Edit tour

Windows Analysis Report
https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca

Overview

General Information

Sample URL:	https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca
Analysis ID:	600205
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Found C&C like URL pattern

URL contains potential PII (phishing indication)

HTML body contains low number of good links

Suspicious form URL found

No HTML title found

Classification

Process Tree

System is start

chrome.exe (PID: 4244 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca MD5: 2A7452F3E3165FECBFCCAD71B04E5C37)

chrome.exe (PID: 2024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,7030880316710046473,7746493725353432648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:8 MD5: 2A7452F3E3165FECBFCCAD71B04E5C37)

chrome.exe (PID: 1344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" MD5: 2A7452F3E3165FECBFCCAD71B04E5C37)

chrome.exe (PID: 5976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,8009548188426664295,11705934950507693598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:8 MD5: 2A7452F3E3165FECBFCCAD71B04E5C37)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
13099.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 13099.2.pages.csv, type: HTML

Source: https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca

Sample URL: PII: andrea.john@islandhealth.ca

Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: Number of links: 0
Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: Number of links: 0
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: Number of links: 0
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: Number of links: 0

Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: Form action: login.php
Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: Form action: login.php
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: Form action: login1.php
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: Form action: login1.php

Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: HTML title missing
Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: HTML title missing
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: HTML title missing
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: HTML title missing

Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: No <meta name="author".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: No <meta name="author".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: No <meta name="author".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: No <meta name="author".. found

Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: No <meta name="copyright".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	HTTP Parser: No <meta name="copyright".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: No <meta name="copyright".. found
Source: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 43.239.249.52:443 -> 192.168.2.2:51735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.239.249.52:443 -> 192.168.2.2:51734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.60.77.135:443 -> 192.168.2.2:50451 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.60.77.135:443 -> 192.168.2.2:50452 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 113MB

Networking

Found C&C like URL pattern

Source: global traffic

HTTP traffic detected: POST /po/login.php HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-aliveContent-Length: 150Cache-Control: max-age=0sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1Origin: https://nervous-ride.43-239-249-52.plesk.pageContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 57250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58584
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62831
Source: unknown	Network traffic detected: HTTP traffic on port 59568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51831
Source: unknown	Network traffic detected: HTTP traffic on port 61808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61512
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 64008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57270
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51734
Source: unknown	Network traffic detected: HTTP traffic on port 61626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52027
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53408
Source: unknown	Network traffic detected: HTTP traffic on port 57735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53885
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55392
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62596
Source: unknown	Network traffic detected: HTTP traffic on port 53863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53651
Source: unknown	Network traffic detected: HTTP traffic on port 64443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51357
Source: unknown	Network traffic detected: HTTP traffic on port 60241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63338
Source: unknown	Network traffic detected: HTTP traffic on port 50451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51368
Source: unknown	Network traffic detected: HTTP traffic on port 58685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63349
Source: unknown	Network traffic detected: HTTP traffic on port 64354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63469
Source: unknown	Network traffic detected: HTTP traffic on port 55532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49512
Source: unknown	Network traffic detected: HTTP traffic on port 63349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52465
Source: unknown	Network traffic detected: HTTP traffic on port 50463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63119
Source: unknown	Network traffic detected: HTTP traffic on port 50457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49508
Source: unknown	Network traffic detected: HTTP traffic on port 52632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50457
Source: unknown	Network traffic detected: HTTP traffic on port 53027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55903
Source: unknown	Network traffic detected: HTTP traffic on port 51734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50453
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52632
Source: unknown	Network traffic detected: HTTP traffic on port 60240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59274
Source: unknown	Network traffic detected: HTTP traffic on port 58584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54946
Source: unknown	Network traffic detected: HTTP traffic on port 61307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58627
Source: unknown	Network traffic detected: HTTP traffic on port 59617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50460
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50463
Source: unknown	Network traffic detected: HTTP traffic on port 49597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55113
Source: unknown	Network traffic detected: HTTP traffic on port 62329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59963
Source: unknown	Network traffic detected: HTTP traffic on port 54548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62329
Source: unknown	Network traffic detected: HTTP traffic on port 50455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65050
Source: unknown	Network traffic detected: HTTP traffic on port 64832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59174
Source: unknown	Network traffic detected: HTTP traffic on port 51521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59617
Source: unknown	Network traffic detected: HTTP traffic on port 57866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54843
Source: unknown	Network traffic detected: HTTP traffic on port 59548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 64985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59598
Source: unknown	Network traffic detected: HTTP traffic on port 61512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58020
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51519
Source: unknown	Network traffic detected: HTTP traffic on port 51735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57735
Source: unknown	Network traffic detected: HTTP traffic on port 50465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52290
Source: unknown	Network traffic detected: HTTP traffic on port 58510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57747
Source: unknown	Network traffic detected: HTTP traffic on port 55392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53027
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60592
Source: unknown	Network traffic detected: HTTP traffic on port 59963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63187
Source: unknown	Network traffic detected: HTTP traffic on port 61386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64832
Source: unknown	Network traffic detected: HTTP traffic on port 57715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58847
Source: unknown	Network traffic detected: HTTP traffic on port 63187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59812
Source: unknown	Network traffic detected: HTTP traffic on port 50460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60241
Source: unknown	Network traffic detected: HTTP traffic on port 62831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64169
Source: unknown	Network traffic detected: HTTP traffic on port 58847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51519 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=91.0.4472.77&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-91.0.4472.77Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0ayYll9htR6YvBVVa0nRqEJjrWe_xx2EvmTO9Zv3Y3QHppbAlfmr88wOclFPcu0pUsJ0t_UL2kW1P6aXbwpy2I7oo0N6WEqdusQP45eqLP2AZ0tAMZSmuWytVkeMh5sroMwg9axK-1fzhI5XQ/extension_9121_329_0_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/?email=andrea.john@islandhealth.ca HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/6mdowyfv0k5u2o53i2za2za0k.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/3m71yrh4x2a2j2nkhzkrro2qcl.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/25l2ttqanckb91ektwzqcgjxtd.js HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/3ck5cxcjdvota2rci97kovhztq.js HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/1pcl69g5oyhz36eyspqh37na8.js HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/2qbmau5rsj0r418xxfzq45ee9j.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13.jpg HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13_002.jpg HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/login_bg.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/ixd481lrtotq10keebomtjfld.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/files/6mdowyfv0k5u2o53i2za2za0k.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/2qbmau5rsj0r418xxfzq45ee9j.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13_002.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/login_bg.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/ixd481lrtotq10keebomtjfld.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.caAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/id.png HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/id.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/2qbmau5rsj0r418xxfzq45eee9j.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/2qbmau5rsj0r418xxfzq45eee9j.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.pageIf-Modified-Since: Mon, 18 Dec 2017 10:32:35 GMTIf-None-Match: "1fa-5609ade5696c0"
Source: global traffic	HTTP traffic detected: GET /po/files/winmail_bg13_002.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.pageIf-Modified-Since: Mon, 18 Dec 2017 10:33:55 GMTIf-None-Match: "5a379993-1a378"
Source: global traffic	HTTP traffic detected: GET /po/files/login_bg.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.pageIf-Modified-Since: Mon, 18 Dec 2017 10:52:10 GMTIf-None-Match: "5a379dda-b63"
Source: global traffic	HTTP traffic detected: GET /po/files/ixd481lrtotq10keebomtjfld.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.pageIf-Modified-Since: Mon, 18 Dec 2017 17:17:00 GMTIf-None-Match: "5a37f80c-6ad"
Source: global traffic	HTTP traffic detected: GET /po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Referer: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/img4.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/:abstract.simplenet.com/point.gif HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/abstract.simplenet.com/point2.html HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/favicon.ico HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/files/img4.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: nervous-ride.43-239-249-52.plesk.page
Source: global traffic	HTTP traffic detected: GET /po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/i.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/i.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/ii.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/bootstrap.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/signin.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/errors.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/element.js?cb=googleTranslateElementInit HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/bootstrap.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/signin.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/errors.css HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/files/element.js?cb=googleTranslateElementInit HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /po/go.php?email=andrea.john@islandhealth.ca HTTP/1.1Host: nervous-ride.43-239-249-52.plesk.pageConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.islandhealth.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gtag/js?id=UA-6980420-14 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_NI2rCd4CVDulXgcLRyDFYy2bq2iPw-82wH2tT7FsWl8.css HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.css HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_U90CtOOTFdFeay-SGr6fI8WWZAkHZkoXkejK_fujNIs.css HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/hotjar/hotjar.script.js?r8lj92 HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_VuZauQsvsWjKftap3BOGAQhqbQtrNRozpNALvcD0_cY.js HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/hotjar-1133450.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js HTTP/1.1Host: www.google-analytics.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/lato/v22/S6u9w4BMUTPHh6UVSwiPGQ.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/bootstrap/assets/fonts/bootstrap/glyphicons-halflings-regular.woff2 HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/fonts/ih-main.woff HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/header__gradient_border.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/rD-mapProduction--belowCarousel.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/Island_Health_rgb.svg HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/librefranklin/v11/jizDREVItHgc8qDIbSTKq4XkRiUf2zc.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/lato/v22/S6u_w4BMUTPHjxsI5wq_Gwft.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"Origin: https://www.islandhealth.casec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://fonts.googleapis.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/mental-health-substance-use/images/carousel-OD.jpg?itok=gf6Ua4QM HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/rD-mapProduction--carouselPiece.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/covid-19/images/covid-carousel-banner.png?itok=0zAbCx97 HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /modules.7d3f952308caf42c2b67.js HTTP/1.1Host: script.hotjar.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/news/images/slideshow-news-images/Nov2020-indigenous-racism.jpg?itok=BzDM0ybB HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /box-acca23410e696f2ca3087d947271c3d0.html HTTP/1.1Host: vars.hotjar.comConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/flu/documents/flu-carousel-2021.png?itok=8uvdXaCV HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/2021-09/od-teaser.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114
Source: global traffic	HTTP traffic detected: GET /sites/default/files/2021-09/nurse-on-phone3-teaser_0.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1
Source: global traffic	HTTP traffic detected: GET /sessions/1133450?s=0.25&r=0.24306399311917715 HTTP/1.1Host: vc.hotjar.ioConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: /Origin: https://www.islandhealth.caSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/2021-09/testing-teaser.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/standard_image/public/news/images/holding-hands.png?itok=g5v802bf HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/standard_image/public/news/images/hospital-to-home-nr-teaser.png?itok=iGwJXoKP HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/standard_image/public/news/images/new-covid-therapies-nr-teaser.png?itok=oh0yjhwb HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/Island_Health_solid-white.svg HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/footer-outline.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/favicon.ico HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/favicon-32.png HTTP/1.1Host: www.islandhealth.caConnection: keep-alivesec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.islandhealth.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _ga=GA1.2.1610308961.1648688114; _gid=GA1.2.1578001640.1648688114; _gat_gtag_UA_6980420_14=1; _hjSessionUser_1133450=eyJpZCI6IjhmZjk3YWExLTEyMDktNTA5MC1hNDMwLTJhMTZiODUyODQ3MCIsImNyZWF0ZWQiOjE2NDg2ODgxMTM5OTMsImV4aXN0aW5nIjpmYWxzZX0=; _hjFirstSeen=1; _hjIncludedInSessionSample=0; _hjSession_1133450=eyJpZCI6IjZjMzEyMGYzLTc3ZTEtNGUxMi1iMTM5LTk5NmY5ODE3MTNmNCIsImNyZWF0ZWQiOjE2NDg2ODgxMTQyODYsImluU2FtcGxlIjpmYWxzZX0=; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/favicon-180.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/Island_Health_rgb.svg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/mental-health-substance-use/images/carousel-OD.jpg?itok=gf6Ua4QM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /themes/ih_main/images/rD-mapProduction--carouselPiece.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/covid-19/images/covid-carousel-banner.png?itok=0zAbCx97 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/news/images/slideshow-news-images/Nov2020-indigenous-racism.jpg?itok=BzDM0ybB HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/slideshow_image_1285_/public/flu/documents/flu-carousel-2021.png?itok=8uvdXaCV HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET /sites/default/files/2021-09/od-teaser.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.islandhealth.ca
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: islandhealth.caConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: Cookies.1.dr	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: Cookies.1.dr	String found in binary or memory: .www.linkedin.combscookie/+3 equals www.linkedin.com (Linkedin)
Source: Cookies.1.dr	String found in binary or memory: .www.linkedin.combscookie//[Of equals www.linkedin.com (Linkedin)
Source: Reporting and NEL.1.dr	String found in binary or memory: coep_reporthttps://www.facebook.com/browser_reporting/ equals www.facebook.com (Facebook)
Source: Reporting and NEL.1.dr	String found in binary or memory: coep_reporthttps://www.facebook.com/browser_reporting/[] equals www.facebook.com (Facebook)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:53:37 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:01 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:01 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:26 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:26 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:28 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:28 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:54 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:55 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:57 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:58 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 30 Mar 2022 15:54:59 GMTContent-Type: text/htmlContent-Length: 808Connection: closeLast-Modified: Tue, 29 Mar 2022 17:03:36 GMTETag: "328-5db5e68d93137"Accept-Ranges: bytes

