CEST	1811	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"15400-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59d0500004eb503387000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JAA69eMGN0jbmfMrc3MI0dE820pMNZdkQ57YFmgJghtFiZAs9e2t0WdaLs42e4RcEBGLuW1jocNBb9PXgBEtvZnUYZzOZCyLlIxD0PvHpjVxUjn2yzXgyN2bpZQE%2BQFXV7s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba80e2f4eb5-FRA
Jun 3, 2021 16:17:32.186311007 CEST	1811	OUT	GET /express/javascript/lovHandlers.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1695-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.236912012 CEST	1818	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"1695-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59d3a00004eb509008000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FtCV7Oih9sRJpOnyL4fDAqvByUIEC0aV9sMFm2zlfaeGTSJncwpwTbhY8zIW0%2FZ4rCGJxUTBjO9R3pRk7I3r%2F7p6gLY61SoBf67T3iikIgcIKSUSs1YmhvVmaJikEGUVg9o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba85efe4eb5-FRA
Jun 3, 2021 16:17:32.237876892 CEST	1819	OUT	GET /express/skins/gpa/logo.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Fri, 31 Aug 2018 19:11:15 GMT If-None-Match: W/"12519-1535742675345" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.295140982 CEST	1824	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"12519-1535742675345" Last-Modified: Fri, 31 Aug 2018 19:11:15 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d6e00004eb54bab8000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=NrTszCNtfjSCJxjF31Hen8UoCF6OIQ2dS9TAd1CuhBnNbQ5IEdVN8YqwBnDhdrBae3ozIA7OHD9iQZ2TLqXAnJeUHdfBPpU9eIXFYcG4hKvyhME2SiQdFEyZCRrkAARg2vg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba8aff84eb5-FRA
Jun 3, 2021 16:17:32.417490005 CEST	1829	OUT	GET /express/images/poweredbynavis.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"840-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.473756075 CEST	1833	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"840-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59e2200004eb549852000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=rXejSKpahre8oAKDVeRorMfJqIXj1rPM45vtkQiH%2FB0nBHgH%2BFTcFg2tNjio91LCMwMvzOo2vbmqEptg%2B8Z3MfrOK5wZID5ObfXG0Z2ygSGfdawIgUTu72jYVzdVtKq4%2BNs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba9cafe4eb5-FRA
Jun 3, 2021 16:17:33.206437111 CEST	1834	OUT	GET /express/about.jsp HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:33.547646046 CEST	1847	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:33 GMT Content-Type: text/html;charset=ISO-8859-1 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC cf-request-id: 0a73d5a13700004eb524b8a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=A74tYBgyaRBLARqEUPdZLc6wIbrdZip09Lf1sqIggC%2B772U%2F%2FPrrE2adTvnp5G75GaX47%2BENWgtHZJXwrMRUMlXZZGL8cAi84frzX0UDlYHzhlCISC%2B6uc9YNmxtWPQDAxE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 65998baeb8c64eb5-FRA Content-Encoding: gzip Data Raw: 33 62 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 55 c1 72 db 36 10 3d 87 5f b1 83 83 22 8d 24 ca 52 ea c6 b6 4c 65 54 45 4e dc b1 95 c4 a6 d3 de 3a 20 b9 22 d1 80 00 0d 2c 65 6b 3a fe f7 0e 48 ca 96 9a 38 f1 b4 69 a7 b8 48 5c ec ee 7b d8 f7 08 7a 9e 5b c7 19 e5 72 e2 1d 67 c8 93 89 f7 cc 7b e6 62 e7 f3 70 0a 6f c3 f0 7d 7f fe e1 ea f4 63 c0 de 1b 9e e6 9c c1 ec dd 22 9c 2f c2 80 2d 74 7f c6 e3 0c d9 a4 c9 ce 88 8a 3e 5e 97 62 15 b0 99 56 84 8a fa e1 ba 40 06 71 fd 14 30 c2 5b 1a 38 b8 31 c4 19 37 16 29 b8 0a 4f fa 07 f7 3d b6 11 e7 b7 85 30 68 b7 20 c3 12 61 5a a6 30 1a c1 f0 e0 68 ff c5 d1 70 0f de 9c 87 30 3c 7c b9 ef 5a e4 48 7c 87 c6 af fd ab 69 7f a6 f3 82 93 88 e4 36 93 d3 79 70 c8 60 f2 70 fc 6a 12 24 48 e2 64 1a e9 92 e0 17 8c a6 71 8c d6 1e 0f ea b0 f7 d8 3a b6 b1 11 05 01 ad 0b 6c ce f8 3b 5f f1 3a ca 40 72 95 96 3c c5 80 fd cc 57 fc b2 8e 4e 3c 6f 30 70 18 bc c2 80 87 2d 38 13 91 e1 66 0d ed b8 03 a3 bd bd 3d 38 d1 86 4a 41 6b 98 69 65 4b 49 42 a5 3e 4c a5 84 0b 91 66 64 e1 02 2d 9a 15 26 be 37 f8 67 cb 51 b2 05 c6 62 b9 06 ca 10 14 cf 11 f4 12 38 38 00 89 04 94 71 02 83 b6 d0 2a b1 40 1a 0c 5e 97 68 c9 1e 79 2b 6e 36 69 0b 57 17 00 7b 2d 6c c1 29 ce d0 b0 f1 f7 e0 36 bf 25 c3 63 aa b8 5d 5d 9c 39 6a ee 6f 5c 1a 83 8a 20 11 06 63 d2 6e 74 2e cc 8b 42 8a 98 93 d0 aa d6 fd 96 3a 47 de b2 54 71 15 4a 91 66 75 b4 dd f1 fe f0 96 c2 58 ba 94 dc 66 68 21 80 1b a1 12 7d e3 4b 5d 37 f0 33 83 4b 5f a8 04 6f df 2d db 6c 30 60 9d b1 67 31 d6 2a a9 6a be 5d c1 7a 3b 08 5d 18 75 c6 1e 65 c2 3c bd c1 36 5e 17 86 9d 71 35 f3 82 d3 a3 d5 b6 8c 2c 19 a1 d2 f6 5e 6f 0b ab 2e 36 48 a5 51 55 fd d8 bb fb 1e fa 9c f3 4f 08 7c e3 09 58 6a 53 3d 15 da 90 f3 0a 87 e4 de 10 1b ab f4 36 86 13 2a 85 4c db fa 2d ea b9 6e 4d a1 33 61 cf f5 ca 39 41 fb 6d 78 7e e6 6a 0c f2 c4 66 e8 1a 20 c5 9d 1e 70 95 38 9f 0a 95 4a 84 82 1b 9e 23 a1 d9 d2 bb 61 75 51 75 6d 3b 28 77 39 f5 1a 98 c5 16 8a b3 43 69 24 04 d0 de 36 09 74 81 35 ac 07 0c ba 3b 66 ef 02 7b 95 23 65 3a 09 dc 19 25 5f d7 38 ad 0d 4e e0 2a 36 0f 2e bd 55 71 ac c2 0f 0c aa 8d 9a 44 b5 d3 9c da 45 45 12 0c 7f 1c 8d 5e 8e 0e 0f f6 5f fc 30 3c 74 06 d4 05 aa 76 69 64 0f d8 6f a4 0b f6 20 2a 99 12 ff 1d 51 9f a2 63 3d Data Ascii: 3b4Ur6=_"$RLeTEN: ",ek:H8iH\{z[rg{bpo}c"/-t>^bV@q0[817)O=0h aZ0hp0<\|ZH\|i6yp`pj$Hdq:l;_:@r<WN<o0p-8f=8JAkieKIB>Lfd-&7gQb88q@^hy+n6iW{-l)6%c]]9jo\ cnt.B:GTqJfuXfh!}K]73K_o-l0`g1j]z;]ue<6^q5,^o.6HQUO\|XjS=6L-nM3a9Amx~jf p8J#auQum;(w9Ci$6t5;f{#e:%_8N6.UqDEE^_0<tvido *Qc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49716	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:09.177208900 CEST	1066	OUT	GET /express/n4standard.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.508323908 CEST	1078	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"19654-1619547716000" Last-Modified: Tue, 27 Apr 2021 18:21:56 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5435a0000dfd7d8071000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=anD8QQGmO4%2BfJ%2FCX8eWZA0ptDEGgYAKZS6YVx2%2B%2BGmfRiLZaGXm32AqxlGkVS5Rh%2B2bgGUfguPsj9RyO5VLGTNXdqrmGu%2BhpmMBV%2BvCh8s7egYZ%2BqkuNaQC1GFPLi6iCyU0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b188c40dfd7-FRA Content-Encoding: gzip Data Raw: 63 37 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dd 5c 6d 6f e3 36 12 fe 1c ff 8a 01 d2 03 ee 8c 44 96 65 e7 cd fe 72 89 ed ed ee a1 5d 14 4d ef fa b1 a0 45 da 22 56 96 04 8a 76 e2 2e f2 df 0f 7c 93 45 89 52 94 20 e9 ae 6b 61 b1 8e 48 0e 67 9e 19 0e 47 c3 91 07 fd 1e 00 c0 e7 31 dc 73 94 60 c4 30 e4 7c 1f 13 c8 23 42 b8 27 1b ef 09 81 8f 7c 13 03 4e c3 ed 86 24 1c 78 84 38 60 92 87 8c 2e 49 0e 3c 22 b0 cd d1 9a 40 ba 02 1e d1 1c 96 64 95 32 02 9b 14 d3 d5 9e 26 6b 45 68 96 66 7b 46 d7 11 87 7f 86 ff 82 c0 f7 47 b0 dc c3 67 b4 a3 39 cc 52 96 a9 5e bf 33 ca 39 49 44 d3 6d 82 19 79 80 ff 78 f0 0b e1 84 e5 69 72 26 87 c9 7e 3f 7c c2 13 48 c6 b9 e6 db 0b f3 fc 6c 07 43 6f ec 05 5e 00 81 3f f4 07 fe c5 20 18 82 7f 3d 19 5f 4d fc 2b d8 ae 51 42 72 94 c0 e2 31 83 1f 7a fd 41 af c7 d1 32 26 de 06 d1 e4 37 f1 ad f7 b5 77 b2 4c 19 26 ec 5c 32 3a 81 d3 30 0c 21 c8 1e 21 4f 63 8a a7 45 33 4f b3 e6 c6 98 ac 5a 86 2e 53 ce d3 8d 6e f7 4b ed 1b c4 d6 34 99 88 7b d3 de c9 2a 4d f8 f9 03 51 6c 24 29 db a0 d8 dc 5d a1 0d 8d f7 13 d8 11 86 51 82 ce 00 31 8a e2 b3 88 c4 3b c2 69 88 a6 bd 93 07 8a 79 34 81 a1 ef ff 63 da 3b 19 f4 23 4d 68 18 f8 82 7c 7f d0 3b 09 d3 38 65 13 38 f5 7d 5f 30 87 c2 2f 6b 96 6e 13 7c 6e 1a 56 ab d5 b4 f7 d4 eb d1 15 43 1b 81 0d 80 66 71 28 59 7c ea f5 30 dd 79 11 89 b3 12 70 3c cd ce f5 ec 63 29 48 86 30 a6 c9 da 20 7a 69 dd 54 50 a9 7b 25 f4 6c 0a 52 e8 9c fe 49 84 40 19 af 74 35 ec de dc dc 54 41 b6 c9 d8 4d f6 30 c3 8f 51 8e e2 c8 46 b1 18 a1 00 3b 88 eb 26 25 4d 44 d1 31 e8 5f 05 8a 91 3a d6 61 18 4e 6d db 73 f2 ae 5a ac f9 9e 7a 3d 24 e0 37 37 2f 2f 2f a7 bd 13 4e 1e f9 39 26 61 ca 10 a7 69 32 81 6d 82 09 8b 69 42 d4 88 c9 8e e6 94 13 2c b5 0a a0 06 2b 53 90 cd 51 ba 23 cc 22 3b bf 9d 07 c3 e7 29 d3 cd ba be 8a 36 04 d3 ed 06 92 54 74 b2 96 90 b3 45 19 85 b3 c9 e8 c7 6a 7c ea f5 bc 38 5d Data Ascii: c79\mo6Der]ME"Vv.\|ER kaHgG1s`0\|#B'\|N$x8`.I<"@d2&kEhf{FGg9R^39IDmyxir&~?\|HlCo^? =_M+QBr1zA2&7wL&\2:0!!OcE3OZ.SnK4{*MQl$)]Q1;iy4c;#Mh\|;8e8}_0/kn\|nVCfq(Y\|0yp<c)H0 ziTP{%lRI@t5TAM0QF;&%MD1_:aNmsZz=$77///N9&ai2miB,+SQ#";)6TtEj\|8]
Jun 3, 2021 16:17:09.514017105 CEST	1085	OUT	GET /express/javascript/browserSniff.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.860052109 CEST	1154	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"15400-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d544aa0000dfd7c41c4000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nurEL8zdmqnMQcIDrxCkTZk3qa8YmRORe3okuq3L0jmU4TouQxtZM0tcehaa6apIE%2Fl3CgCYPjjQvlbMsO27SFkc9Pv1SUfdUTOvm7UAvfU748PfWp%2BMRi%2BMNcd04e4k7S0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1aa86ddfd7-FRA Content-Encoding: gzip Data Raw: 31 30 32 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 3b 5d 77 db 38 ae cf cd af 40 fd d0 da 3d 8e 6c 59 b2 62 a7 cd dc d3 db c9 dc 4d 67 92 f4 b4 d9 ce be f5 d0 32 1d 33 91 49 1d 91 b2 9d d9 ee 7f df 03 52 1f d4 97 9d 4e 6f 1f 1a 88 04 40 00 04 40 12 a4 47 23 f8 67 a4 d8 86 28 0a 61 c4 28 57 a7 92 2d 29 7c 24 5b f2 25 4c 58 ac b2 66 90 9c ad 56 0e 7c a5 89 64 82 83 ef 8c 27 27 a3 11 2c 88 a4 4b 48 63 c1 cf ff 26 27 cf 19 7b c8 a9 ff 61 00 37 54 c9 90 c4 14 3e 88 cd 26 e5 2c 24 8a 09 2e c1 9d cf e7 a7 93 f1 d8 75 00 3e d1 64 c3 a4 26 bd 4f 08 57 74 09 4a 40 42 53 49 81 f0 25 2c 99 54 09 5b a4 8a 3a c8 f6 33 dd 32 14 d1 3d 83 6b f2 04 f3 39 62 93 e5 12 98 74 38 d9 4e d3 58 53 31 e9 30 8a 1f 7d 49 29 2c 68 24 76 83 0a fd c4 85 1b b1 85 f1 d8 a2 bf a7 e1 a3 b0 c8 bf 4d e1 7d 24 05 7c 58 13 7e 4f 8b 21 72 8c 6c 38 25 b2 8f c0 ea 08 d2 b8 32 da 04 7e a3 0b 18 bb 88 1d 8a 24 a1 a1 d2 a6 94 c6 94 bf 52 45 43 b4 0d ac 44 02 57 97 30 75 f6 43 b8 8d 69 42 c0 1f 02 b2 6a fd 97 b3 32 98 53 58 e6 7c 3a 29 50 55 99 c6 b1 48 94 1e 6b c7 f8 f5 a5 16 7c c7 f8 e4 b1 93 4e 3e f1 70 0d 3b a6 d6 b0 48 c4 4e d2 e4 54 3d c5 f4 54 08 e7 41 1e 1c 8d 49 87 88 68 3a cc 80 a0 62 97 00 ae 49 52 b3 8b 51 a6 a2 4a 8e 3f 9e c0 6d a8 32 7c 64 7e 75 19 74 60 ce 0c e6 04 16 4f 70 c7 36 f0 ab 58 2c 68 44 68 42 a1 bf 56 2a 3e 1f 8d 14 db 38 cb a2 d9 09 c5 66 d0 ae 49 36 d8 9f 8c ff eb 13 f4 99 74 76 8c ef e3 c1 10 5b 96 62 27 9d 9b cb bb bc 7d 29 14 a7 6a 70 74 ca ae c5 5f 2c 8a 08 bc 2a a3 24 33 ec 88 f2 7b c6 a9 f6 7c 66 bc e2 dd bb 77 80 01 91 f7 e4 1a bf ec 1c 66 93 b1 37 14 e7 68 fc 8d f8 6b 98 fd 9d 14 40 1a e7 a0 57 00 65 9b 5f 00 65 db b4 00 8c 8f c3 61 01 32 a5 72 09 b0 6d 68 c1 ee 51 43 b5 06 d7 d0 8a f9 b3 dc b5 0a 60 a6 01 81 7e 14 58 e0 41 79 33 7e 1b 12 0a 39 2c a0 59 09 ce 4b 70 5f cb 24 ef e3 04 c6 1e 7a da af 24 49 28 87 8f f0 Data Ascii: 1022;]w8@=lYbMg23IRNo@@G#g(a(W-)\|$[%LXfV\|d'',KHc&'{a7T>&,$.u>d&OWtJ@BSI%,T[:32=k9bt8NXS10}I),h$vM}$\|X~O!rl8%2~$RECDW0uCiBj2SX\|:)PUHk\|N>p;HNT=TAIh:bIRQJ?m2\|d~ut`Op6X,hDhBV>8fI6tv[b'})jpt_,$3{\|fwf7hk@We_ea2rmhQC`~XAy3~9,YKp_$z$I(
Jun 3, 2021 16:17:09.866041899 CEST	1159	OUT	GET /express/css/modules/table.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.203888893 CEST	1170	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"3121-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d546100000dfd7ca3b7000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eBOYsj678qu9K17PHABP06dUfbxHJ1arctrDxMR0MUzIkVb6hxt2YaKZdRVF6p6A3sJ7KEh%2B9EnLjbAvnl4dLcHcFLOZFH34CxaFW4MO6H%2FiObARISRgeIzEopS%2BjRfOn5c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1ced51dfd7-FRA Content-Encoding: gzip Data Raw: 32 64 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 56 4b 6f 1a 31 10 3e c3 af 18 29 8a d4 46 c5 40 50 0e ec 9e 02 0d ea 21 a7 86 fe 80 d9 f5 c0 5a 31 f6 ca 1e 1e 69 d5 ff 5e ed 03 58 96 67 1a d4 ae 0f 2b db e3 79 7e df d8 ed bb 2b 7d ed 66 3b fb c1 f8 71 f0 fc 24 86 2f 2f f0 57 5f 55 d5 d0 1a 26 c3 c0 18 69 f2 80 8e 80 13 eb 09 e6 9e 80 2d 48 e5 53 8d 6f 30 b1 6e e6 bf 80 a3 d4 3a f6 60 dd be 2a ad 7c b6 33 01 c5 34 f3 e2 03 5e 5d 27 57 27 75 15 01 c3 54 db 08 b5 2f ac 9f cd fb 0f 4f 32 cb 04 a0 d6 10 ef 64 4e fc 8f 08 45 6e 7b ac 58 d3 77 bb 6c fe 6a 66 56 22 8c 5f a7 ce ce 8d 6c c5 56 5b 17 dc 0c 06 83 b0 f9 bb 26 0d 9c 94 07 52 94 52 99 69 d0 49 57 35 b1 52 a0 54 d3 eb f5 c2 7c 3e b1 86 5b 4b 52 d3 84 83 c8 6a 59 59 f5 ea 27 05 dd 6e a6 29 5b 63 5a 71 0b b5 9a 9a 40 d3 84 c3 1d 7b bd b5 d4 52 49 4e 82 6e a7 73 bb b5 ff 18 b3 b2 c6 97 1e 2c 13 c5 d4 f2 29 c6 14 18 bb 74 98 86 75 d7 a1 57 b8 7f 26 bf 39 90 c7 79 ed e1 42 b6 e5 55 67 9b 17 1c 95 01 34 72 97 16 e2 1f 57 7d 13 c2 d1 8a f7 fb fd 43 a9 65 29 34 46 a4 c7 f2 e8 c9 af 0f d9 38 51 bd 63 a5 28 2c dd af ed 28 93 ce f9 84 9d a7 41 36 c2 4b ab 5b b5 f1 d0 b9 2d 6c 2c 50 cf e9 83 36 aa 2a b7 89 85 43 20 ac 00 bc a4 0a 4b 81 b9 c8 f5 02 85 03 ac b8 00 d5 59 ef bd 1e aa 31 d7 77 b2 95 5f 1f d5 9b 10 de 8d 6a 27 ac 3c 5f 80 5c 90 16 64 2e 93 8c ad fe 46 28 c9 ed f4 ca 3a 06 ea ed d0 58 37 43 fd ae e6 77 00 13 8d 05 39 56 31 ea f2 f8 4c 49 a9 29 6c 36 aa 9d b8 71 9c bc 87 02 10 de 3a 2e d3 db 88 ac 93 e4 82 6e ba 02 6f b5 92 e1 7a 69 ad 69 34 1a c1 cd f0 3e 1b db ff 68 34 2a 7c 8e e7 ce 5b 17 48 9a e0 5c 97 81 b5 ef ea 4a e1 a6 3f ca 46 78 d7 ce 10 2c 8c 65 1a 5a 7d e8 d6 a9 14 f5 f6 78 5a ce d3 20 d2 36 7e 7d ce b0 7b 0d 1a e4 da f2 17 4d 4e 87 92 0b 4f 18 27 c5 56 ed fd 83 69 4a e8 3c e0 14 95 f1 0c 58 04 51 01 9a 00 18 14 3a b3 77 96 a7 14 1d 32 49 88 de ea aa 80 13 65 40 2b 43 Data Ascii: 2deVKo1>)F@P!Z1i^Xg+y~+}f;q$//W_U&i-HSo0n:`\|34^]'W'uT/O2dNEn{XwljfV"_lV[&RRiIW5RT\|>[KRjYY'n)[cZq@{RINns,)tuW&9yBUg4rW}Ce)4F8Qc(,(A6K[-l,P6C KY1w_j'<_\d.F(:X7Cw9V1LI)l6q:.nozii4>h4*\|[H\J?Fx,eZ}xZ 6~}{MNO'ViJ<XQ:w2Ie@+C
Jun 3, 2021 16:17:10.207772017 CEST	1172	OUT	GET /express/css/modules/modalDialog.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.675565958 CEST	1184	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"863-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d547600000dfd7d51c3000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1zDpsnQapKYjiLIQbnhcbPcsv0cxvAff%2BMwvbtjI72Qv29MZLVG4VzM8xEswFr1KQDmChak0lVpnu2Czfpcn97vkx7cXWXfHPqDZt9cOnfuEH6P7BUbxUtPoBHDCStho0Zc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1efa2edfd7-FRA Content-Encoding: gzip Data Raw: 31 38 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 52 4b 4b 03 31 10 be cf af 10 8a a0 e0 2e f1 89 26 78 f0 55 28 58 11 f5 e0 35 db 64 77 07 b3 99 25 3b b5 ad a5 ff 5d e2 b6 dd 52 eb c1 e4 92 4c 92 ef 35 e9 55 1a fd 1d 79 b6 9e 61 0e 35 35 c8 48 5e ea ac 21 37 66 ab 80 a9 96 7b a2 9e 2a 70 36 e7 e5 f2 2b 41 6f ec 54 26 c7 0a 32 3d fa 28 02 8d bd 49 46 e4 28 c8 cc 8d ad 82 05 40 af 22 a3 dd b3 0e ff 03 ff c4 06 33 74 c8 33 59 a2 31 d6 b7 60 4d 89 d6 99 bf 71 c4 12 44 74 f2 76 a9 eb f5 7f 86 82 09 1a 2e e5 b1 10 0a 4a 8b 45 c9 ed ba 3f 78 7c 7b 78 91 75 a0 02 8d bc 7f 1f 54 ba b0 6f 41 fb 26 a7 50 a5 43 1c 05 6a 28 e7 f4 c6 d5 a5 3e 68 78 e6 ec b5 38 a2 5a 8f 90 67 d7 17 e2 50 41 52 d1 57 b2 ac 48 91 5e b4 06 b8 b4 c3 18 c8 ff 2c 88 9d 26 6e ae e2 54 50 6b 63 d0 17 f2 64 23 f0 41 1e 74 65 61 0e 19 05 63 43 44 5b 00 a4 b9 36 3f c5 6d ac 60 8d 02 58 40 ea a9 ff c7 95 15 db 9a 22 fe 98 40 ae 81 79 17 e3 7e 97 e3 65 6c e3 5a 5a dc fc 76 f0 70 1b a7 02 b6 53 4e b4 c3 c2 cb 10 5f 6f 5a 3f d9 a2 6c ff 11 7d da 90 3b 9a 48 3d 66 52 eb 6d 32 5d 16 ba f7 a7 3b 88 57 ed 5f c9 3b 8f f2 d6 2c 4f 6d 72 b9 23 cd 32 f6 62 57 ae 1d c1 59 1b ad 09 54 bf 96 da d0 64 e3 34 8a ff 06 1c 2e 13 16 5f 03 00 00 0d 0a Data Ascii: 18bRKK1.&xU(X5dw%;]RL5Uya55H^!7f{*p6+AoT&2=(IF(@"3t3Y1`MqDtv.JE?x\|{xuToA&PCj(>hx8ZgPARWH^,&nTPkcd#AteacCD[6?m`X@"@y~elZZvpSN_oZ?l};H=fRm2];W_;,Omr#2bWYTd4._