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: History.0.dr	String found in binary or memory: http://islandhealth.ca/)
Source: History Provider Cache.0.dr	String found in binary or memory: http://islandhealth.ca/2
Source: History.0.dr	String found in binary or memory: http://islandhealth.ca/Island
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-capture-time
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00
Source: manifest.json1.0.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension
Source: manifest.json1.0.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/win64/1cf1126d11bb20
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://client-api.arkoselabs.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://client-api.arkoselabs.com/fc/apps/canvas/001/?meta=7&custom_font=
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://client-api.arkoselabs.com/fc/gc/?token=35960af6dab9183d8.6753500805&r=eu-west-1&metabgclr=%2
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json0.0.dr, manifest.json1.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themeso
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtableb
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US&attribution_code=c291cm
Source: Reporting and NEL.1.dr	String found in binary or memory: https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=AMS
Source: Reporting and NEL.1.dr	String found in binary or memory: https://exo.nel.measure.office.net/api/report?TenantId=84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa&FrontEnd
Source: manifest.json1.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: manifest.json1.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: angular.js.0.dr, material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_background.js.0.dr, craw_window.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json1.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/_/logpref
Source: Reporting and NEL.1.dr	String found in binary or memory: https://identity.nel.measure.office.net/api/report?catId=GW
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://iframe.arkoselabs.com
Source: 000003.log2.0.dr	String found in binary or memory: https://iframe.arkoselabs.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://iframe.arkoselabs.com/B7D8911C-5CC8-A9A3-35B0-554ACEE604DA/index.html?mkt=en
Source: 000003.log2.0.dr	String found in binary or memory: https://iframe.arkoselabs.com/Fnamespace-7f4ec067_06d1_4ec7_a12d_243a478fe253-https://www.office.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://login.live.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://login.live.com/
Source: 000003.log4.0.dr	String found in binary or memory: https://login.live.com/0
Source: 000003.log4.0.dr	String found in binary or memory: https://login.live.com/0BJP
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page
Source: Network Action Predictor.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john
Source: History.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/go.php?email=andrea.john
Source: History.0.dr, Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/login.php
Source: Tabs_13293161610561843.0.dr, Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/login.php0
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/login1.php
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb76
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.177425641
Source: 827acb3a-8a3d-4307-9fd2-9e52476b8c77.tmp.0.dr, 1789b073-d741-4e5c-b428-36fef03c8476.tmp.0.dr, 48d903f6-5f81-4bef-a527-0570f73e8115.tmp.0.dr	String found in binary or memory: https://nervous-ride.43-239-249-52.plesk.page:443
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-cache-expiration.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-cacheable-response.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-core.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-navigation-preload.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-routing.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-strategies.prod.js
Source: 000003.log0.0.dr	String found in binary or memory: https://officehome.cdn.office.net/versionless/workbox-v3.6.2/workbox-sw.js
Source: 000003.log1.0.dr	String found in binary or memory: https://outlook.live.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://outlook.live.com/
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 000003.log2.0.dr	String found in binary or memory: https://servedby.flashtalking.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://servedby.flashtalking.com/container/13539;99030;10307;iframe/?ftXRef=&ftXValue=&ftXType=&ftX
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com
Source: 000003.log2.0.dr	String found in binary or memory: https://setup.office.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/EnterPin?ctid=c086a95b-1df9-4640-88cf-b4792443459d
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/Home
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/Home/EligibileActModern?ctid=c086a95b-1df9-4640-88cf-b4792443459d
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/home/getoffice
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/signin-oidc
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://setup.office.com/signin-oidcdg
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://signup.live.com
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://signup.live.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://signup.live.com/signup?ru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%2
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: messages.json35.0.dr, messages.json34.0.dr, messages.json18.0.dr, messages.json42.0.dr, messages.json48.0.dr, messages.json44.0.dr, messages.json60.0.dr, messages.json22.0.dr, messages.json54.0.dr, messages.json82.0.dr, messages.json46.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json86.0.dr, messages.json32.0.dr, messages.json6.0.dr, messages.json20.0.dr, messages.json88.0.dr, messages.json10.0.dr, messages.json70.0.dr, messages.json4.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: messages.json35.0.dr, messages.json34.0.dr, messages.json18.0.dr, messages.json42.0.dr, messages.json48.0.dr, messages.json44.0.dr, messages.json60.0.dr, messages.json22.0.dr, messages.json54.0.dr, messages.json82.0.dr, messages.json46.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json86.0.dr, messages.json32.0.dr, messages.json6.0.dr, messages.json20.0.dr, messages.json88.0.dr, messages.json10.0.dr, messages.json70.0.dr, messages.json4.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://tr.snapchat.com/cm/i
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://tr.snapchat.com/cm/i?pid=93f19646-2418-418d-98af-f244ebb7c1cc
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html
Source: craw_background.js.0.dr, craw_window.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 000003.log1.0.dr	String found in binary or memory: https://www.google.com
Source: 000003.log2.0.dr, manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.google.com/search?q=adobe
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.google.com/search?q=firefox
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.google.com/search?q=firefox&oq=firefox&aqs=chrome..69i57j0j0i433l5j0l2j0i433.1935j1j7&so
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json1.0.dr	String found in binary or memory: https://www.google.com;
Source: craw_background.js.0.dr, craw_window.js.0.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json1.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json1.0.dr	String found in binary or memory: https://www.gstatic.com;
Source: 000003.log1.0.dr, Session_13293161609213783.0.dr	String found in binary or memory: https://www.islandhealth.ca
Source: Session_13293161609213783.0.dr	String found in binary or memory: https://www.islandhealth.ca/
Source: History Provider Cache.0.dr	String found in binary or memory: https://www.islandhealth.ca/2
Source: History.0.dr	String found in binary or memory: https://www.islandhealth.ca/Island
Source: 000003.log1.0.dr	String found in binary or memory: https://www.islandhealth.ca1_https://www.islandhealth.ca
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.mozilla.org
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/#
Source: 000003.log4.0.dr, History.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/#product-desktop-release
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/#product-desktop-releaseMDownload
Source: History.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-US/fire
Source: 000003.log4.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/0
Source: 000003.log4.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/firefox/all/0B
Source: 000003.log1.0.dr	String found in binary or memory: https://www.office.com
Source: 000003.log0.0.dr, 000003.log2.0.dr	String found in binary or memory: https://www.office.com/
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.office.com/#Office
Source: 000003.log0.0.dr	String found in binary or memory: https://www.office.com/0
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.office.com/?auth=1
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.office.com/b
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.office.com/html/MsaToken.html#access_token=EwAIA61DBAAUmcDj0azQ5tf1lkBfAvHLBzXl5ugAAUKTj
Source: Tabs_13293161610561843.0.dr	String found in binary or memory: https://www.office.com/landing
Source: 000003.log0.0.dr	String found in binary or memory: https://www.office.com/sw?cdnDomain=officehome.cdn.office.net&workload=officehome