Jun 3, 2021 16:17:10.678864956 CEST	1184	OUT	GET /express/javascript/getOptions.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.039191961 CEST	1208	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"4948-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5495a0000dfd7a1a83000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wDWWPIEx88DayDWXBrpwsH9kxhbgp7mlnShURlZmOm3FL%2FapNmcoxlSoeMljWV4AS5hxiXm7GM8YN7x9oRvbKjtFKBWRozZ362VWh4%2BWG3OpfyTnz8RWs6mHfdtnops%2F3CQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b22095adfd7-FRA Content-Encoding: gzip Data Raw: 36 36 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 57 5b 6f e3 b6 12 7e 96 7e c5 20 5d c0 97 ba b2 9d dd 6e f7 c4 35 b0 d9 24 e7 34 80 d7 5a 24 d9 c5 01 0c 3f d0 e2 c8 a6 23 93 2a 49 3b 75 8b fc f7 62 48 c9 96 72 df 22 e7 f8 21 91 c8 6f 86 73 f9 66 86 ea b6 c3 36 7c 6c fe d0 9a a3 8d 73 2b 94 34 d1 d2 c0 9b 0b dc 08 23 94 3c 82 7e d4 87 37 f0 e6 94 59 3c 82 c3 5e ef 6d b7 f7 af ee e1 5b e8 bf 3f ea 7f 38 7a d7 83 37 21 e9 38 51 f9 56 8b f9 c2 c2 98 6d 84 81 13 a5 73 a5 19 69 74 52 61 1b 8e b3 0c 2e 08 62 e0 02 0d ea 0d f2 42 54 a6 82 a3 b4 82 65 70 2e 53 a5 57 5e 4e a5 f7 95 85 6d f8 2a d9 da 2e 94 16 7f 22 87 b5 41 10 06 8c d5 22 b1 d9 16 72 ad 16 62 26 6c a1 fb 6a 21 0c dc 28 7d 0d 89 92 96 09 69 60 c3 b2 35 9b 65 48 2b fb 73 73 ad 72 2d d0 32 bd 05 ab 19 47 30 98 68 b4 61 1b c4 33 26 01 93 9c 6c c8 b5 b2 98 58 e4 30 db 82 c9 31 11 a9 48 c2 36 b0 b9 46 5c a1 b4 c6 21 53 e4 a8 59 06 49 19 b1 a8 62 a5 d2 c0 e4 16 72 a6 2d d8 05 6a 54 69 d8 86 15 db 82 54 16 66 08 5c 98 24 53 06 79 87 cc 94 66 25 ac a5 97 44 e5 82 fe 2b 0d 1a 73 ad f8 3a 41 0e 82 8c db 86 6d 20 0f 68 6f 85 5c ac 57 70 23 ec 42 ad 2d e4 5a 28 0d 37 9a 94 48 28 c3 ea bd 4a b5 5a 79 67 5d 8e 76 ee 46 61 bb 1b 86 5d 8a ee 9e 34 90 8a 2c 33 30 8a bf 19 98 31 83 1c 94 84 d5 3a b3 e2 27 2e 56 28 89 4b 2c 03 a6 35 db 1a e0 98 0a e9 30 61 3b 60 30 17 1b 94 f0 db d5 e7 11 e4 6c 8e 91 cb dc c7 0d 6a 92 fa 5e 2e c2 47 ef c6 11 9c 64 6c 0b 63 bc b1 74 4c 61 72 70 15 c3 69 7c 14 b6 83 60 ac 24 56 7c 39 ff fc 65 74 f6 f9 6c 7c 75 7c 75 1e 8f 61 1c 5f 9d 5d 1e 85 6d f8 c2 34 5b a1 45 6d 9c d4 25 22 a5 02 0d cc 30 53 37 ce d6 20 38 75 0e 51 c6 28 75 28 ad cb 34 c7 1c 25 11 ec 81 48 1c bb 48 38 95 41 b0 61 1a f2 38 b7 6e b1 0f 43 98 f8 f5 49 83 c8 8a fd 46 07 1a 16 ff b0 fd c6 b4 53 db 39 2c 77 0e 1b 53 bf 11 45 91 7f 98 ee 55 f3 07 55 4f ae 71 7b 54 58 eb 8f 99 Data Ascii: 660W[o~~ ]n5$4Z$?#I;ubHr"!osf6\|ls+4#<~7Y<^m[?8z7!8QVmsitRa.bBTep.SW^Nm."A"rb&lj!(}i`5eH+ssr-2G0ha3&lX01H6F\!SYIbr-jTiTf\$Syf%D+s:Am ho\Wp#B-Z(7H(JZyg]vFa]4,301:'.V(K,50a;`0lj^.GdlctLarpi\|`$V\|9etl\|u\|ua_]m4[Em%"0S7 8uQ(u(4%HH8Aa8nCIFS9,wSEUUOq{TX
Jun 3, 2021 16:17:11.043409109 CEST	1210	OUT	GET /express/images/spacer.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.111577988 CEST	1213	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 43 Connection: keep-alive ETag: W/"43-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 329 Accept-Ranges: bytes cf-request-id: 0a73d54aa60000dfd786332000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3IBRWoqzW3FkQD9j5HJWKE1M800ZDPISDziFgfqvzZTWuoP5y2S6EjDV80XYrTyxB5ZClRmNWnadh6fLxFaqX5E5mc4ImjcXTVr0xs4Bwb%2BbeHfARjjVpmanCoaJ0GpbndU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b243d5adfd7-FRA Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Jun 3, 2021 16:17:11.112694025 CEST	1214	OUT	GET /express/images/poweredbynavis.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.443335056 CEST	1246	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 840 Connection: keep-alive ETag: W/"840-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes cf-request-id: 0a73d54aea0000dfd7e4100000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wAiW33nGd0Jj9l1BwMnyQUC1ONx9Buv5xNXXzN2xeGrbdb2YLGb9hvLl1SRA%2ByZjTRIeT7TvGnz1BafZxMfsSWQ4e5y%2FHFlLqnZUfP%2BtDHigC4lHN88we7QytBJbZPYSurM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b24ae43dfd7-FRA Data Raw: 47 49 46 38 39 61 60 00 1e 00 b3 0f 00 76 bc 4c 56 5c 5d 8f c6 6e c8 c9 c9 85 8a 8b ab cf 96 6c 71 73 9e cb 84 3a 41 43 d7 dd d4 a2 a5 a5 b5 b7 b8 c1 d7 b4 59 b2 24 29 31 33 e4 e4 e4 21 f9 04 01 00 00 0f 00 2c 00 00 00 00 60 00 1e 00 00 04 ff f0 c9 49 ab bd 38 eb cd bb ff 60 28 8e 64 89 25 4c 62 ae 2c 7b 34 8c 37 2c b4 da de e6 1b 6b 09 81 38 40 60 60 d1 62 00 0e 80 c6 41 92 10 34 94 0f 63 21 7a 7c 24 00 53 63 03 10 13 1c 0a 4b 2d 57 82 6c 38 77 98 c1 4f 48 20 04 80 06 16 e3 c9 70 4e 93 8c 82 32 61 7e 38 1b 51 30 7c 5c 00 00 0f 49 7b 5b 46 86 73 02 05 78 19 6a 40 04 36 4c 06 0e 04 2b 8d 56 66 7c 4b 87 86 85 0f 4a 30 2f 0f 7a 5e 78 49 2a a8 65 75 0d 2a 3a 19 6e 01 0a 18 97 03 26 73 9f 8a 50 87 80 3a b0 4a 00 02 0f 2f 5e 07 07 57 80 c6 66 c9 ca 49 64 30 18 60 cf 95 15 06 71 25 9b 73 53 5b 9c c5 83 86 02 90 dd a7 a1 cc e6 8f cd 31 90 17 88 74 69 08 ba 4f 88 ac 5b ee 49 c5 7a cc bf fa bf 13 92 fc e3 83 6f da bb 27 f1 6e d1 fb 52 a0 52 9e 86 13 50 a8 40 81 26 01 98 1d 0c 2a 5e 8c 58 20 45 0a 0c f0 ff 0c 5e c8 b5 cd 17 8e 1b 48 0a 8d 39 39 61 17 89 01 0a da 10 d1 b0 20 66 1b 99 2c 47 da bc a9 e0 9a 4b 9a 41 1c 04 78 a0 60 4d 50 4a 15 7a 18 0d 0a 27 d7 a5 20 f3 2c 0c 60 ba e0 05 42 34 44 97 32 1d 22 a1 d1 96 30 58 ac 60 59 10 34 c0 53 a6 42 2a 4d 45 8b 16 c1 0c aa 16 ce 0a 6d 76 75 82 5c b6 40 6c cd e1 62 67 d0 29 18 64 f1 b2 cd 24 e1 4d 50 04 01 02 68 1d 6a 18 4e 85 b5 41 88 58 4d 48 00 6d 62 b6 0b 5c f2 29 e6 a4 89 a1 c0 4c 11 2b 0e 2d 41 01 53 c2 12 24 05 79 00 1a c8 b5 ca 41 86 d2 4d d8 d8 81 81 4a 0b 96 12 f8 f9 6d 17 94 d6 93 28 dc 95 00 5b 88 85 da 44 6a a3 4e b0 d4 d6 6c 83 a7 2b 28 48 9c 78 77 6f 5f f6 58 47 a7 90 00 ee 0c 1a 0b 48 3e 98 51 1c 08 11 d3 50 27 94 8f fa 7c 87 56 c4 3c c3 b7 ac f7 c4 c6 0b 43 da 83 5e 58 3a 93 35 2d ad 70 3d d0 9c f5 04 03 4a 53 d7 03 77 e1 15 40 2e 12 e5 e1 50 03 53 e4 67 dc 71 41 11 91 9b 60 68 cd 84 9e 63 1b 3a c0 5e 7b Data Ascii: GIF89a`vLV\]nlqs:ACY$)13!,`I8`(d%Lb,{47,k8@``bA4c!z\|$ScK-Wl8wOH pN2a~8Q0\|\I{[Fsxj@6L+Vf\|KJ0/z^xIeu:n&sP:J/^WfId0`q%sS[1tiO[Izo'nRRP@&^X E^H99a f,GKAx`MPJz' ,`B4D2"0X`Y4SBMEmvu\@lbg)d$MPhjNAXMHmb\)L+-AS$yAMJm([DjNl+(Hxwo_XGH>QP'\|V<C^X:5-p=JSw@.PSgqA`hc:^{
Jun 3, 2021 16:17:31.896773100 CEST	1776	OUT	GET /express/css/main.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1732-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.951420069 CEST	1779	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"1732-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c1a0000dfd7e507e000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZOkzjHq1cOltbyRSAcO6a9RGhxOuy9zN8%2FEk%2FqIe9sm%2FgXy7EyR3aktGES4WlFBSUPAXB9FDBDCHtPmCEy81zI1ehVXPqUsTN92oZq%2BnaCxKbipH7avC58vvtjao%2BsU%2Ff%2BA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba68b95dfd7-FRA
Jun 3, 2021 16:17:31.957490921 CEST	1781	OUT	GET /express/css/modules/menu.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2886-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.014494896 CEST	1788	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2886-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59c5a0000dfd7d5ab9000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OS2WEa2h1etY5B2aXdVo5om1ZQ4QN5Nb0miC6VihK121tPkkn6%2B9dsCrrIcVwaZPAt8Kh9zHcRMSRrNQIOF%2BmLmYLYASVRXR1sENIQacipPgKxfPQFZlr6gZABGprz%2F2n6k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba6ec35dfd7-FRA
Jun 3, 2021 16:17:32.016169071 CEST	1789	OUT	GET /express/css/modules/table.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"3121-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.080413103 CEST	1797	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"3121-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c900000dfd77e28f000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=QP2eEJ%2BXUAxP2RCfU0K1%2BQlpI7cg9vfl%2FbyRNSkXUxPthukrf5YTtF6bXN4%2BtrjjH6gOB1xC%2F5A8ovjCZBaKfrbVnsUJDY5k8cMfA8d%2BkrFHwNb9vp%2BO78MgMFljE%2BGlY4I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba74ce7dfd7-FRA
Jun 3, 2021 16:17:32.081267118 CEST	1799	OUT	GET /express/css/modules/appointment.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1227-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.135821104 CEST	1803	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"1227-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59cd30000dfd7dabe0000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VoY4jLPBwf8ehjMf9Vy6SR2G78cALT%2BGXomjpcdjNU99vJj6o2qS7QsrqO%2B0CcgDS5ixc3N4qXTUc3cxPgVuOLF1DLSueIMa5DjfkZILdZ8CpKKn%2BscqjFTZOpYf%2F%2ByVwNQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7bdd8dfd7-FRA
Jun 3, 2021 16:17:32.137340069 CEST	1804	OUT	GET /express/javascript/ieEmulation.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"6959-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.188816071 CEST	1813	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"6959-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59d090000dfd7813f6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9QebsGnXRJsV0Owq9Ix%2BzAMtO7XfE3qpWr6SppViihK591Q94yMxUsLYsxpy6GjqgP3TTM48Tv8a6Bas2ohSQ86LULBnYNLh%2FyrJ4t%2BAhyL1t28o%2Fp%2FziQVmoShMJYRY7TU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba80e78dfd7-FRA
Jun 3, 2021 16:17:32.189692974 CEST	1814	OUT	GET /express/javascript/dropShadow.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2700-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.243592978 CEST	1820	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2700-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d3f0000dfd7861c7000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=eycZKbc4N7hdPio7NDaZs6PUxDsdZbZoyHheORj0wXM50N2bnSWK%2BNUF%2B8aCr4UoagAcVgbWc%2F5fhEfHkMba2sn4ZV41ecQr8lYocS176ymLQtLVWu0w211FmJWMPZ4%2Bjnc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba86f0ddfd7-FRA