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=YES+srp.gws-20210525-0-RC1.de+FX+704

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,7030880316710046473,7746493725353432648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,8009548188426664295,11705934950507693598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,7030880316710046473,7746493725353432648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,8009548188426664295,11705934950507693598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	15 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
vc-live-cf.hotjar.io	0%	Virustotal	Browse
islandhealth.ca	0%	Virustotal	Browse
www.islandhealth.ca	0%	Virustotal	Browse

Source	Detection	Scanner	Label
https://iframe.arkoselabs.com/	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb76	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/go.php?email=andrea.john@islandhealth.ca	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/themes/ih_main/images/footer-outline.png	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/2021-09/od-teaser.png	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page:443	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/25l2ttqanckb91ektwzqcgjxtd.js	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/apps-themes	0%	Avira URL Cloud	safe
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	0%	URL Reputation	safe
https://nervous-ride.43-239-249-52.plesk.page/	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/element.js?cb=googleTranslateElementInit	0%	Avira URL Cloud	safe
http://islandhealth.ca/2	0%	Avira URL Cloud	safe
http://islandhealth.ca/)	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/login1.php	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/2021-09/nurse-on-phone3-teaser_0.png	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/signin.css	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/styles/standard_image/public/news/images/holding-hands.png?itok=g5v802bf	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/styles/slideshow_image_1285_/public/flu/documents/flu-carousel-2021.png?itok=8uvdXaCV	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/3m71yrh4x2a2j2nkhzkrro2qcl.css	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/2qbmau5rsj0r418xxfzq45ee9j.gif	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/css/css_NI2rCd4CVDulXgcLRyDFYy2bq2iPw-82wH2tT7FsWl8.css	0%	Avira URL Cloud	safe
http://islandhealth.ca/Island	0%	Avira URL Cloud	safe
https://client-api.arkoselabs.com/fc/gc/?token=35960af6dab9183d8.6753500805&r=eu-west-1&metabgclr=%2	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/themes/ih_main/images/Island_Health_rgb.svg	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/i.css	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/static-on-bigtableb	0%	Avira URL Cloud	safe
https://www.islandhealth.ca	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/2qbmau5rsj0r418xxfzq45eee9j.gif	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4	0%	Avira URL Cloud	safe
https://client-api.arkoselabs.com/fc/apps/canvas/001/?meta=7&custom_font=	0%	Avira URL Cloud	safe
https://www.google.com;	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/js/js_VuZauQsvsWjKftap3BOGAQhqbQtrNRozpNALvcD0_cY.js	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/themes/ih_main/images/rD-mapProduction--belowCarousel.png	0%	Avira URL Cloud	safe
http://islandhealth.ca/	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/apps-themeso	0%	Avira URL Cloud	safe
https://vc.hotjar.io/sessions/1133450?s=0.25&r=0.24306399311917715	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/themes/ih_main/images/header__gradient_border.png	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/ixd481lrtotq10keebomtjfld.gif	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/:abstract.simplenet.com/point.gif	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.css	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/themes/ih_main/favicon.ico	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/styles/slideshow_image_1285_/public/covid-19/images/covid-carousel-banner.png?itok=0zAbCx97	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/2021-09/testing-teaser.png	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/3ck5cxcjdvota2rci97kovhztq.js	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/styles/standard_image/public/news/images/hospital-to-home-nr-teaser.png?itok=iGwJXoKP	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/files/winmail_bg13_002.jpg	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page	0%	Avira URL Cloud	safe
https://nervous-ride.43-239-249-52.plesk.page/po/login.php	0%	Avira URL Cloud	safe
https://www.islandhealth.ca/sites/default/files/css/css_U90CtOOTFdFeay-SGr6fI8WWZAkHZkoXkejK_fujNIs.css	0%	Avira URL Cloud	safe
https://csp.withgoogle.com/csp/report-to/static-on-bigtable	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nervous-ride.43-239-249-52.plesk.page	43.239.249.52	true	true		unknown
gstaticadssl.l.google.com	216.58.215.227	true	false		high
vc-live-cf.hotjar.io	108.157.4.120	true	false	0%, Virustotal, Browse	unknown
accounts.google.com	142.250.203.109	true	false		high
www-google-analytics.l.google.com	142.250.203.110	true	false		high
plus.l.google.com	172.217.168.78	true	false		high
www-googletagmanager.l.google.com	172.217.168.8	true	false		high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false		high
vars.hotjar.com	13.224.99.30	true	false		high
islandhealth.ca	52.60.77.135	true	true	0%, Virustotal, Browse	unknown
in-live.live.eks.hotjar.com	54.76.183.110	true	false		high
script.hotjar.com	13.224.99.19	true	false		high
www.google.com	142.250.185.164	true	false		high
clients.l.google.com	142.250.186.46	true	false		high
googlehosted.l.googleusercontent.com	142.250.186.33	true	false		high
www.islandhealth.ca	52.60.77.135	true	false	0%, Virustotal, Browse	unknown
static-cdn.hotjar.com	13.224.99.58	true	false		high
in.hotjar.com	unknown	unknown	false		high
clients2.googleusercontent.com	unknown	unknown	false		high
vc.hotjar.io	unknown	unknown	false		unknown
clients2.google.com	unknown	unknown	false		high
static.hotjar.com	unknown	unknown	false		high
apis.google.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://clients2.googleusercontent.com/crx/blobs/Acy1k0ayYll9htR6YvBVVa0nRqEJjrWe_xx2EvmTO9Zv3Y3QHppbAlfmr88wOclFPcu0pUsJ0t_UL2kW1P6aXbwpy2I7oo0N6WEqdusQP45eqLP2AZ0tAMZSmuWytVkeMh5sroMwg9axK-1fzhI5XQ/extension_9121_329_0_0.crx	false		high
https://nervous-ride.43-239-249-52.plesk.page/po/go.php?email=andrea.john@islandhealth.ca	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/themes/ih_main/images/footer-outline.png	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/2021-09/od-teaser.png	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=91.0.4472.77&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://nervous-ride.43-239-249-52.plesk.page/po/files/25l2ttqanckb91ektwzqcgjxtd.js	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/element.js?cb=googleTranslateElementInit	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css	false		high
https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca	true		unknown
https://nervous-ride.43-239-249-52.plesk.page/po/login1.php	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/2021-09/nurse-on-phone3-teaser_0.png	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/signin.css	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/styles/standard_image/public/news/images/holding-hands.png?itok=g5v802bf	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/styles/slideshow_image_1285_/public/flu/documents/flu-carousel-2021.png?itok=8uvdXaCV	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/3m71yrh4x2a2j2nkhzkrro2qcl.css	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/2qbmau5rsj0r418xxfzq45ee9j.gif	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/css/css_NI2rCd4CVDulXgcLRyDFYy2bq2iPw-82wH2tT7FsWl8.css	false	Avira URL Cloud: safe	unknown
https://static.hotjar.com/c/hotjar-1133450.js?sv=6	false		high
https://www.islandhealth.ca/themes/ih_main/images/Island_Health_rgb.svg	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/success.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	true		unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/i.css	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/2qbmau5rsj0r418xxfzq45eee9j.gif	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/js/js_VuZauQsvsWjKftap3BOGAQhqbQtrNRozpNALvcD0_cY.js	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/themes/ih_main/images/rD-mapProduction--belowCarousel.png	false	Avira URL Cloud: safe	unknown
https://script.hotjar.com/modules.7d3f952308caf42c2b67.js	false		high
http://islandhealth.ca/	false	Avira URL Cloud: safe	unknown
https://vars.hotjar.com/box-acca23410e696f2ca3087d947271c3d0.html	false		high
https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	true		unknown
https://vc.hotjar.io/sessions/1133450?s=0.25&r=0.24306399311917715	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/themes/ih_main/images/header__gradient_border.png	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/ixd481lrtotq10keebomtjfld.gif	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/:abstract.simplenet.com/point.gif	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/css/css_K_nJJUXGGEsPD67l3zTy6sAJDxdVQu_QMEn6SqgLS2o.css	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/themes/ih_main/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/	false		unknown
https://www.islandhealth.ca/sites/default/files/styles/slideshow_image_1285_/public/covid-19/images/covid-carousel-banner.png?itok=0zAbCx97	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1	true		unknown
https://in.hotjar.com/api/v2/client/sites/1133450/visit-data?sv=6	false		high
https://www.islandhealth.ca/sites/default/files/2021-09/testing-teaser.png	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca	false		unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/3ck5cxcjdvota2rci97kovhztq.js	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/styles/standard_image/public/news/images/hospital-to-home-nr-teaser.png?itok=iGwJXoKP	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/files/winmail_bg13_002.jpg	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/login.php	false	Avira URL Cloud: safe	unknown
https://www.islandhealth.ca/sites/default/files/css/css_U90CtOOTFdFeay-SGr6fI8WWZAkHZkoXkejK_fujNIs.css	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/	Tabs_13293161610561843.0.dr	false		high
https://iframe.arkoselabs.com/	000003.log2.0.dr	false	Avira URL Cloud: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/po/loader.php?email=andrea.john	Session_13293161609213783.0.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com/js/client.js	mirroring_common.js.0.dr	false		high
https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb76	Session_13293161609213783.0.dr	true	Avira URL Cloud: safe	unknown
https://exo.nel.measure.office.net/api/report?TenantId=84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa&FrontEnd	Reporting and NEL.1.dr	false		high
https://nervous-ride.43-239-249-52.plesk.page:443	827acb3a-8a3d-4307-9fd2-9e52476b8c77.tmp.0.dr, 1789b073-d741-4e5c-b428-36fef03c8476.tmp.0.dr, 48d903f6-5f81-4bef-a527-0570f73e8115.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://crash.corp.google.com/samples?reportid=&q=	mirroring_cast_streaming.js.0.dr, common.js.0.dr	false		high
https://csp.withgoogle.com/csp/report-to/apps-themes	Reporting and NEL.1.dr	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	mirroring_hangouts.js.0.dr	false		high
https://aomediacodec.github.io/av1-rtp-spec/#dependency-descriptor-rtp-header-extension	mirroring_hangouts.js.0.dr	false	URL Reputation: safe	unknown
https://nervous-ride.43-239-249-52.plesk.page/	Network Action Predictor.0.dr	true	Avira URL Cloud: safe	unknown
https://preprod-hangouts-googleapis.sandbox.google.com	mirroring_hangouts.js.0.dr	false		high
https://www.google.com	000003.log1.0.dr	false		high
http://islandhealth.ca/2	History Provider Cache.0.dr	false	Avira URL Cloud: safe	unknown
https://setup.office.com	Tabs_13293161610561843.0.dr	false		high
https://setup.office.com/	000003.log2.0.dr	false		high
http://islandhealth.ca/)	History.0.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/landing	Tabs_13293161610561843.0.dr	false		high
https://setup.office.com/signin-oidcdg	Tabs_13293161610561843.0.dr	false		high
https://creativecommons.org/publicdomain/zero/1.0/.	mirroring_hangouts.js.0.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://github.com/madler/zlib/blob/master/zlib.h	mirroring_hangouts.js.0.dr	false		high
http://islandhealth.ca/Island	History.0.dr	false	Avira URL Cloud: safe	unknown
https://client-api.arkoselabs.com/fc/gc/?token=35960af6dab9183d8.6753500805&r=eu-west-1&metabgclr=%2	Tabs_13293161610561843.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/tools/feedback	feedback_script.js.0.dr	false		high
https://www.office.com/	000003.log0.0.dr, 000003.log2.0.dr	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_background.js.0.dr, craw_window.js.0.dr	false		high
https://csp.withgoogle.com/csp/report-to/static-on-bigtableb	Reporting and NEL.1.dr	false	Avira URL Cloud: safe	unknown
https://support.google.com/chromecast/troubleshooter/2995236	messages.json35.0.dr, messages.json34.0.dr, messages.json18.0.dr, messages.json42.0.dr, messages.json48.0.dr, messages.json44.0.dr, messages.json60.0.dr, messages.json22.0.dr, messages.json54.0.dr, messages.json82.0.dr, messages.json46.0.dr, messages.json37.0.dr, feedback.html.0.dr, messages.json86.0.dr, messages.json32.0.dr, messages.json6.0.dr, messages.json20.0.dr, messages.json88.0.dr, messages.json10.0.dr, messages.json70.0.dr, messages.json4.0.dr	false		high
https://www.islandhealth.ca	000003.log1.0.dr, Session_13293161609213783.0.dr	false	Avira URL Cloud: safe	unknown
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions	mirroring_hangouts.js.0.dr	false		high
https://setup.office.com/Home	Tabs_13293161610561843.0.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://client-api.arkoselabs.com/fc/apps/canvas/001/?meta=7&custom_font=	Tabs_13293161610561843.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com;	manifest.json1.0.dr	false	Avira URL Cloud: safe	low
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://servedby.flashtalking.com/container/13539;99030;10307;iframe/?ftXRef=&ftXValue=&ftXType=&ftX	Tabs_13293161610561843.0.dr	false		high
https://www.google.com/search?q=adobe	Tabs_13293161610561843.0.dr	false		high
https://csp.withgoogle.com/csp/report-to/apps-themeso	Reporting and NEL.1.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	mirroring_hangouts.js.0.dr	false		high
https://www.office.com/?auth=1	Tabs_13293161610561843.0.dr	false		high
http://tools.ietf.org/html/rfc1950	mirroring_hangouts.js.0.dr	false		high
https://hangouts.google.com/_/logpref	mirroring_hangouts.js.0.dr	false		high
https://docs.google.com	mirroring_common.js.0.dr	false		high
https://www.google.com/	000003.log2.0.dr, manifest.json.0.dr	false		high
https://feedback.googleusercontent.com	manifest.json1.0.dr	false		high
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/win64/1cf1126d11bb20	000003.log4.0.dr, History.0.dr	false		high
https://clients6.google.com	mirroring_hangouts.js.0.dr	false		high
https://nervous-ride.43-239-249-52.plesk.page	Session_13293161609213783.0.dr	true	Avira URL Cloud: safe	unknown
https://csp.withgoogle.com/csp/report-to/static-on-bigtable	Reporting and NEL.1.dr	false	Avira URL Cloud: safe	unknown
https://signup.live.com	Tabs_13293161610561843.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.186.45	unknown	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
43.239.249.52	nervous-ride.43-239-249-52.plesk.page	New Zealand	29802	HVC-ASUS	true
142.250.203.110	www-google-analytics.l.google.com	United States	15169	GOOGLEUS	false
52.60.77.135	islandhealth.ca	United States	16509	AMAZON-02US	true
172.217.168.8	www-googletagmanager.l.google.com	United States	15169	GOOGLEUS	false
54.76.183.110	in-live.live.eks.hotjar.com	United States	16509	AMAZON-02US	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
108.157.4.120	vc-live-cf.hotjar.io	United States	16509	AMAZON-02US	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false
216.58.215.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
13.224.99.19	script.hotjar.com	United States	16509	AMAZON-02US	false
13.224.99.58	static-cdn.hotjar.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
13.224.99.30	vars.hotjar.com	United States	16509	AMAZON-02US	false

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	600205
Start date and time:	2022-03-30 15:52:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.troj.win@56/266@18/19
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	102892
Entropy (8bit):	6.069894943598122
Encrypted:	false
SSDEEP:	3072:SZwTBgx4XoWps6UuBipzXNFGMNF7Njgirh1oQIc4Nap:82gSy6UuBEHGkFesToQ6Ep
MD5:	85E58166A63F8D3CDCA687D60D020208
SHA1:	59FDFADFCA359435A14418956AFDEE62900F9CC9
SHA-256:	1C8CFAB9C66D58E52D5CA59505609E8D214A68BEE94C200E84C36915D5BC1DB8
SHA-512:	D25DD6875D024EB2F9C687D5440C0DD1D54E9E4701099A4BFA126E14496F20DAEB7FB518EE52A061675A60FC32C26F4C775C1051A63E4C221CF54693FD32C98A
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.648688008831628e+12,"network":1.648655609e+12,"ticks":157747825.0,"uncertainty":2668252.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACanWu3FyjzSb22qOd7JcKxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOvzHMHSfF9+m4oxy+22fHMcQg44kCf1BXy1OZZbdvKzAAAAAA6AAAAAAgAAIAAAAPTENVQ24xIsJc/ZQEp5QqLyGws8rV509kXnSOO5wySTMAAAAH5bXPykNQD+rPcaJzuKSNgUUlUVuRFSP9klMm9IrmEdAB20jsgAMb2dc/upU0MueUAAAAChrUBvSOw+ZaWzDX+CTHaJdop4I956Us1Y1/MTm0kr4uGgJ1iujCKCl39idN0Kk67uULB9hxw0UYLGUi8ZC41p"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13293161647946453"},"plugins":{"metadata":{"adobe-flash-player":{"displ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 30, 2022 17:53:29.267703056 CEST	57529	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:53:29.268980026 CEST	55920	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:53:29.270040035 CEST	60433	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:53:29.285851002 CEST	53	55920	1.1.1.1	192.168.2.2
Mar 30, 2022 17:53:29.298877001 CEST	53	57529	1.1.1.1	192.168.2.2
Mar 30, 2022 17:53:30.157022953 CEST	53	60433	1.1.1.1	192.168.2.2
Mar 30, 2022 17:53:30.264238119 CEST	56107	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:53:30.280740023 CEST	53	56107	1.1.1.1	192.168.2.2
Mar 30, 2022 17:53:37.506798983 CEST	60759	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:53:37.814846039 CEST	53	60759	1.1.1.1	192.168.2.2
Mar 30, 2022 17:54:37.254548073 CEST	62814	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:54:37.856236935 CEST	53	62814	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:08.005235910 CEST	65145	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:08.341309071 CEST	53	65145	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:08.557708025 CEST	50348	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:08.895469904 CEST	53	50348	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:10.496711016 CEST	64163	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:10.513611078 CEST	53	64163	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:13.217962027 CEST	65481	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:13.263325930 CEST	53	65481	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:13.339903116 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.357605934 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.357701063 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.357721090 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.360189915 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.382118940 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.382244110 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.382524967 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.398380995 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.398402929 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.398437977 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.398453951 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.398963928 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.399188042 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.399211884 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.409996986 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410057068 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410083055 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410106897 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410130978 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410155058 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410181999 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410207033 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410233021 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.410254002 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.415085077 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.415185928 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.422333956 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.422626972 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.422722101 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.422823906 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.422894001 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.423026085 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.438497066 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438527107 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438563108 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438591957 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438615084 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438659906 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438683033 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438704967 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438788891 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438837051 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438873053 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438905001 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438941956 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438977003 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.438997984 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439019918 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439034939 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439053059 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439071894 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439090014 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439109087 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.439207077 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439310074 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439424992 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439513922 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439604044 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439706087 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439795017 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439891100 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.439977884 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.440058947 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.455560923 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455614090 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455635071 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455657005 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455733061 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455755949 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.455775976 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456007957 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456100941 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456131935 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456142902 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456154108 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456176043 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456197023 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456218958 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456240892 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456260920 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456285000 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456304073 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456326008 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456350088 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456374884 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456398010 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456398010 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456422091 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456445932 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456470013 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456489086 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.456517935 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456626892 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456726074 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456811905 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.456919909 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457001925 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457084894 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457179070 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457262993 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457345963 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.457431078 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.472887993 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.472920895 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.472945929 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.472970963 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473004103 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473031044 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473057985 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473081112 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473105907 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473129034 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.473151922 CEST	443	53885	104.18.10.207	192.168.2.2
Mar 30, 2022 17:55:13.475996971 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.476084948 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.476187944 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.476819038 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.476927996 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.477070093 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:13.809111118 CEST	55044	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:13.812130928 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.829000950 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.830740929 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.841094017 CEST	53	55044	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:13.841639996 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.841690063 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.841715097 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.843139887 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.845082998 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.866008997 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.866172075 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.866575956 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.882395029 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.882426977 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.882710934 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.882735014 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.885166883 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.885560989 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.926573992 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.931525946 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:13.934367895 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.934839964 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:13.971208096 CEST	58690	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:14.002006054 CEST	53	58690	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:14.039153099 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:14.055435896 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:14.068098068 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:14.068305969 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:14.068501949 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:14.105416059 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:14.109951019 CEST	443	50521	142.250.203.110	192.168.2.2
Mar 30, 2022 17:55:14.434115887 CEST	49452	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:14.450653076 CEST	53	49452	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:14.466672897 CEST	49407	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:14.484088898 CEST	53	49407	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:17.316329002 CEST	61081	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:17.452091932 CEST	53885	443	192.168.2.2	104.18.10.207
Mar 30, 2022 17:55:17.452810049 CEST	50521	443	192.168.2.2	142.250.203.110
Mar 30, 2022 17:55:17.492639065 CEST	53	61081	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:31.721440077 CEST	53650	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:31.741023064 CEST	53	53650	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:31.776529074 CEST	54714	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:31.793015957 CEST	53	54714	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:32.598606110 CEST	59513	53	192.168.2.2	1.1.1.1
Mar 30, 2022 17:55:32.643102884 CEST	53	59513	1.1.1.1	192.168.2.2
Mar 30, 2022 17:55:34.091285944 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.091896057 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.108242989 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.109580994 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.110843897 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.112535000 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.114955902 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.114995003 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.115032911 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.115067959 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.115209103 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.115652084 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.117656946 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.117697954 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.117733955 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.117765903 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.117867947 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.118077040 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.126022100 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.126188040 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.126851082 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.126943111 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.142486095 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.142530918 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.142860889 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.145229101 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.145261049 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.145451069 CEST	55048	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.167567968 CEST	443	51795	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.169879913 CEST	51795	443	192.168.2.2	142.250.185.164
Mar 30, 2022 17:55:34.170006990 CEST	443	55048	142.250.185.164	192.168.2.2
Mar 30, 2022 17:55:34.170537949 CEST	55048	443	192.168.2.2	142.250.185.164