Jun 3, 2021 16:17:33.702013969 CEST	1870	OUT	GET /express/skins/gpa/n4client.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/about.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 24 Apr 2018 18:47:44 GMT If-None-Match: W/"13807-1524595664000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49717	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:09.178812027 CEST	1066	OUT	GET /express/n4addendum.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.512181997 CEST	1083	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"9069-1619547716000" Last-Modified: Tue, 27 Apr 2021 18:21:56 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5435b00004e32d1098000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5qiAGCkaGMndH1NR6JvAFPrKYJnJkzm0RWZ4Hr%2BxlqD9Pe6QeEDG9GGdw5cRXlSEWUHg52Dr%2FvX5%2F3gb3dbJaviFQePDHadxY9PrmeNs%2FjFLZuwV%2FlZAtMyzG9X5%2FH3H6HQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b189c5d4e32-FRA Content-Encoding: gzip Data Raw: 38 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 e5 5a 6d 6f 22 39 12 fe 9c fe 15 25 cd de 69 07 05 68 20 c9 4c 9a 4f 04 7a 32 68 99 10 11 66 56 fb 09 99 76 01 d6 34 76 cb 36 10 16 f1 df 57 b6 bb 09 2f 4d 26 17 66 72 27 5d 47 49 d4 b6 ab ea f1 53 e5 f2 5b 97 0b 1e 00 40 7f c2 14 30 05 84 c3 dd 05 3c 68 c2 29 91 14 94 5e c6 08 6a 82 a8 81 50 8a 9c ce a6 25 af 50 00 68 6b 50 13 31 8b 29 0c 11 a4 88 63 a4 c0 b8 16 a0 27 68 54 28 4d 81 28 50 42 70 f3 5f 22 51 82 93 61 8c 25 6b ef 01 11 3e eb 69 0c 54 44 b3 29 72 0d 7a 42 34 50 54 91 64 43 54 56 cd 4c 91 31 82 18 81 36 e8 86 38 12 12 61 2a 28 1b 2d 19 1f 3b 45 4d 91 2c 25 1b 4f 34 fc 1e bd 87 aa ef d7 60 b8 84 3b 32 67 0a 9a 42 26 ae d5 9f 92 69 8d dc 54 35 63 b2 84 3b 5c 68 c1 cf 6d 7b db e0 b7 36 0d 80 5f 6c fa 18 29 75 3e 87 4a a9 72 61 da 7c 2c fb b5 b2 7f 09 fe 55 50 ad 04 97 97 30 1b 13 8e 8a 70 08 1f 13 f8 cd 2b 94 3d 4f 61 8c 91 5e 79 b0 60 54 4f 82 ca 07 3f 79 f4 d6 59 79 69 2c 09 a7 b8 a9 ae 55 fd e4 b1 be 55 3f 45 fa 24 fb 71 af 32 96 e3 4d 65 f5 e2 43 5a 59 2e 80 26 c3 0e e3 df 81 23 52 05 5a c0 42 c8 ef 30 12 12 84 9e a0 04 8c d1 90 6b c8 53 8c a2 f1 6f 34 11 52 41 a1 ec 95 52 61 6f e5 9d 4d 89 1c 33 1e 80 b5 7b 36 12 5c 17 17 68 58 0d 60 28 62 5a f7 ce 22 11 0b 19 c0 bb 2b fb 64 8d 14 fb 1b 03 a8 54 9e c4 46 64 ca e2 65 00 73 94 94 70 72 0e 44 32 12 9f 4f 30 9e a3 66 11 a9 7b 67 1a 1f 75 91 62 24 24 d1 4c f0 00 b8 e0 68 7b 54 8a c5 98 f1 be 09 93 d5 2b 60 d4 2c 8c 21 89 be 8f a5 98 71 5a 74 ad df 85 61 18 b6 5a 5b 16 1e 66 c3 29 d3 3d b1 58 79 30 71 06 2e 32 ca 4b 4a d3 0c 81 63 fc d2 cf ea b4 2c 09 4a 41 d3 6d a0 90 63 d0 37 3f 60 b4 4d 30 4e ac 8b 56 36 ce b6 39 ca 28 3a 60 c8 34 4c 35 5d 5f 5f d7 9f 04 6d 3f 2b 16 8d 29 db 27 d2 f1 68 6a 8e 73 60 6b 85 a4 28 03 25 62 46 a1 92 3c c2 93 99 84 50 ca f8 38 d8 d8 48 23 63 f3 9e d2 55 b9 ca 0a 52 89 a2 1d 84 Data Ascii: 86aZmo"9%ih LOz2hfVv4v6W/M&fr']GIS[@0<h)^jP%PhkP1)c'hT(M(PBp_"Qa%k>iTD)rzB4PTdCTVL168a*(-;EM,%O4`;2gB&iT5c;\hm{6_l)u>Jra\|,UP0p+=Oa^y`TO?yYyi,UU?E$q2MeCZY.&#RZB0kSo4RARaoM3{6\hX`(bZ"+dTFdesprD2O0f{gub$$Lh{T+`,!qZtaZ[f)=Xy0q.2KJc,JAmc7?`M0NV69(:`4L5]__m?+)'hjs`k(%bF<P8H#cUR
Jun 3, 2021 16:17:09.548713923 CEST	1102	OUT	GET /express/css/modules/menu.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.881597042 CEST	1160	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2886-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d544cd00004e32e70d0000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=R6D9wuDIFwh0xllo95RyW87eg9eAO6iHbpJSAjWk6rrQxakmtxQF1SxB6pJUSZk%2FW%2FtK3%2FiV%2FmJBYvKX4JC7sWBmdaLTmqnlxdC%2FJR4ialfY%2BZHpHUnvxkkNqmz0Z1c5tVQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1aeaa04e32-FRA Content-Encoding: gzip Data Raw: 33 31 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 55 5b 4f db 30 14 7e cf af b0 8a 26 b5 53 1b 92 55 50 08 aa b4 42 53 a9 d2 d8 c3 00 89 3d 4d 4e ec 34 16 8e 9d d9 4e 2f 4c fc f7 c9 4e 4b 9c a6 b4 63 83 a5 0f 49 bf 73 f3 f9 ce c5 c7 1f df e8 39 76 8e f5 0b 5c 87 5f ef dc ab 9b 1b f0 77 8f ed ea 4e 62 04 a2 15 88 39 53 78 a9 40 86 59 21 01 64 c8 7c 45 50 94 88 7b d8 d5 db 24 78 c8 17 20 59 ce 85 92 65 e8 3f 21 6b 6a 0c 00 64 2b 90 71 54 50 0c 62 29 81 c0 3f 0b 22 ca dc 55 4a a4 01 ff 4b 86 9f cb 0c 40 21 68 bb 25 53 88 f8 c2 8d a5 6c 75 2e 1c c7 81 ae a6 fb b2 50 8a b3 2e b0 ff 05 94 b0 87 2d 08 c6 8a cc f1 16 38 27 92 28 8c b6 d0 94 cf b1 a8 63 a3 1d d6 25 b6 23 d6 5a 00 5f b6 59 c7 75 7e 39 00 a4 98 cc 52 15 f8 9e f7 e1 c2 01 20 87 08 11 36 0b fa f9 12 9c e4 4b 0d c5 85 90 5c 04 08 27 b0 a0 4a 23 09 67 aa b7 28 0d 23 4e d1 33 26 c9 23 0e 7c af b4 b3 b5 18 17 19 a4 95 9e 5a 51 6c 81 11 8c 1f 66 82 17 0c f5 62 4e b9 08 8e c2 30 0c c7 63 13 de 00 e0 e8 f4 f4 d4 a8 72 81 b0 08 fc 7c 09 24 a7 04 01 4b 55 8f 45 0f e1 98 0b a8 08 67 01 e3 0c 6b 1c 11 99 53 b8 0a 08 a3 a4 44 1e 7b 84 21 bc 0c bc 0b e7 c9 69 b2 6f 98 29 23 f5 14 cf ed 68 93 c9 a4 3a 46 8f e2 44 bd 2c 8d b8 52 3c b3 e5 e3 c1 78 70 15 5a 2a a2 64 bf a9 51 3f d6 fb 34 c0 4e 59 83 80 66 16 f5 2c 1b 29 d4 c5 5b fc 35 18 d8 a6 d0 52 68 76 c5 28 1c 8d cf 35 39 88 cc cd d1 cd 41 73 2e 89 29 38 80 91 e4 b4 50 a6 c6 c6 31 58 37 a3 3e c5 e6 5b 67 1f 11 4a d4 2a 00 29 41 08 33 bb 25 80 ef 79 3b a3 db 9d f6 62 6f 1c 6c 8f 43 1d 72 e6 e9 df 3e 7a 2b 8d cd b0 6e 12 9b 4c bf dc 86 df 02 47 2f c3 5c f0 19 41 c1 f8 7e 9a c1 19 be 15 90 c9 84 8b cc bd 26 b1 e0 92 27 ca 9d 40 84 db a8 28 67 65 e8 f6 bb ba f0 14 e6 43 df f5 bc 8e 4d f2 8d 59 7d 7b a8 6e 56 ca 33 cf de 32 6c a6 12 44 94 c7 0f f5 12 bc 3e 9b 11 cd 53 d8 36 8b 65 e8 75 79 0e 63 a2 56 43 df eb bc 11 1b d5 e9 ce Data Ascii: 31eU[O0~&SUPBS=MN4N/LNKcIs9v\_wNb9Sx@Y!d\|EP{$x Ye?!kjd+qTPb)?"UJK@!h%Slu.P.-8'(c%#Z_Yu~9R 6K\'J#g(#N3&#\|ZQlfbN0cr\|$KUEgkSD{!io)#h:FD,R<xpZdQ?4NYf,)[5Rhv(59As.)8P1X7>[gJ)A3%y;bolCr>z+nLG/\A~&'@(geCMY}{nV32lD>S6euycVC
Jun 3, 2021 16:17:10.122651100 CEST	1164	OUT	GET /express/css/modules/tab.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.445218086 CEST	1174	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2768-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5470b00004e32f78eb000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3jOdK9MWWWFVw14I%2BgNM6GePquIpg9xSR0SopupMBgpNeiBaEFTqa3kgSh2vNtIfl8GzCdM5wMcC3Z7V8qGIIUiGjYzMovIOgbGsRHyr3d0N%2Fxexu2o8LTo%2FthaKSQgC6io%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1e7d2b4e32-FRA Content-Encoding: gzip Data Raw: 32 33 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 55 41 6f db 20 14 3e db bf 02 a9 97 ad 9a ed 25 d9 0e c3 a7 c6 4d b7 43 4f ab 77 8e 9e cd b3 8d 42 00 01 69 dc 4d fd ef 13 76 d2 a6 4d ab 64 59 52 15 24 63 1b f4 de f7 7d 8f 0f 92 f3 23 b5 24 4c fc 40 f2 8b 71 9c dd dc 90 03 db 66 a8 4c 49 67 94 b0 04 b4 46 30 20 4b 24 aa 22 0e 0a 1b ff 5b a8 e3 10 dc 19 8b 7c 17 aa 00 61 c9 be 62 5d 68 2d 38 5a e2 14 01 21 f6 66 76 32 86 b1 83 22 87 42 60 f8 27 f4 09 96 9c b9 86 c2 c2 a9 34 bc df c1 bf 2b 17 4a 47 72 28 76 29 b0 e6 ff cb 22 23 95 32 1d f3 55 99 b9 ac 09 97 c4 35 48 ca 55 44 30 08 f1 5b f1 bf e6 72 f6 89 ac df a6 50 3a 7e eb f5 08 0a 65 18 9a c8 29 4d 07 ba 25 56 09 ce c8 d9 d5 57 df d3 30 28 95 50 86 9e 8d 46 a3 34 0c 1c b6 2e 62 58 2a 03 8e 2b 49 a5 92 98 86 41 a5 a4 8b 2c ff 8d 74 30 d0 6d 1a 06 1a 18 e3 b2 a6 64 a4 5b 32 f8 ac db 34 08 03 c6 ad 16 70 47 0b a1 ca 59 1a 06 cb 86 3b 8c ac 86 12 a9 54 4b 03 3a 0d 83 5b 34 8e 97 20 22 10 bc 96 74 ce 19 13 e8 ab b4 8d dc 4b 55 2e 8c 55 86 32 ac 60 21 dc 7a 5d 06 7a 2a b0 72 eb 72 bf 90 c8 ff 2f a0 9c d5 46 2d 24 8b f8 1c 6a a4 0b 23 3e c4 71 12 c7 49 f7 6d 13 5f 3f ff 18 24 7d d6 bc 8b 7d 8d 95 9b 16 75 ce 05 c6 35 af 3e 6e 45 33 a8 11 1c ed 87 e8 6e 35 ff a2 ce df ae 7c ef 57 3c e3 5e 28 e7 d4 3c dd d8 b1 43 2f ee 23 45 c3 eb e6 98 1c dd 7f b0 7b 05 7b 0f 36 67 4f ab b6 5b 8a 57 d3 b5 5b f3 5a 59 de 6d c6 4d bd 36 e6 57 1b 78 f2 c5 f7 47 44 87 40 d9 47 c1 9f 6a 39 de 5b bc 83 d9 64 59 b6 fb e8 3a 27 3f 10 18 9a 23 1e 5d 4d 1f 50 83 44 d1 5d 5a 0d 92 39 70 49 34 d4 18 9f e2 e8 ea 33 e6 27 30 f5 f0 7d 99 fa 09 d1 e3 5a 7b 78 22 6b 3f 40 7e 17 06 9f 4c 26 97 97 cf 71 9d c0 e6 c3 b7 b3 b9 bf 83 27 e3 34 bc ff 0b 4e 8e 02 95 d0 0a 00 00 0d 0a Data Ascii: 234UAo >%MCOwBiMvMdYR$c}#$L@qfLIgF0 K$"[\|ab]h-8Z!fv2"B`'4+JGr(v)"#2U5HUD0[rP:~e)M%VW0(PF4.bX+IA,t0md[24pGY;TK:[4 "tKU.U2`!z]zrr/F-$j#>qIm_?$}}u5>nE3n5\|W<^(<C/#E{{6gO[W[ZYmM6WxGD@Gj9[dY:'?#]MPD]Z9pI43'0}Z{x"k?@~L&q'4N