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:29 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=YES+srp.gws-20210525-0-RC1.de+FX+704
2022-03-30 15:53:29 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-03-30 15:53:29 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Mar 2022 15:53:29 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-lOQoAhuP9KxDBwoGwurQZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-lOQoAhuP9KxDBwoGwurQZw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-03-30 15:53:29 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-03-30 15:53:29 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:29 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=91.0.4472.77&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-91.0.4472.77 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:29 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-xR0jMurDZN8x01DoW5oxpg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Mar 2022 15:53:29 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5567 X-Daystart: 32009 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-03-30 15:53:29 UTC	2	IN	Data Raw: 35 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 35 36 37 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 32 30 30 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 51e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5567" elapsed_seconds="32009"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-03-30 15:53:29 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-03-30 15:53:29 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:33 UTC	926	OUT	GET /po/files/2qbmau5rsj0r418xxfzq45ee9j.gif HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:34 UTC	927	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:34 GMT Content-Type: image/gif Content-Length: 2225 Last-Modified: Mon, 18 Dec 2017 10:53:55 GMT Connection: close ETag: "5a379e43-8b1" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:34 UTC	928	IN	Data Raw: 47 49 46 38 39 61 6c 01 61 00 f7 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 2b 00 00 2b 33 00 2b 66 00 2b 99 00 2b cc 00 2b ff 00 55 00 00 55 33 00 55 66 00 55 99 00 55 cc 00 55 ff 00 80 00 00 80 33 00 80 66 00 80 99 00 80 cc 00 80 ff 00 aa 00 00 aa 33 00 aa 66 00 aa 99 00 aa cc 00 aa ff 00 d5 00 00 d5 33 00 d5 66 00 d5 99 00 d5 cc 00 d5 ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 33 00 99 33 00 cc 33 00 ff 33 2b 00 33 2b 33 33 2b 66 33 2b 99 33 2b cc 33 2b ff 33 55 00 33 55 33 33 55 66 33 55 99 33 55 cc 33 55 ff 33 80 00 33 80 33 33 80 66 33 80 99 33 80 cc 33 80 ff 33 aa 00 33 aa 33 33 aa 66 33 aa 99 33 aa cc 33 aa ff 33 d5 00 33 d5 33 33 d5 66 33 d5 99 33 d5 cc 33 d5 ff 33 ff 00 33 ff 33 33 ff Data Ascii: GIF89ala3f++3+f+++UU3UfUUU3f3f3f3f3333f3333+3+33+f3+3+3+3U3U33Uf3U3U3U3333f3333333f3333333f3333333