Jun 3, 2021 16:17:10.656352043 CEST	1180	OUT	GET /express/css/modules/appointment.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.014352083 CEST	1206	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"1227-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5492100004e32ed819000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=p9hxvEsARahRcO0UBBANyT229ottI52PotM3V9SxPpPE9OyiiwvBHFu8Q8FTGZNOox7SsNiFe9zmAUzVIODKRad71PJ%2FsZ26dV5ySf2WpUFzl9s0BycqGv3vDFdrAw9p5Pw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b21cf504e32-FRA Content-Encoding: gzip Data Raw: 31 38 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 94 df 6b c2 30 10 c7 df f3 57 04 86 2f 42 ab 93 c9 6c 7d d2 d9 32 61 73 03 7d 1f 69 73 d6 b0 98 84 e4 9c ca f0 7f 1f a9 ce 29 a3 ee 87 de 3d 14 ae c9 e7 fb ed 5d 93 46 fd 42 d1 20 0d ff a0 bd e7 e7 a7 e1 68 f2 98 8c 26 e1 dd 78 4c ff 18 87 a8 31 ae 25 38 ba 70 c0 29 6a ca 85 33 92 ad 29 33 46 0b 85 73 50 48 2d 48 86 c0 a9 61 05 b8 b0 1a 75 66 1c a0 2e d3 2b 12 4a 96 81 bc 07 c6 c1 92 77 e2 45 32 96 bf 16 56 2f 14 0f 72 2d b5 8d af 58 19 dd f2 ed 54 2b 0c 96 20 8a 19 c6 99 96 7c 5b 5d ce 04 42 e0 0c cb 21 56 7a 69 99 e9 92 0d 09 55 66 cf 46 23 ac 30 60 52 14 2a ce 41 21 d8 92 5c da 4e 14 da 75 25 7a d0 f6 f9 0d 22 61 8a d5 a6 cb ba e0 38 8b 3b 2d b3 2a a5 2c e3 42 9f 96 4a fa 3e 4f f9 65 9c 1f 22 0c e3 5c a8 22 6e 76 7f 20 6e 48 88 2c 93 f0 f2 b5 a4 d2 45 14 45 7e 03 09 91 ff 66 79 1a f9 f4 3b b8 78 0b 99 31 38 f1 4a 74 b7 5e 5b 0e 36 70 fe df 8f 9d 96 62 37 8e 5d 7d db a3 6b df a2 83 ea b1 91 70 aa ed fc c1 0f 6a 52 ed 62 70 9b f4 d2 ce bf a7 d4 aa ed 95 86 ca 2c f0 84 52 d2 4f 6f d2 fe 69 e8 7e 2e 9f 1f b6 55 69 37 6b 64 e3 cf 1d 4d 14 3f 3a f8 ce 40 2e a6 22 a7 6e 7b 49 d4 eb 8d 0f 7a 23 f6 cd cb 04 00 00 0d 0a Data Ascii: 182k0W/Bl}2as}is)=]FB h&xL1%8p)j3)3FsPH-Hauf.+JwE2V/r-XT+ \|[]B!VziUfF#0`RA!\Nu%z"a8;-,BJ>Oe"\"nv nH,EE~fy;x18Jt^[6pb7]}kpjRbp,ROoi~.Ui7kdM?:@."n{Iz#
Jun 3, 2021 16:17:11.018070936 CEST	1206	OUT	GET /express/images/s.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.374346018 CEST	1244	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 43 Connection: keep-alive ETag: W/"43-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes cf-request-id: 0a73d54a8f00004e32ef046000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VBl5VzKQws25ZP%2FI8wXkSYACY3%2BhDIkHdp%2Flp9y%2FVaI0zbW8wDxrhwm5pU82gQbjxwiCVJvQdQfvVcxHD2tadoPW4ew7ckcRC7Z0fTYBvNYhsLTZS%2F8Ln7fR3o1i1O65qXQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b241ddb4e32-FRA Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;
Jun 3, 2021 16:17:31.900827885 CEST	1776	OUT	GET /express/n4standard.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMT If-None-Match: W/"19654-1619547716000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.952325106 CEST	1780	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"19654-1619547716000" Last-Modified: Tue, 27 Apr 2021 18:21:56 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c1e00004e327cbb1000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=o3covnFuJ0Lx7YG1Z0FmYjMxWB4Z4re3mhX%2FLH34%2FA23g%2BgnViu%2BOnqeW4xzg5hqEfiadyjvSC3TZJEYS09tGbbkvVHz%2FPE0%2BBxWsQ25T5bjpf0zCYhDq9yGMp7mInBrDXE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba699da4e32-FRA
Jun 3, 2021 16:17:31.956181049 CEST	1780	OUT	GET /express/css/modules/font.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"833-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.008690119 CEST	1785	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"833-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c5400004e32939e6000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=F0qj35hxXvywl2VNg4j3yvyQYb9IIKZfDtto6amtrTPl6%2Bn1rMFEvAht0KUaiCPE%2Fdvwh1LBqvnd%2BxWxSy1rLC3E5XwfUWSby6t22d%2Bm7NO20iqGWFf3UgAYMG1ntU3pq6A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba6eac14e32-FRA
Jun 3, 2021 16:17:32.009980917 CEST	1788	OUT	GET /express/css/modules/button.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"3835-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.064129114 CEST	1794	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"3835-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c8a00004e32f63d7000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xNwsCro5iQI%2FQNRNA0Qvi70hEGga1Wxp7SLs%2FjAO%2FCzkjHfg1Vli9d5ElXjnDuW4X4AKidhlOi6aL8tXUOfk8ZyRl8yiZSl%2FMv%2BDmeLBTT5QeNgNsqwGP6%2F%2F30qvo%2BVyoY0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba74bd44e32-FRA
Jun 3, 2021 16:17:32.065104008 CEST	1794	OUT	GET /express/css/modules/shadow.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"718-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.124943018 CEST	1800	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"718-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59cc900004e32851aa000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=FAe9e87BpLWzN23jolUwNPwt4U5HlEVxGaDmuHbDdl91TyBLhE%2BS73daEED3k6ipdRe%2FM%2FWhRsQV1Yf411OWM47D6DzAf%2BhkrifMUI45G4KkdBRgYAxJcHp0kJ%2BXiWEQKxA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7acf64e32-FRA
Jun 3, 2021 16:17:32.126076937 CEST	1801	OUT	GET /express/includes/popupWindow.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2361-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.186532021 CEST	1812	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2361-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59cfe00004e328f1a8000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=XoQaxEbz6jXFUG6sVg30GZmSUCJRXmHdwa72g3hbBUQ1iKPPeLKQ19M0A7h9DPWThEszfeBP%2BcPvy2XTYKl5%2B7E6Xu3yX4gtr3cBsPTrfVICUIO82zgbjKqbCj80FNv6gWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7fdfa4e32-FRA
Jun 3, 2021 16:17:32.187231064 CEST	1813	OUT	GET /express/javascript/getOptions.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"4948-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.237107038 CEST	1818	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"4948-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d3c00004e329b8ec000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YoxkaI5a1%2BGloXyC3391%2FAY0MBVS3NIdH%2BBaPmQGEriZvJstJsUWnOkGZaLzBYtv%2FqSi8XFEU0F7S1NvWypIlxQDECUGhxmXK%2FFxGgigOb4yoxxRT7ogwLsHAMQDxywLZH8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba85efc4e32-FRA
Jun 3, 2021 16:17:32.238801003 CEST	1820	OUT	GET /express/images/s.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"43-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.297590971 CEST	1825	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"43-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d6f00004e329cbfb000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=E%2BaVOr4S0VhuffBy6byf8jhYFU%2BRlW1nCkd6Zg%2F8UgpB3bVNH4MqkqUJeSXUymncgEKkzsIVHXij2qjaJwcVV0lspE6%2BkjDAQsSxlEg1M5Mt9GyZ0%2FfAJSMtyZ6hADxyhzE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba8bfc54e32-FRA
Jun 3, 2021 16:17:32.414556980 CEST	1828	OUT	GET /express/images/spacer.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"43-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.467664003 CEST	1833	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"43-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 350 cf-request-id: 0a73d59e1e00004e3298047000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=T%2FrWxBFOgNpp4R%2BCg1XyKCIAXLeDlSlnSQB%2FLn8s0Vr1maSD%2BmXllUMpc8sc7uQoWEVF87cwKHp9h1gt6tfqo4eaSsVWKjahHCNOGfXLFi8Lz24QsQPnM3a5RqM3sDPAIKA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba9cadf4e32-FRA
Jun 3, 2021 16:17:33.680558920 CEST	1868	OUT	GET /express/css/modules/tooltip.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/about.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1853-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:33.731535912 CEST	1870	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:33 GMT Connection: keep-alive ETag: W/"1853-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 24 cf-request-id: 0a73d5a31100004e3279b38000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wd05athuH2nkAQ0vQ2WcQLG7Fosp4LIsb565XF4%2BYkOv0DgQUG7Kd4q8hi0dyM5PwgXWw2ZolTF3m9Q8kIEus1C6GoL5vnaRZgL2sxP0C4GSD1boSeRYgS1aMu40BOKGFJE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998bb1b9a34e32-FRA