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:55:20 UTC	6689	OUT	GET /sites/default/files/2021-09/od-teaser.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: www.islandhealth.ca
2022-03-30 15:55:20 UTC	6881	IN	HTTP/1.1 200 OK Date: Wed, 30 Mar 2022 15:47:38 GMT Server: Apache Accept-Ranges: none ETag: "2353e-5cc9917277115" Cache-Control: max-age=900, public X-Content-Type-Options: nosniff Last-Modified: Wed, 22 Sep 2021 17:46:14 GMT Content-Length: 144702 Content-Type: image/png X-Varnish: 215728546 215943765 Age: 726 Via: 1.1 varnish (Varnish/5.1) X-Varnish-Cache: HIT Accept-Ranges: bytes Connection: close
2022-03-30 15:55:20 UTC	6884	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 68 00 00 00 e6 08 06 00 00 00 f8 28 1f c9 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 04 6a 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 27 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 27 3e 0a 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 27 3e 0a 0a 20 3c 72 64 66 3a 44 65 73 63 72 69 70 Data Ascii: PNGIHDRh(pHYs+jiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x='adobe:ns:meta/'><rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'> <rdf:Descrip
2022-03-30 15:55:20 UTC	6897	IN	Data Raw: 82 0f 08 b2 be 2b 52 14 56 29 8d 94 8a f9 7c ce c3 47 ef a1 ca 1a 97 81 0c 29 49 c2 c4 81 ad 8b 18 6e 18 96 c8 81 91 4a 01 05 89 05 5d 5e 5c 24 43 10 23 6d d7 e2 bd e7 ea f2 12 2d 64 3a 57 4a 8c e9 51 85 4e 5a a3 4b db 2f 9a 7d ba b6 d6 3a 69 94 42 8c ac 33 10 b1 ce 71 f9 f2 25 4d d3 50 d7 35 fb ed 96 ed 7a 4d 55 55 b9 cb c9 e0 78 ef 89 44 ca a2 cc 6c 7c d0 7e e3 b8 40 95 52 b4 fb 36 15 05 54 15 c6 5a 8c 4b ac b0 ef 7b b4 2e d0 3a 2d 7e 21 44 d6 33 13 1b 1c c0 29 f8 88 b5 2e 33 c9 e4 1d 55 55 35 b6 e1 9c cb c6 27 31 cf c1 70 38 97 82 5a 12 70 3e 6d 9e 83 54 28 95 ef 3b 8f ba 1f 3e 03 84 f4 38 67 29 8a 2a eb b9 6e 64 cf 89 0d ab 6c 64 43 66 87 7e 34 2a 7e d8 db 21 cb 02 83 3e 5e 96 25 6c 36 a3 94 31 18 85 e1 19 0c f3 d6 f4 86 18 92 a1 d5 fa c0 75 86 60 dc Data Ascii: +RV)\|G)InJ]^\$C#m-d:WJQNZK/}:iB3q%MP5zMUUxDl\|~@R6TZK{.:-~!D3).3UU5'1p8Zp>mT(;>8g)ndldCf~4~!>^%l61u`
2022-03-30 15:55:20 UTC	6993	IN	Data Raw: 48 4a 47 da 56 71 f8 3b 44 0b 21 b2 5e af 89 48 1e 7d f0 78 74 fb 89 31 55 ae 0c 28 3c 18 97 5c c7 9f d8 69 72 41 11 82 fd 6e c7 97 4f 9f e0 9c 63 bb dd 22 84 60 36 9b a5 49 ac 24 a7 a7 a7 89 e9 58 9b dc 5e 67 09 c6 50 14 7a 5c dc 52 4a ac 31 60 c4 b8 90 eb ba 1e 01 d3 7b cf 64 32 41 08 39 ba a9 5a 6b da b6 a3 ef fb 71 db 44 ef 03 fb fd 1e ad 13 50 c6 10 a9 ea 0a 88 d9 85 f7 68 a5 b0 7d 62 6a 10 d3 a4 b2 76 7c 66 4a 0d d2 8d 18 77 20 1b 24 1c 6b 2d ce 7a bc 4f 1e 85 b1 86 b2 2c 50 5a 66 cf 25 8c ee b6 d6 0a 29 24 bd 49 6e ad cf bb 91 25 d6 9d 9e 45 d7 75 08 a9 e8 bb 9e b2 2c 29 cb 32 6f ca 6e 31 d6 24 83 66 bb b4 33 9a 54 c9 65 b7 2e b3 64 87 b3 96 7a 32 c9 f2 42 92 2d b4 d6 23 18 0c af 43 08 a3 f1 b3 d6 a2 b4 82 78 33 a8 ea 7d d2 7d 87 e7 e1 9c a3 2c 4b Data Ascii: HJGVq;D!^H}xt1U(<\irAnOc"`6I$X^gPz\RJ1`{d2A9ZkqDPh}bjv\|fJw $k-zO,PZf%)$In%Eu,)2on1$f3Te.dz2B-#Cx3}},K
2022-03-30 15:55:20 UTC	7008	IN	Data Raw: e4 67 53 14 29 88 34 00 d9 6c 32 4d e5 b7 42 e0 0a 87 0f 3e 83 a4 c3 98 2e 6d 24 24 25 d7 eb 35 4a 95 9c 9d 9d 8d 45 1e 84 c3 e6 f0 93 c9 74 2c 1e 4a 73 27 19 d0 49 5d 25 96 29 04 55 66 73 21 04 a6 93 b4 0f 6f 59 96 74 7d cf 64 32 01 22 b3 d9 8c 76 bf 27 c4 9a 42 29 4e bf fb e1 a8 59 7a 67 59 ce e7 4c aa 8a c5 72 81 31 7e 2c c4 d9 ed 76 e9 67 91 80 c5 74 46 0c 81 69 53 63 4c 37 1a f8 a6 aa 98 4d a7 ec db 3d db ed 2e 17 7a 24 f9 a4 2c 4b 26 4d 45 f0 8b 1c d9 37 80 60 b7 d9 b0 58 2c f2 ae 6f 29 77 bb ef 7b 9a ba e6 de f9 29 4d d3 b0 d9 6c 28 94 c4 d9 9e c5 62 41 d7 77 9c e4 85 3f a9 1b da ae 43 22 28 75 81 e9 7a 4e 16 4b ca a2 c4 e8 8e 76 bf 67 36 9b b3 69 af 39 39 59 22 61 34 0a dd 6e 9f 80 5a 08 f6 ed 9e e0 2c d3 aa e4 fa ba 27 0a 4f 70 91 d6 77 34 65 8d Data Ascii: gS)4l2MB>.m$$%5JEt,Js'I]%)Ufs!oYt}d2"v'B)NYzgYLr1~,vgtFiScL7M=.z$,K&ME7`X,o)w{)Ml(bAw?C"(uzNKvg6i99Y"a4nZ,'Opw4e
2022-03-30 15:55:20 UTC	7017	IN	Data Raw: 7b 4c 67 09 41 e8 73 fc f2 02 10 dc b8 b5 4f d7 35 fa 6b bf 12 03 98 2e ee ba 27 b3 eb 7a 7c f3 cd 37 1c 1f bf e4 fe fd 07 84 61 c4 e9 e9 29 2f 5e 3c e7 6a b1 a4 2c 6b 5e 1e 1f 73 76 76 46 59 55 b4 7a 51 67 28 63 a6 73 36 66 36 6a 24 53 8e 5c 0c 92 c0 71 89 c3 88 34 19 e1 bb 0a 87 75 1d 97 91 ee 9c c2 30 24 08 42 db 19 c4 b1 8a ad 6f 9a 86 f1 28 65 34 52 07 ad ef 5b 35 be a2 c6 cd 9b 37 8f 60 90 1a 3b 0c 69 5b 85 b7 8e c7 a9 ea 74 f4 2f a9 bb 12 73 39 ed e9 e9 a1 6d 1a c2 20 64 14 29 ba d4 d0 f7 a4 a3 11 f3 d9 5c 49 80 f5 e5 1c 85 e1 b7 7e 49 03 c3 68 08 a7 1f 06 e6 f3 39 5d db 12 ea 2e bb aa 2a c2 30 64 3a ce 14 6f 5a 4a 92 38 a1 28 0a 46 49 a2 1c ff 1c b5 34 da 9b cf 29 8b 42 49 7d 35 af 3e cb 32 3d aa ab 06 a3 ae 6b b5 33 41 5a d1 4b 5d 55 f8 9e 82 7a Data Ascii: {LgAsO5k.'z\|7a)/^<j,k^svvFYUzQg(cs6f6j$S\q4u0$Bo(e4R[57`;i[t/s9m d)\I~Ih9].*0d:oZJ8(FI4)BI}5>2=k3AZK]Uz
2022-03-30 15:55:20 UTC	7025	IN	Data Raw: a7 2a 7b b1 68 24 bd 54 01 0d a2 2d 14 34 26 7c 84 3b 20 b7 6b da a6 61 36 d9 c3 f3 22 5c df 67 b2 7f c8 5b ef 7d 1f e1 79 f8 81 8f 27 1c 25 40 51 31 46 bd 0d 2c c4 71 08 bc 90 38 4a e9 3a a5 2c 7c f2 cd 31 c3 e0 f0 f8 cb a7 1c 1f 9f 92 65 13 8e 8e 8e 78 f7 9d 3b 08 07 d2 34 e4 bd ef be cd 93 af 1f f3 bf fe eb ff 8d d5 a2 24 0c 13 ed 08 35 a3 69 1b de 78 eb 2e 65 05 07 87 7b dc 7f ed 3d 66 b3 09 91 1f 22 64 4f db 36 b4 7d 83 a4 c7 d1 05 b1 ed 1a fa 5e 33 4a 1c 89 14 e0 07 3e 4e 17 72 75 55 70 7a 7a ca c9 c9 92 f3 b3 2b 2e 2f 57 94 75 0b 83 8b 70 02 1c cf c7 0f 05 43 0f 65 d3 11 c6 23 46 a3 8c b2 5a 2b 19 b7 bb 55 a2 9b 21 a2 ef 3b a4 54 36 90 7d 37 30 f4 0e cf 9e bd a4 28 ef d2 0f 2a e0 11 94 f7 44 db d4 4a e4 e0 a9 1f bc 04 16 cb 15 ab e5 5a 19 6d 0e 03 Data Ascii: {h$T-4&\|; ka6"\g[}y'%@Q1F,q8J:,\|1ex;4$5ix.e{=f"dO6}^3J>NruUpzz+./WupCe#FZ+U!;T6}70(DJZm
2022-03-30 15:55:20 UTC	7033	IN	Data Raw: e1 a7 27 3c 7f 91 b3 c9 7b 64 ef 23 06 1f 15 ef 2e ae 15 f6 0e 13 b9 ee 85 0e 61 90 b2 5e ad f8 c1 fb 77 79 ff fd ef f3 e5 17 cf f0 c3 10 c4 a0 bc 7f 07 c5 6c e8 86 9c b7 bf 73 97 28 f2 35 57 d9 a5 d7 b2 4e 05 f9 38 3c 7b f6 8c 3f 3c fd 86 f3 f3 0b b6 bb 1d be 0e 9f 1c 7a 85 f7 09 a1 13 5e 34 0f dc 6c bc ad 32 71 50 69 c4 a3 d1 88 ae ef 18 25 09 55 59 b1 5a ad d9 6e 77 84 51 c4 c1 fe be 5d a0 98 ce 38 49 12 2b ed 36 5b 66 83 09 9b 05 98 ea e2 06 4b 21 33 82 0e b3 ec 68 db 56 51 bb ba c6 76 6f 55 55 11 1b 95 57 df 2b ef 00 39 90 8e c7 4a 59 a5 a1 88 b2 2a 41 40 96 8d 11 3a 30 c0 78 28 ab 94 65 49 3a ce 18 6b 15 a0 31 27 2a ab 9a 7e 50 cb 1c 63 b4 64 60 93 20 0c f0 7c 9f 6c 9a d9 ae d2 e0 8e c2 11 96 86 d7 f7 9d bd ec 82 c0 d7 dd bd 4f ab 99 22 4d f3 ca 20 Data Ascii: '<{d#.a^wyls(5WN8<{?<z^4l2qPi%UYZnwQ]8I+6[fK!3hVQvoUUW+9JYA@:0x(eI:k1'~Pcd` \|lO"M
2022-03-30 15:55:20 UTC	7040	IN	Data Raw: 8a bc 3f c2 1b ed e3 c7 aa 21 12 8e 8b fb 5f fc cd bf f8 c0 45 19 7f 54 4d 43 dd 0c 38 6e 88 1f 26 20 22 36 db 86 67 df 5c f1 f3 9f 7d c6 ff f3 d3 df f0 ab 8f 1e f1 f9 a3 17 2c 96 15 43 1f e1 07 13 7c 7f a4 97 2f 9d 1e fb 7b 84 f0 08 fc 04 21 03 ba fa ff 25 eb 4d 9b 2c 3d ae 3b bf 5f 66 3e db dd ef ad 5b 55 5d 55 dd 68 f4 82 95 00 29 4a 24 21 52 96 3c 0e 59 f6 d8 0a 3b 64 87 c3 e1 af c3 ef e1 17 fe 04 b6 63 3c f3 42 33 11 da 87 a2 3c 14 17 51 20 40 52 58 1b bd d5 7a f7 fb 6c b9 f8 45 66 3e 5d 18 23 02 81 46 77 6d 7d 6f 3e 27 cf f9 9f ff a2 f9 e6 b7 de 62 38 1a b2 5e 95 e4 59 c2 60 68 f9 9d df 7d 83 bf f9 eb bf e1 3f fc f9 df f0 d6 3b 67 64 b9 65 bd 5e f2 ee 37 1e f3 ef fe dd bf 47 d7 8a f7 bf 75 1f dd 94 7c f1 d9 33 74 23 78 f1 ec 92 f7 be f5 0e 0f 1e 3e Data Ascii: ?!_ETMC8n& "6g\},C\|/{!%M,=;_f>[U]Uh)J$!R<Y;dc<B3<Q @RXzlEf>]#Fwm}o>'b8^Y`h}?;gde^7Gu\|3t#x>

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:34 UTC	927	OUT	GET /po/files/winmail_bg13.jpg HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:35 UTC	932	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:35 GMT Content-Type: image/jpeg Content-Length: 506 Connection: close X-Accel-Version: 0.01 Last-Modified: Mon, 18 Dec 2017 10:32:35 GMT ETag: "1fa-5609ade5696c0" Accept-Ranges: bytes X-Powered-By: PleskLin
2022-03-30 15:53:35 UTC	932	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff ee 00 0e 41 64 6f 62 65 00 64 c0 00 00 00 01 ff db 00 84 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02 02 02 02 03 03 03 03 03 03 03 03 03 03 01 01 01 01 01 01 01 02 01 01 02 02 02 01 02 02 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ff c0 00 11 08 01 a4 00 28 03 01 11 00 02 11 01 03 11 01 ff c4 00 4d 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 08 10 01 00 00 Data Ascii: JFIFddDuckydAdobed(M