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49718	104.26.6.110	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2021 16:17:09.185264111 CEST	1067	OUT	GET /express/skins/gpa/n4client.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.522988081 CEST	1088	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"13807-1524595664000" Last-Modified: Tue, 24 Apr 2018 18:47:44 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5436200004ea4c5049000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Lm%2FNrwnvflKD1peTkG7l7hHksZv%2FTWM8%2FGGsq3NZsAU5XQ7Ku560EtpSTunStM0XM4dQRgRYz2hxcbNLxQAhXVwUu5ArsXFgxHUfhw3Fjermbm4mQIflq0jtwPRcV4Ke8A0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b189dab4ea4-FRA Content-Encoding: gzip Data Raw: 39 39 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 5a ed 4f e3 38 13 ff bc 48 fc 0f 23 71 27 dd 22 5a d2 96 b7 a6 9f fa 92 72 e8 01 ba ea b2 7b da 4f c8 6d dc d6 da d4 8e 1c b7 c0 21 fe f7 47 7e 4b 93 26 69 0b 05 0e 1a dd 69 63 8f 3d 33 bf 19 4f 66 c6 1c ee ef ee 00 00 5c 1f 41 3b 20 98 0a 88 42 3c 24 23 32 84 48 3c 04 18 a2 09 c6 a2 ac 89 7a 73 cc 39 f1 71 04 6c 04 98 0a 4e 70 04 84 02 3d 8a 04 a2 3e e2 7e 79 18 45 30 62 7c b1 cb 50 ed 1a e9 0d da 2c 7c e0 64 3c 11 f0 d7 f0 2b 54 1d a7 06 83 07 b8 46 73 12 41 9b f1 d0 f0 f9 87 13 21 30 95 73 df 26 24 80 3e 1b 60 2e 22 46 0f d4 1a 4d f4 c7 85 ef 02 3d d2 fb 4b be 07 73 a8 94 8f 15 c5 61 c5 39 74 4e a1 5a 71 2b c7 6e b5 0e b3 90 a3 08 f9 e0 dd 87 f0 c7 ee ce fe e1 ee ce ee 4e 79 c0 11 f5 09 1d 37 39 46 bb 3b 8f bb 3b 5f 46 8c 8a 52 44 fe c5 2e d4 aa a1 68 ec ee 7c b9 23 be 98 b8 50 71 9c 3f e5 eb 00 0d 7f 8f 39 9b 51 bf 34 64 01 e3 2e ec 39 4e ad 56 af 37 76 77 9e e4 ae c2 2f 07 6c 4c a8 dc f4 00 84 5f 9e e0 20 5c 70 18 30 ee 63 ee 42 25 bc 87 88 05 c4 87 ef 24 98 63 de 48 73 af 54 c2 7b 39 34 c7 5c 90 21 0a 4a 28 20 63 ea 82 60 a1 1c 36 6f 0a 4a f9 be 10 45 fe 0a e4 ec 9c 7a cd ee 99 9c 0c 91 2f f5 76 e1 58 71 b1 72 4f aa 20 d0 20 c0 5a ec aa fe bf 12 3b b3 9b e2 54 ab d9 c5 e5 08 23 3e 9c 2c d4 34 1c 4a 4a 42 17 4e b4 36 76 34 c0 23 21 21 d5 a3 39 6a 5b c2 01 13 82 4d e3 f5 53 c4 c7 84 ba 50 d3 af 56 b1 9a 12 24 5e 24 58 18 af 58 05 83 96 7c 68 5d f2 79 c2 d7 9e 29 bb 62 76 b8 0f 63 8e 1f 60 30 13 82 51 90 6e 58 d6 ff ae b8 01 a1 bf 0f 20 7e 9d 93 88 08 ec 2f 46 8c fb 14 1b 22 b6 6a 35 89 ce 5e b7 db 8d 05 bd c3 4a a3 01 0b fc b4 f0 56 76 03 b0 d9 41 e0 7b 51 f2 f1 90 71 24 08 a3 2e 65 14 37 62 1f d6 38 2f fc 78 af 5e 93 4f 82 c0 98 79 05 85 41 38 41 72 d4 94 4f 82 c4 c2 98 47 23 c3 c0 44 eb 54 d5 ce 24 47 86 33 1e 31 ee 4e 10 f5 63 2b 5b 58 27 6c 8e f9 02 d4 5b f5 5e 04 ed 69 Data Ascii: 994ZO8H#q'"Zr{Om!G~K&iic=3Of\A; B<$#2H<zs9qlNp=>~yE0b\|P,\|d<+TFsA!0s&$>`."FM=Ksa9tNZq+nNy79F;;_FRD.h\|#Pq?9Q4d.9NV7vw/lL_ \p0cB%$cHsT{94\!J( c`6oJEz/vXqrO Z;T#>,4JJBN6v4#!!9j[MSPV$^$XX\|h]y)bvc`0QnX ~/F"j5^JVvA{Qq$.e7b8/x^OyA8ArOG#DT$G31Nc+[X'l[^i
Jun 3, 2021 16:17:09.531037092 CEST	1093	OUT	GET /express/css/modules/font.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:09.857608080 CEST	1152	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:09 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"833-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d544bc00004ea483b79000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Lc40Xx%2FsHt5IbNN2dA9mtkNSTOwxuT7BWNsESU5tQHpvpiDAVhVlYh3hi9hDajei6LbpYHbfuhQ2ZEoHg6MdimQZperIKYepcSqObCXyi68gTTAO00GdVU3tEWhgzChCeYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1acc0d4ea4-FRA Content-Encoding: gzip Data Raw: 31 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 50 c1 6a 02 31 10 bd e7 2b 06 7a 2b 71 5d 15 04 d7 53 11 7a 6c 0f f6 07 c6 ec ec ee c0 98 84 24 5b b5 c5 7f 2f 51 4b b5 96 52 8a 73 19 78 f3 de e3 bd 19 de df 68 86 6a 98 17 3c 3e 3f bd 14 8b e5 12 fe 37 e7 56 0b 67 53 70 12 21 75 04 e8 3d 61 40 6b 08 5c 03 28 02 8d b3 29 42 1f a9 06 b6 9f 1c 61 83 89 9d 2d 2e ad 1e 44 c0 63 4b 11 62 e7 7a a9 c1 64 87 d4 71 84 86 85 8a bf a7 ba cd af d4 ca d5 3b 0d a9 d6 e0 35 08 6b 60 eb fb a4 21 d1 36 61 20 d4 80 1a 56 7d 4a ce 6a 70 3e 57 d2 10 49 c8 24 f5 ae 72 a6 5c 7f 10 f9 8d aa d1 c8 6f e7 5f d8 86 b8 ed 52 65 5d 58 a3 9c e1 31 ed 84 ae e1 06 d7 2c bb ea 95 42 8d 16 35 06 46 d1 11 6d 1c 44 0a dc 1c 99 c6 89 0b d5 dd 64 32 99 ab bd 2a 28 04 17 4e 39 4e 27 63 ca b2 2c af 63 ac 9c d4 07 cd 06 83 65 db 5e aa 66 b3 e9 f4 37 55 37 ba e4 1f 02 7c 6b 3f fe a9 fd d1 20 a3 6b 0c 2d db aa cc ac bd ea c6 37 36 fc 00 f6 63 14 f6 41 03 00 00 0d 0a Data Ascii: 131Pj1+z+q]Szl$[/QKRsxhj<>?7VgSp!u=a@k\()Ba-.DcKbzdq;5k`!6a V}Jjp>WI$r\o_Re]X1,B5FmDd2*(N9N'c,ce^f7U7\|k? k-76cA
Jun 3, 2021 16:17:09.862010002 CEST	1158	OUT	GET /express/css/modules/button.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.206104040 CEST	1171	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"3835-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5461100004ea4898de000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6bFyAdkEDrlv8GuKkeNNVSlcvyF4T%2F6BuksRFiH2wUzPOZfjErsisDeiCSmEtVsCnPi69P5jXWrcia2uk9oDFLPUBMYuQcklblkIzWryOQLWfw2cTqQxor1E3QMCZ6alsHc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1cea864ea4-FRA Content-Encoding: gzip Data Raw: 33 34 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 55 db 6e e2 30 10 7d 26 5f 31 6a df aa 05 4a e8 6d 43 55 a9 25 74 df 76 a5 6d fb bc 1a ec 81 58 75 ed c8 31 85 aa da 7f 5f 39 21 e4 42 0a a8 2d bb 9b 91 b8 78 26 e3 39 33 c7 3e dd a3 4f 7a ba 5e d7 7d c1 cd c3 fd fd 8f ef 9d e1 dd 1d bc e7 29 a7 1a 6a 65 8d 96 09 60 1c 13 1a 54 8c 40 4f 00 a5 84 f1 cc 5a ad 12 40 66 74 92 80 8d c8 05 49 c1 d0 0a ad 3a f5 54 9f 03 70 5b ae 65 55 d7 86 10 76 6b d6 43 42 1c c6 2f 69 fd 97 16 c7 92 ae c0 46 68 81 69 65 51 a8 0c 59 96 16 48 d2 13 29 9b 74 9a 9a f5 39 08 3b 05 02 ef d5 73 5b c4 c8 b9 50 d3 e0 38 5e 40 af f2 31 48 fd 96 16 b6 8d 52 4c 55 60 c4 34 b2 03 ef 77 9e e5 de e1 59 a6 79 42 33 15 2a 48 5f 5b 05 fc d4 f3 f5 5d 9c 7f 2b a4 65 4b 7a b0 2b 2b bf 19 7c c9 49 d3 81 ac ef 13 6d 20 c6 29 b5 25 3d 93 04 1d 93 49 d9 53 6a f0 de 1a ed 52 a5 b3 8d d1 90 b2 70 69 f9 15 88 04 66 ae 30 ab 81 1b 9c 67 b3 d7 86 93 81 f2 74 7a f7 fc 0b 14 bf 7f 71 9a e0 4c 5a ef d5 6b 65 d1 41 2f 5e 40 a2 a5 e0 70 f8 f5 d6 d9 c0 6b cd 23 61 a9 9d c4 c8 28 50 7a 6e 30 1e 78 2d 36 33 89 36 41 ac 85 b2 64 4a a3 d9 9a f7 74 e8 cc bd b1 82 b2 a4 a9 b0 09 c9 89 03 e3 40 28 98 0b 1b 01 82 14 ea 11 b4 c9 fe a6 7c cf e2 af 72 5e 57 31 16 08 f3 3a 8a 95 00 99 15 cf b4 1e b2 74 b8 8a 99 96 da 04 87 fd 7e 7f 90 97 df b6 3a 2e 43 b8 3d 75 56 b8 25 4d ec 26 ff 58 5b ab 9f ca 11 c3 5b 67 45 44 7a 02 9a 03 90 3d 4e 8d 9e 29 de 5e 56 36 3a 71 36 f0 5a e9 09 e2 c4 74 c6 be 40 69 45 0d a3 69 e5 67 04 fa f1 02 ce e3 c5 a0 e5 b5 ba 47 5c 24 b1 c4 97 60 2c 35 7b 1c 1c 75 f3 81 1c 2c 5b 72 b0 ba 2a 19 2a 40 99 68 88 f0 99 00 81 8b c9 84 52 f2 95 ae d7 ca 0c 4a 0c 70 87 60 1d 43 78 e1 ac 89 04 f9 4c 23 4c e0 49 1b b7 2e a4 6d 0b 95 1f 75 77 cd 29 40 b8 c4 2b b0 38 05 ae 29 c9 76 cf 32 14 3c a8 fe af d5 94 37 c5 f5 dc cf 2e 8f 7a 29 0e 37 8b 50 4d a9 0c 74 1e 91 02 26 05 7b 24 5e 45 bd 0b bb de 64 04 Data Ascii: 347Un0}&_1jJmCU%tvmXu1_9!B-x&93>Oz^})je`T@OZ@ftI:Tp[eUvkCB/iFhieQYH)t9;s[P8^@1HRLU`4wYyB3H_[]+eKz++\|Im )%=ISjRpif0gtzqLZkeA/^@pk#a(Pzn0x-636AdJt@(\|r^W1:t~:.C=uV%M&X[[gEDz=N)^V6:q6Zt@iEigG\$`,5{u,[r*@hRJp`CxL#LI.muw)@+8)v2<7.z)7PMt&{$^Ed
Jun 3, 2021 16:17:10.209290981 CEST	1173	OUT	GET /express/css/modules/calendar.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.538352013 CEST	1180	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive ETag: W/"2243-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5476100004ea4edbcd000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AGShkDFDmtC2iMI2u1r9n1l2aydGyr1HLjE6xHzAe%2BTBvV%2Fa%2FaZiY1sjdC%2BQiJDikVRJ3mTk1ZMNtMahMjsJ6oHPyBHWoGPNvnlkQa2ANozmgyqldFQww2LZ3XjzoOaR%2FLw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b1f09af4ea4-FRA Content-Encoding: gzip Data Raw: 32 33 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 55 c1 8e da 30 10 bd e7 2b 2c a1 4a ed 6a 03 09 ec ae c0 9c a0 54 e2 d6 4a 3d ec d9 89 27 c9 68 8d 1d 39 0e 85 ad f6 df 2b 27 26 09 81 42 a5 02 23 71 98 99 3c cf 7b 33 1e 0f 62 25 0d 43 09 da fb ed 11 f7 cb 55 81 06 95 24 94 b0 a8 50 a2 34 30 6f 82 02 12 43 28 09 83 20 df b5 5e a3 f2 53 e7 2f e4 26 b3 ee f0 a5 eb 1e 3d 64 80 69 56 a1 3c 8f bb 91 58 60 4e 35 c4 e6 73 90 ef 48 38 9e da 7f 9b 42 82 7c f7 65 fe 30 6a 32 b7 58 60 84 02 cd 9e 50 92 21 e7 20 5b 98 77 1f 25 87 1d a1 64 dc 3a 23 a5 39 68 1a e6 3b 52 28 81 9c 0c 66 b3 d9 dc fb f0 bc 41 fc 43 e5 1d fa 1b a6 53 94 f4 88 4a ce 38 47 99 1e 3b 23 16 bf a5 5a 95 92 fb b1 12 4a 53 32 f8 f6 64 cd c1 1e a4 3d 86 ff 7f 01 ff 26 df e8 e1 df 05 6c 35 7a ba aa d1 59 11 3e 3c cf f0 61 cc 84 a3 96 28 69 fc 84 6d 50 ec 29 59 68 64 e2 71 0d 62 0b 06 63 f6 f8 93 c9 c2 2f 40 63 32 6f 93 0b 7c 07 cb ed 40 e1 a0 e1 64 32 e9 c0 2f 8d 74 27 c4 a5 2e 94 a6 b9 42 69 40 57 29 05 08 88 cd 70 a3 a4 c9 ee 53 47 d3 06 4a a6 cf 8e 37 ca bc 34 c3 3d 30 7d f7 33 27 07 ad ad 14 2b dc ba 03 eb 46 f9 46 e5 67 9b e5 c2 91 32 46 6d ba 19 49 92 1c 65 d8 59 bc 84 a0 ed a0 9d 05 a8 67 90 36 f3 57 d7 1b 06 c1 27 07 d0 bf 1b 83 c5 cc 5a 43 66 99 7e b5 fe 9b 2b d8 52 b8 78 3b ab 12 2a 92 f7 29 e3 9a d2 fd 78 af 95 fd f0 49 23 56 a1 b5 2b ed 3e 24 39 be 6b 4c 33 61 81 ee 4d f9 54 f9 26 76 32 27 f5 ca 21 67 f6 32 bb df 76 a9 36 2e ec 8c cf 21 56 9a d9 c7 8e 12 a9 24 b4 07 d3 b5 da c2 ed 45 7a 59 2d 56 e3 f0 5a 05 43 8e 05 8b 04 ac d8 fe e6 15 4c 03 6b 17 2b a8 1f 93 7e ab dc 95 af 1c ee 25 a9 be 67 02 53 49 63 a8 b7 f2 f9 cb bf 0c ac 39 6e 6c 5f 7c 4f 5e 01 de ba dc ea 72 67 6e dd b1 61 e9 b7 dd ef 97 59 4a 0e 5a 60 2d d6 1f 75 67 6f fa c3 08 00 00 0d 0a Data Ascii: 23eU0+,JjTJ='h9+'&B#q<{3b%CU$P40oC( ^S/&=diV<X`N5sH8B\|e0j2X`P! [w%d:#9h;R(fACSJ8G;#ZJS2d=&l5zY><a(imP)Yhdqbc/@c2o\|@d2/t'.Bi@W)pSGJ74=0}3'+FFg2FmIeYg6W'ZCf~+Rx;*)xI#V+>$9kL3aMT&v2'!g2v6.!V$EzY-VZCLk+~%gSIc9nl_\|O^rgnaYJZ`-ugo
Jun 3, 2021 16:17:10.657188892 CEST	1182	OUT	GET /express/javascript/autocomplete.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:10.976955891 CEST	1195	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:10 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"21234-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d5492100004ea492881000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=kk3LyTIOCMe716QKzK585wF7m2XpQepHh2SUwRe1h2vedFNk3IOtckC5o0EHM4z1G72LqC3QlhU3rDN7sEMyTnxRx3XcIO2YuwXxl0CmpbQgE9sO9dmHVc4hY4QS26NiMBE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b21c8a94ea4-FRA Content-Encoding: gzip Data Raw: 31 36 36 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c 6b 77 13 b9 92 9f ed 5f 51 78 e7 60 9b 38 76 02 dc e1 11 cc 4e 08 e1 4e 76 02 e1 90 c0 bd 1c 86 e5 c8 dd b2 2d d2 6e f5 4a 6a 3b 1e e0 bf ef 29 bd 5a fd 70 12 5e bb f7 ec d9 7c 00 5b 2a 95 4a a5 52 a9 5e f2 e8 56 fb 16 fc d6 fb b7 3e c9 15 8f f8 22 4b a8 a2 c3 8f 12 7e 79 45 97 4c 32 9e 3e 84 dd e1 af c3 db c3 3b f0 0b fc f2 94 28 fa 10 6e ef ec ee 8e 76 ee 8e 6e 3f 80 9d bb 0f 77 ef 3c dc b9 0b bf b4 11 d3 01 cf d6 82 cd e6 0a 5e 90 25 93 70 c0 45 c6 05 51 8c a7 70 7b 67 e7 4e fb 16 ec 27 09 bc 42 10 09 af a8 a4 62 49 63 3b 34 9d b2 98 a6 8a 91 04 8e d2 29 17 0b 33 8e 4f eb c8 da b7 e0 75 4a 72 35 e7 82 fd 45 63 c8 25 05 26 41 2a c1 22 95 ac 21 13 7c ce 26 4c 59 dc 67 73 26 61 c5 c5 39 44 3c 55 84 a5 12 96 24 c9 c9 24 a1 d8 52 cc 9b 09 9e 09 46 15 11 6b 50 82 c4 14 24 8d 04 55 ed 5b c0 ae 20 09 48 1a 23 0d 99 e0 8a 46 8a c6 30 59 83 cc 68 c4 a6 2c 6a df 02 32 13 94 2e 68 aa a4 86 9c d2 98 0a 92 40 e4 38 36 0c a8 e4 02 48 ba 86 8c 08 05 6a 4e 05 e5 d3 f6 2d 58 90 35 a4 5c c1 84 42 cc 64 94 70 49 e3 01 92 99 ca 05 53 0a bf 44 3c 63 f8 3f 17 20 68 26 78 9c 47 34 06 86 c4 ad db b7 00 57 80 7d 0b 1a b3 7c 01 2b a6 e6 3c 57 90 09 c6 05 ac 04 22 49 c1 b1 d5 ac 6a 2a f8 c2 2c 56 ef 91 5f ee b0 7d 6b d4 6e 8f 90 bb a1 e8 00 c3 ff cd 32 d5 9c c2 f1 c9 1b 88 12 22 25 f2 8c 4f 3e d2 48 e1 66 69 9a 5e dc c5 7f d5 9c b6 6f b5 b2 84 44 14 61 70 90 54 24 8d 89 88 41 d2 04 07 4c f8 c5 50 ef e3 6f 4b 2a 50 26 bf 45 3a e1 37 b3 b0 87 f0 94 08 41 53 38 ce 97 84 48 bb 8c 1f f4 37 32 a8 e0 b5 34 fb af 19 ce d2 2c 47 76 f0 32 a7 62 a2 08 d0 54 89 35 42 26 9c c4 2c 9d 81 fe 0b 51 a1 4c a7 33 69 36 82 a4 40 a4 e4 11 23 28 60 8f 0c 7f 1e 9b 19 86 d0 f4 17 a2 fa ce bf 00 d5 8f e4 d5 8f a3 ca 9c a0 29 4b 28 c4 34 a3 69 2c 21 cf b8 16 31 98 f2 24 e1 2b e4 f0 7f 90 25 39 8d 04 cb 94 06 95 0f 37 f0 Data Ascii: 1663<kw_Qx`8vNNv-nJj;)Zp^\|[JR^V>"K~yEL2>;(nvn?w<^%pEQp{gN'BbIc;4)3OuJr5Ec%&A"!\|&LYgs&a9D<U$$RFkP$U[ H#F0Yh,j2.h@86HjN-X5\BdpISD<c? h&xG4W}\|+<W"Ij,V_}kn2"%O>Hfi^oDapT$ALPoKP&E:7AS8H724,Gv2bT5B&,QL3i6@#(`)K(4i,!1$+%97
Jun 3, 2021 16:17:10.982307911 CEST	1202	OUT	GET /express/javascript/paging.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.322958946 CEST	1227	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive ETag: W/"998-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED cf-request-id: 0a73d54a6a00004ea4ed24e000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=laWFUK5Tfv6N5nTE1PtgwSH0gYkRViDQYLGczrUnQb7PHqynfbIra8RP2zdPt9uSbOc6gHedjmXM21i%2F6ZJVNMOMd3ceQECCExR3Y4xHUBKwhOSngY%2F8PfjmCuV%2FYiEHKAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b23ddbc4ea4-FRA Content-Encoding: gzip Data Raw: 31 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 92 cf 4e 83 40 10 c6 cf f6 29 26 bd 00 29 d2 f4 5c 89 07 4f 9e ac ff 1e 00 61 28 9b 00 43 87 d9 96 da f8 ee 66 17 5d c0 68 d5 39 4c 16 76 be 5f be 6f b2 00 90 eb 3a 15 45 35 34 8c 7b 45 ba dd 24 5b f4 73 a6 ea b6 ce b0 0b 95 60 d5 6e 90 cd ef 70 a7 91 8f 8f ea 15 43 cd e5 26 e1 a4 42 41 6e 83 19 00 c0 c9 76 53 fb 84 2d ee 2e cf 5b 14 88 c1 e1 e0 12 c6 c0 b5 93 a8 dc 1f 29 ae 60 15 b8 2b 53 13 da 6a 90 6d e9 89 ac e1 61 e0 47 93 bd ea cd f6 a1 b9 fc 35 76 62 51 42 7d f2 7f 84 35 da 3e 5f 0c 1f 72 58 7c eb d3 4d fe 6a 73 ea ce 01 e8 7c c8 2f e6 96 4b 48 a9 6a a8 45 90 02 41 73 09 07 25 85 fd 60 dc 69 c5 98 81 65 41 e3 20 20 04 d8 61 aa a5 57 d9 fb 68 12 d8 80 e2 4f f4 bd b9 7f e6 d2 ff 2e 88 a9 7e 3a c9 32 3b e9 46 cc 7c 08 5e 9f c8 0b a1 3f fc 59 e7 56 e0 85 e0 ce 23 f5 41 d5 19 1d a2 92 d2 c4 ac 30 2a 18 73 88 0d d4 ad f8 c2 ed f7 7c 14 c7 3c 8d 5f e5 b0 88 2d ca 0d d5 82 9d f8 01 2c 60 9e a9 b6 29 93 e3 03 36 c4 12 65 74 3d 87 05 4c 90 b0 1e 93 ce 07 ad 50 0a ca 3c 17 59 bf 54 4a bc 60 42 60 14 cd f5 10 6e f4 86 66 ef 48 a4 1d 55 e6 03 00 00 0d 0a Data Ascii: 16cN@)&)\Oa(Cf]h9Lv_o:E54{E$[s`npC&BAnvS-.[)`+SjmaG5vbQB}5>_rX\|Mjs\|/KHjEAs%`ieA aWhO.~:2;F\|^?YV#A0*s\|<_-,`)6et=LP<YTJ`B`nfHU
Jun 3, 2021 16:17:11.327435970 CEST	1228	OUT	GET /express/images/down.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:11.646622896 CEST	1268	IN	HTTP/1.1 200 OK Date: Thu, 03 Jun 2021 14:17:11 GMT Content-Type: image/gif Content-Length: 175 Connection: keep-alive ETag: W/"175-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes cf-request-id: 0a73d54bc000004ea49c12a000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dhIjqiZnFyLTg79k8LIaxgf%2FeS2Ge1aAwKEf4tRJKGxc5BPRuNPT0BjY71%2FD230kbBpW06XUGlD86XLnWevCgx3cjYjdLrvyYP4%2BwXsEy91kLdGIymWklGbypRckKRZn5kA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998b25fba04ea4-FRA Data Raw: 47 49 46 38 39 61 08 00 0c 00 c4 00 00 00 00 00 02 02 02 06 06 06 08 08 08 41 41 41 f0 f0 f0 11 11 11 03 03 03 f8 f8 f8 fa fa fa 09 09 09 1c 1c 1c 2e 2e 2e 07 07 07 33 33 33 0c 0c 0c 15 15 15 20 20 20 05 05 05 13 13 13 0a 0a 0a 1d 1d 1d f1 f1 f1 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 17 00 2c 00 00 00 00 08 00 0c 00 00 05 2c e0 25 8a cf 38 12 83 79 31 40 3a 2e 00 d0 8c 55 0c 1c 81 21 d9 bc c2 db 97 89 2d 20 10 88 22 31 8a ca 11 53 5d 20 00 e7 25 7a 09 01 00 3b Data Ascii: GIF89aAAA...333 !,,%8y1@:.U!- "1S] %z;
Jun 3, 2021 16:17:31.889765978 CEST	1775	OUT	GET /express/css/modules/tooltip.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1853-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:31.943804979 CEST	1778	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:31 GMT Connection: keep-alive ETag: W/"1853-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c1200004ea4d28c0000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mUau5AvLEG7Eb9yURYao8CJdI390JuqmH758g7rrOVY1rkaae%2BYudiAycz8Zfx0FNzPOLvA9%2BOBiJ5ScktwbNbCAClNTzgn1cNU8lsj3rqLNO%2FwDoXysPbaTcNVwBt1rOLk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba68a8d4ea4-FRA
Jun 3, 2021 16:17:31.962426901 CEST	1781	OUT	GET /express/css/modules/actionbar.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2708-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.026318073 CEST	1792	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2708-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59c5e00004ea4cf17c000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6yW68iFbkU3cbUva2Hr%2BAD%2BFA50trOPN1urHptt%2FN9GbmRokh7r53r9epmDGbb%2FUAkT3rLuTrx3PLjJhhCByx3Wm7F6xOlAwwhzc9jHeiqglRU3%2Bu2lU0ia%2FqbQPUWPBIu4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba6fbce4ea4-FRA
Jun 3, 2021 16:17:32.029690981 CEST	1793	OUT	GET /express/css/modules/header.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"1517-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.081113100 CEST	1798	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"1517-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59c9e00004ea4e3177000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YkqbZaYXHxSxcnieCqyVA1ctE%2Bq6NBbC%2B8Qob7Zf2sCbzkAuXNCGnHyoMyA7HSJGv5cv2%2BGuoDNvihX%2BJyQMX1lBCEQpDuzvcZuSMwQAUgaz%2BhsPMQePbjyXHjBQys3QFXY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba76cd34ea4-FRA
Jun 3, 2021 16:17:32.082525015 CEST	1800	OUT	GET /express/includes/ImageSwap.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"2128-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.137085915 CEST	1804	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"2128-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 23 cf-request-id: 0a73d59cd500004ea4c29e1000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HGbu5FiE0CHGz27bE7Xiy24uus6yzHBGlj4dpyIasF0BOXfoYoa9avLj8MOY8q1eZcVcltgtbawrrI9HUtr63ykOMnnoLN7B45kwD3AOpT6A%2F8tNDf2Ny2aY%2BICtIMWdFOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba7bdef4ea4-FRA
Jun 3, 2021 16:17:32.140736103 CEST	1808	OUT	GET /express/javascript/common.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"5576-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.194442034 CEST	1815	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"5576-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 cf-request-id: 0a73d59d0e00004ea4bca4d000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SgQ0CSZqzB4Emp3CoSri3hItLhFjM4oL4xUGYmPWHi0ktV9DjqyTEKKEJtypK12dfgL2heZjaVvOChSCSJj0AJmW7AhGARaYtsoLtekXt8oLVpMAsCgcZGXxK0bdh4bes3U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba81f084ea4-FRA
Jun 3, 2021 16:17:32.195483923 CEST	1817	OUT	GET /express/javascript/paging.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://webaccess.gaports.com/express/index.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:58 GMT If-None-Match: W/"998-1619547718000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3
Jun 3, 2021 16:17:32.271924973 CEST	1824	IN	HTTP/1.1 304 Not Modified Date: Thu, 03 Jun 2021 14:17:32 GMT Connection: keep-alive ETag: W/"998-1619547718000" Last-Modified: Tue, 27 Apr 2021 18:21:58 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 cf-request-id: 0a73d59d4700004ea47faf8000000001 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hxgy%2BJh2A7wJPxwqnsJV5jReRpR%2BydSu5G4YL%2Fo2cs2tiWgFj5Xr5DLA5SfNvfLPEc18v3uK4xbUExlfatxY2YIEhTOy8QtUqtcto3kULn4g%2BHqOxwkuVycEZD6gY%2BFvjbI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 65998ba868004ea4-FRA
Jun 3, 2021 16:17:33.699433088 CEST	1869	OUT	GET /express/n4addendum.css HTTP/1.1 Accept: text/css, / Referer: http://webaccess.gaports.com/express/about.jsp Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: webaccess.gaports.com If-Modified-Since: Tue, 27 Apr 2021 18:21:56 GMT If-None-Match: W/"9069-1619547716000" Connection: Keep-Alive Cookie: JSESSIONID=AA9D0CAAC5FFF61AF33033B2BAE8AC30.tomcat3