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:34 UTC	930	OUT	GET /po/files/winmail_bg13_002.jpg HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:35 UTC	938	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:35 GMT Content-Type: image/jpeg Content-Length: 107384 Last-Modified: Mon, 18 Dec 2017 10:33:55 GMT Connection: close ETag: "5a379993-1a378" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:35 UTC	938	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff ee 00 0e 41 64 6f 62 65 00 64 c0 00 00 00 01 ff db 00 84 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02 02 02 02 03 03 03 03 03 03 03 03 03 03 01 01 01 01 01 01 01 02 01 01 02 02 02 01 02 02 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ff c0 00 11 08 01 a4 03 ac 03 01 11 00 02 11 01 03 11 01 ff c4 00 ff 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 04 00 02 03 05 06 01 07 08 09 0a 0b 01 00 02 03 01 01 01 01 01 01 00 00 00 00 Data Ascii: JFIFddDuckydAdobed
2022-03-30 15:53:35 UTC	954	IN	Data Raw: cb a5 af 31 7d b1 c2 90 68 cb 6b 5e 72 9d b4 38 52 bb 36 5d 0d 79 81 ed a0 84 d2 ea cb 63 56 62 2b 64 82 97 56 5b 5a 66 0b 27 81 20 a5 d0 32 e8 69 9b 02 b2 0f f4 ba ba fe 2d 33 17 91 f4 17 a5 d5 97 4b 4c c5 64 62 f4 9a b2 e9 62 cc 57 6d 9d f4 83 47 57 c0 b5 66 05 da a1 df 49 ab 67 73 5e 76 56 44 38 52 ea cb 63 4c c0 bb 7d 0e 8a 5d 59 74 b1 29 93 20 f1 4b ab 2e 96 25 30 94 0e fa 5d 5d 3f 4b 5e 60 b2 0e 14 ba b2 e6 6b cc 2e 56 fd a4 82 94 e8 cb 99 ed 33 0b 70 17 a4 d5 b3 b9 8b 38 2e dd 46 9a 4d 5b 3b 9a f3 80 ed d4 46 92 1f 2f 5f c1 a6 60 5d ba 11 9a 4d 59 6c 6b 53 2b b7 d4 88 d2 6a cb 98 31 e7 64 c8 86 9a 4c ce cb a5 ad 4c 8e 15 e0 46 69 1d 9b 2e 86 2c e5 38 11 9a 3d 59 6c 62 53 2b b6 46 69 35 6c fa 58 d4 c1 76 f9 91 1a 4b 61 96 c6 6a 98 0e de 15 21 55 24 Data Ascii: 1}hk^r8R6]ycVb+dV[Zf' 2i-3KLdbbWmGWfIgs^vVD8RcL}]Yt) K.%0]]?K^`k.V3p8.FM[;F/_`]MYlkS+j1dLLFi.,8=YlbS+Fi5lXvKaj!U$
2022-03-30 15:53:35 UTC	970	IN	Data Raw: 38 59 07 44 ee a6 c2 f6 db a6 b6 dd c5 d0 f9 e6 ba 79 ab 53 49 39 c6 46 f1 50 42 a5 90 a4 2a 24 87 68 03 5b 74 b7 0b 4a 5a 29 5f 58 4e 14 6b 97 a4 e2 43 0b 98 e3 17 c8 ec 8a fa a8 85 2a 5a c0 0e 04 82 f7 6b b0 b6 3d 36 ff 00 ad 8d bc 92 ca e8 b0 aa 2a e6 92 cc 9d 62 9a ea 36 a2 aa 64 d0 7c d5 83 a0 0b 06 a7 6a 6c 5a ad 7e ab 53 2c d7 da 6f 95 15 10 56 f4 f1 b7 5c ab de 65 05 4a c3 88 79 89 cd a4 c4 f2 37 98 d6 5c 9a 95 13 ea ce b5 88 a7 96 bc 51 93 ae 22 2a 24 87 07 5a e2 f0 f7 73 45 b8 3a 9a cd b9 f8 9e 82 c7 bb 48 a5 c4 c7 5e 55 72 69 42 97 36 62 50 98 3d 5b e3 41 31 16 e6 6e 4b b5 3b 8e b1 55 48 ee 69 da c9 47 c8 f2 fa dc 61 51 78 d7 7e 0d 86 68 6a 6f 8b d2 66 f1 45 35 24 b5 4e 52 10 97 05 cf 9a 52 e4 48 91 28 97 ae 64 c2 94 20 17 a8 80 de 87 63 f2 8e Data Ascii: 8YDySI9FPB$h[tJZ)_XNkCZk=6b6d\|jlZ~S,oV\eJy7\Q"$ZsE:H^UriB6bP=[A1nK;UHiGaQx~hjofE5$NRRH(d c
2022-03-30 15:53:35 UTC	986	IN	Data Raw: 6b a2 9c f9 f5 36 eb 7b 82 7c 5e 34 39 f2 da 35 11 75 8d 70 01 55 c7 3d 6f 09 0f 71 b0 82 1c 06 78 5a f6 d7 1d 64 55 5b 68 47 c0 ea e3 8c 6a d3 1b f8 15 52 4c 25 0d 65 f0 8d a2 39 e0 cc 86 b6 df d1 72 4c 5b d3 6b 69 f4 5d 4e 2a e6 a8 0e 7c b4 8b 5f ff 00 27 31 79 cc cf 5a bb 7c 17 0a 57 fb 82 dd bd 5c 15 5c 5d 18 29 ba d6 f2 15 24 87 ba cf 97 78 87 80 fd 0c d5 a8 8b 49 ae 04 cd aa 4b 9e 04 33 2e e2 94 92 a4 29 2e 79 24 bc 39 d6 b8 bd cc ce fd a5 cf ee f4 87 0b 97 d6 34 a9 9b 9f 3f cd ab a6 ba ee da 6a 9b ce f5 af 9f 2e 92 8a 86 8a 9e 6d 5d 55 5d 5c e5 04 49 a6 a6 a6 92 17 36 74 f9 8b 2e 4a 52 09 24 b9 cd 83 59 bc 69 74 96 dd db 92 4a 31 4d b6 dd 12 48 ed ed db 76 bb 5b 7e 36 ed 42 52 72 69 24 93 6d b7 c2 8b 99 ef 7e e1 f8 1b c5 8e 08 fb 14 c5 97 87 15 a8 Data Ascii: k6{\|^495upU=oqxZdU[hGjRL%e9rL[ki]N*\|_'1yZ\|W\\])$xIK3.).y$94?j.m]U]\I6t.JR$YitJ1MHv[~6BRri$m~
2022-03-30 15:53:35 UTC	1002	IN	Data Raw: f9 6e 37 6a e5 77 58 eb d7 53 a8 7f ff 00 69 e8 f4 1c 52 4a 12 90 9b a7 05 cb 73 a0 8c 05 81 d2 39 00 18 7c 1e 66 7c 7c cd b9 56 aa f7 fb d8 7f 09 c3 bd e5 0d 3c 9e 2f 50 fd 3a 8b ff 00 d6 1a 8a 6e 2e 54 20 39 34 58 55 00 c5 c9 c1 18 2c 3b 4c 3f 00 d4 da 23 e6 8d d3 87 7d fb 21 fc 27 3a e7 92 f4 6d d5 ab ee 9f fa fb ff 00 d6 06 8e 2f 54 27 71 49 a6 c2 e6 24 a7 77 05 60 d4 28 66 11 fc 06 0a 56 ac cd 6f cd 1b a5 70 be fd 90 fe 11 0f c9 3a 2a e3 1b d8 7f eb af ff 00 58 56 54 71 46 64 e4 a9 2a ba 70 6c c7 83 19 98 13 04 a8 80 a2 62 92 6e 07 a5 51 89 1a 58 25 e6 7d d5 ff 00 8e 7f bb 0f e1 0a 3e 4d d1 27 c2 fa ff 00 87 bf f7 ff 00 98 66 eb 71 d5 3c f4 ee cc b8 30 34 c0 9d e7 05 f0 ff 00 03 a8 12 a7 03 03 87 cd a1 b3 4b cc 7b 93 78 dd ff 00 7b 0f e1 35 43 ca 9a Data Ascii: n7jwXSiRJs9\|f\|\|V</P:n.T 94XU,;L?#}!':m/T'qI$w`(fVop:XVTqFdplbnQX%}>M'fq<04K{x{5C
2022-03-30 15:53:35 UTC	1018	IN	Data Raw: f9 84 ff 00 5c f5 b9 af e0 57 40 97 99 a1 fa 58 9d 57 11 92 37 7f bc 0c f6 29 fd 6e 62 5a 0f 02 3f 33 2f d2 64 c9 e2 42 47 f8 9e 95 77 b4 fa bc 0f ed 32 6f e9 84 23 89 88 0e fe f7 b4 3b ad ab ea ec 2b 42 9f 99 17 e9 84 a3 89 c9 11 f5 48 e7 53 bb 4b 1a d0 78 0b 7e 64 e5 9c 25 3c 51 4f f9 94 f3 2d db 09 62 f8 14 b9 03 fd a3 af e7 22 53 c5 24 84 9f ef 09 e5 df 0f b7 95 a2 d1 2a f0 02 5e 63 af 09 60 75 1c 56 48 ff 00 14 61 6f 8c 7f ee 9a 3d 0f 81 6b cc 4b 8e 60 94 71 60 07 0f 58 07 29 1d 6f 39 99 72 d0 a5 8d 06 c7 cc 4b f4 b1 08 4f 16 07 f9 b4 ea f1 24 76 d8 ca 7a 2f 01 8b cc 6a bf 49 04 a7 8b 00 ff 00 8b 41 b2 c5 0f fd d3 2a 5a 1f 00 97 98 57 0c c8 25 3c 58 02 ca 94 ff 00 5d db 49 65 bd 02 0d 79 85 73 90 e4 f1 65 20 bf d5 b9 c7 ed c3 a3 3b 57 c0 78 17 1f 31 Data Ascii: \W@XW7)nbZ?3/dBGw2o#;+BHSKx~d%<QO-b"S$^c`uVHao=kK`q`X)o9rKO$vz/jIAZW%<X]Ieyse ;Wx1
2022-03-30 15:53:36 UTC	1034	IN	Data Raw: 71 83 5a 6c 53 91 55 3a 80 07 c3 a1 89 09 94 f0 2a 66 d0 87 98 6a 67 c7 81 8a 77 17 ac ac 9d 46 ec b3 33 a2 8c 77 2e 95 b3 29 63 61 b3 9d 9c 91 8e 57 50 12 e9 c8 07 57 38 62 51 5d 05 3b d8 02 aa 48 c8 34 70 5c 8b 57 91 12 a5 0d 03 2d 8c 0e 28 6a b9 d1 90 aa 50 16 0e 9b 5a b2 f5 0f b8 c8 4c b1 ac 30 b8 86 ae be 63 14 8e 7c b4 b0 d1 0d 8d da 91 94 06 94 5e a1 99 db f4 11 2a 58 ce 3a 32 83 4a 04 a6 c6 14 73 b5 51 05 98 66 e8 62 a0 59 98 b7 43 4a 12 ac 5b ac 5e 82 f3 0b 75 8a 85 66 10 1c ec 5f 84 1c e3 83 9c c6 97 30 5c aa 26 64 7e f8 04 89 19 de c6 81 6f 90 f6 28 82 74 33 17 52 99 20 80 62 58 8b 6f 99 d7 b1 50 1c c8 6b 4e 00 9c 51 74 35 30 78 8e 8a c0 63 03 ea 11 fd 6f f0 cb f5 b4 e3 2f 0f b8 4d c1 ae 16 4a f6 e1 ec fb 14 dd 1c 1b e1 07 0c b8 3b 85 af cc 5d Data Ascii: qZlSU:fjgwF3w.)caWPW8bQ];H4p\W-(jPZL0c\|^X:2JsQfbYCJ[^uf_0\&d~o(t3R bXoPkNQt50xco/MJ;]