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 3, 2021 16:17:42.331501961 CEST	104.16.19.94	443	192.168.2.6	49748	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.331501961 CEST	104.16.19.94	443	192.168.2.6	49748	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.332082033 CEST	104.16.19.94	443	192.168.2.6	49749	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.332082033 CEST	104.16.19.94	443	192.168.2.6	49749	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.366060019 CEST	104.16.19.94	443	192.168.2.6	49750	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.366060019 CEST	104.16.19.94	443	192.168.2.6	49750	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.368207932 CEST	104.16.19.94	443	192.168.2.6	49751	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.368207932 CEST	104.16.19.94	443	192.168.2.6	49751	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.369291067 CEST	104.16.19.94	443	192.168.2.6	49752	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.369291067 CEST	104.16.19.94	443	192.168.2.6	49752	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:42.395064116 CEST	35.201.125.192	443	192.168.2.6	49753	CN=cdn.bc0a.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 11:27:42 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 12:27:42 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:42.395380020 CEST	35.201.125.192	443	192.168.2.6	49754	CN=cdn.bc0a.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 11:27:42 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 12:27:42 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:43.023406982 CEST	35.190.5.192	443	192.168.2.6	49762	CN=cdn.b0e8.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 11:16:16 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 12:16:16 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:43.023912907 CEST	35.190.5.192	443	192.168.2.6	49763	CN=cdn.b0e8.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 11:16:16 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 12:16:16 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:45.558315992 CEST	152.199.21.175	443	192.168.2.6	49767	CN=sni1e6ffgl.wpc.edgecastcdn.net, OU=SecOps, O="Verizon Digital Media Services, Inc.", L=Los Angeles, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Apr 16 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu Apr 21 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:45.558315992 CEST	152.199.21.175	443	192.168.2.6	49767	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:45.558994055 CEST	152.199.21.175	443	192.168.2.6	49766	CN=sni1e6ffgl.wpc.edgecastcdn.net, OU=SecOps, O="Verizon Digital Media Services, Inc.", L=Los Angeles, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Apr 16 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu Apr 21 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:45.558994055 CEST	152.199.21.175	443	192.168.2.6	49766	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:46.502135038 CEST	34.95.105.148	443	192.168.2.6	49771	CN=b0e8.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 01:29:30 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 02:29:30 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:46.503643990 CEST	34.95.105.148	443	192.168.2.6	49770	CN=b0e8.com CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1D4, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sat May 01 01:29:30 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Fri Jul 30 02:29:30 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1D4, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 3, 2021 16:17:47.148710966 CEST	142.251.5.154	443	192.168.2.6	49774	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 03 11:01:14 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Jul 26 11:01:13 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.148710966 CEST	142.251.5.154	443	192.168.2.6	49774	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.151067019 CEST	142.251.5.154	443	192.168.2.6	49775	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 03 11:01:14 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Jul 26 11:01:13 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.151067019 CEST	142.251.5.154	443	192.168.2.6	49775	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.519711971 CEST	172.217.19.99	443	192.168.2.6	49778	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 03 12:46:16 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Jul 26 12:46:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.519711971 CEST	172.217.19.99	443	192.168.2.6	49778	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.520598888 CEST	172.217.19.99	443	192.168.2.6	49779	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 03 12:46:16 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Jul 26 12:46:15 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:47.520598888 CEST	172.217.19.99	443	192.168.2.6	49779	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 3, 2021 16:17:48.489790916 CEST	54.86.117.43	443	192.168.2.6	49780	CN=*.wistia.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Apr 01 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun May 01 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 3, 2021 16:17:50.194245100 CEST	52.6.75.166	443	192.168.2.6	49781	CN=*.wistia.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Apr 01 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun May 01 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 3, 2021 16:18:22.744918108 CEST	52.0.129.236	443	192.168.2.6	49797	CN=*.litix.io CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Nov 27 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon Dec 27 00:59:59 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 3, 2021 16:18:22.745481968 CEST	52.0.129.236	443	192.168.2.6	49798	CN=*.litix.io CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Nov 27 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon Dec 27 00:59:59 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034

Code Manipulations

Statistics

Behavior

• iexplore.exe
• iexplore.exe

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5116 Parent PID: 792

General

Start time:	16:17:06
Start date:	03/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff721e20000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Analysis Process: iexplore.exe PID: 4996 Parent PID: 5116

General

Start time:	16:17:06
Start date:	03/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5116 CREDAT:17410 /prefetch:2
Imagebase:	0xbd0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://webaccess.gaports.com/express/secure/today.jsp?Facility=GCT

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5116 Parent PID: 792

General

File Activities

File Created

File Written

File Read

Registry Activities

Key Created

Key Value Created

Key Value Modified

Analysis Process: iexplore.exe PID: 4996 Parent PID: 5116

General

File Activities

File Created

File Written

File Read