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:34 UTC	931	OUT	GET /po/files/login_bg.gif HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:35 UTC	933	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:35 GMT Content-Type: image/gif Content-Length: 2915 Last-Modified: Mon, 18 Dec 2017 10:52:10 GMT Connection: close ETag: "5a379dda-b63" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:35 UTC	933	IN	Data Raw: 47 49 46 38 39 61 f4 01 f4 01 e6 00 00 da e1 e8 fe fe fe ad ad ad fb fc fd 7f 7f 7f fd fd fe fd fe fe fc fd fd fe fe ff fa fb fc fd fd fd fe ff ff d0 d0 d0 fc fd fe fa fb fb fb fc fc fc fc fd fb fb fb f3 f3 f3 fc fc fc 5c 5c 5c f9 fa fb 67 67 67 dd e3 ea 73 73 73 b9 b9 b9 e8 e8 e8 96 96 96 dc dc dc 8a 8a 8a c5 c5 c5 e1 e7 ec a2 a2 a2 fa fa fb ed f0 f3 ee f1 f4 eb ef f3 ef f2 f5 db e2 e9 e3 e9 ee ea ee f2 fb fb fc f8 f9 fa f7 f8 f9 f6 f8 f9 e1 e7 ed e5 ea ef f4 f6 f9 f5 f7 f8 e2 e7 ed de e4 eb f4 f5 f7 f4 f6 f8 f9 fa fa de e5 eb e8 ed f1 ed f1 f4 f1 f4 f7 f3 f6 f7 f5 f7 f9 e2 e8 ed f7 f8 fa f9 fa fc f5 f6 f8 db e1 e8 e8 ec f1 f2 f5 f7 e9 ee f2 f7 f9 fa f8 f9 f9 f2 f4 f6 e7 ec f0 e0 e7 ec dd e4 ea e4 e9 ee f9 f9 fa db e2 e8 ee f2 f4 f1 f4 f6 f6 f7 f9 f6 f7 Data Ascii: GIF89a\\\gggsss

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:34 UTC	932	OUT	GET /po/files/ixd481lrtotq10keebomtjfld.gif HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/files/6mdowyfv0k5u2o53i2za2za0k.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:35 UTC	936	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:35 GMT Content-Type: image/gif Content-Length: 1709 Last-Modified: Mon, 18 Dec 2017 17:17:00 GMT Connection: close ETag: "5a37f80c-6ad" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:35 UTC	936	IN	Data Raw: 47 49 46 38 39 61 05 00 28 00 f7 00 00 00 00 00 80 00 00 00 80 00 80 80 00 00 00 80 80 00 80 00 80 80 c0 c0 c0 c0 dc c0 a6 ca f0 4b 8b d2 4c 8c d2 4d 8c d2 4e 8d d3 4e 8e d3 50 8f d4 51 8f d5 52 90 d5 53 91 d6 54 92 d6 55 93 d7 57 94 d8 58 96 d8 59 97 d9 5b 98 da 5c 99 da 5d 9a db 5f 9b dc 60 9c dd 62 9e dd 63 9f de 64 a0 df 66 a1 e0 67 a2 e0 69 a3 e1 6a a4 e2 6b a5 e2 6c a6 e3 6e a8 e4 6f a9 e4 70 a9 e5 71 aa e5 72 ab e6 73 ac e7 74 ad e7 75 ae e8 76 ae e8 77 af e8 77 af e9 97 c6 f5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: GIF89a(KLMNNPQRSTUWXY[\]_`bcdfgijklnopqrstuvww

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:36 UTC	1043	OUT	GET /favicon.ico HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:37 UTC	1044	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Mar 2022 15:53:37 GMT Content-Type: text/html Content-Length: 808 Connection: close Last-Modified: Tue, 29 Mar 2022 17:03:36 GMT ETag: "328-5db5e68d93137" Accept-Ranges: bytes
2022-03-30 15:53:37 UTC	1044	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>404 Not Found</title> <link rel="s

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0ab9ae5f-ad70-4bc1-b655-b17ed69b4375.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2fdbff74-2af5-433c-a306-f0f4e3bf47f9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\32458d35-6137-43e0-9733-511ec0282111.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3d5aa94b-5456-4843-996d-a08e9b57ad7d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\41a79e3e-f2ad-49d9-9032-5ab8f8f10f14.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\4288962c-0e96-4e4a-a67e-5ec8e911d878.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\671dd13d-cea5-4292-9cda-5e217e4cd1da.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7e36f6ba-65c5-40b1-8490-7d9cb37dfb4a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\8f67bfe5-58a2-4b49-a5f1-27b5f8ad303f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\08850018-4933-4183-8111-4be5c91a56ca.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\0c4a502e-a27d-4636-bcc9-6ae64d723d9f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1789b073-d741-4e5c-b428-36fef03c8476.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\21a39e21-2219-40c9-8ea2-e6029eaa3ace.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\36a6d8df-17c3-40c5-bc35-147cb7328fc3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\39937fe4-abbd-423d-a8ee-3b76dd504da7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3d8d2dc4-2b2e-487c-8775-d7106a2aa1ec.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\48d903f6-5f81-4bef-a527-0570f73e8115.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5d7eae03-52a7-4ff4-94dd-3532a6ce947c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7eddf9e0-4313-40fa-a78c-bce8cf7544be.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\827acb3a-8a3d-4307-9fd2-9e52476b8c77.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\87b5748b-3ef6-4f36-adf0-1ff3de7a52f4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\95cd07f5-19ff-467e-a8fd-08ff0af99afa.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9bda54d5-166e-4226-a52d-7daab840036f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old (copy)

Windows Analysis Report
https://nervous-ride.43-239-249-52.plesk.page/po/?email=andrea.john@islandhealth.ca

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:38 UTC	1045	OUT	GET /po/files/winmail_bg13.jpg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: nervous-ride.43-239-249-52.plesk.page
2022-03-30 15:53:39 UTC	1045	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:38 GMT Content-Type: image/jpeg Content-Length: 506 Connection: close X-Accel-Version: 0.01 Last-Modified: Mon, 18 Dec 2017 10:32:35 GMT ETag: "1fa-5609ade5696c0" Accept-Ranges: bytes X-Powered-By: PleskLin
2022-03-30 15:53:39 UTC	1046	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff ee 00 0e 41 64 6f 62 65 00 64 c0 00 00 00 01 ff db 00 84 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02 02 02 02 03 03 03 03 03 03 03 03 03 03 01 01 01 01 01 01 01 02 01 01 02 02 02 01 02 02 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ff c0 00 11 08 01 a4 00 28 03 01 11 00 02 11 01 03 11 01 ff c4 00 4d 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 08 10 01 00 00 Data Ascii: JFIFddDuckydAdobed(M

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:39 UTC	1049	OUT	GET /po/files/winmail_bg13_002.jpg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: nervous-ride.43-239-249-52.plesk.page
2022-03-30 15:53:40 UTC	1052	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:40 GMT Content-Type: image/jpeg Content-Length: 107384 Last-Modified: Mon, 18 Dec 2017 10:33:55 GMT Connection: close ETag: "5a379993-1a378" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:40 UTC	1052	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff ee 00 0e 41 64 6f 62 65 00 64 c0 00 00 00 01 ff db 00 84 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 02 02 02 02 02 02 02 02 02 03 03 03 03 03 03 03 03 03 03 01 01 01 01 01 01 01 02 01 01 02 02 02 01 02 02 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ff c0 00 11 08 01 a4 03 ac 03 01 11 00 02 11 01 03 11 01 ff c4 00 ff 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 04 00 02 03 05 06 01 07 08 09 0a 0b 01 00 02 03 01 01 01 01 01 01 00 00 00 00 Data Ascii: JFIFddDuckydAdobed
2022-03-30 15:53:40 UTC	1068	IN	Data Raw: cb a5 af 31 7d b1 c2 90 68 cb 6b 5e 72 9d b4 38 52 bb 36 5d 0d 79 81 ed a0 84 d2 ea cb 63 56 62 2b 64 82 97 56 5b 5a 66 0b 27 81 20 a5 d0 32 e8 69 9b 02 b2 0f f4 ba ba fe 2d 33 17 91 f4 17 a5 d5 97 4b 4c c5 64 62 f4 9a b2 e9 62 cc 57 6d 9d f4 83 47 57 c0 b5 66 05 da a1 df 49 ab 67 73 5e 76 56 44 38 52 ea cb 63 4c c0 bb 7d 0e 8a 5d 59 74 b1 29 93 20 f1 4b ab 2e 96 25 30 94 0e fa 5d 5d 3f 4b 5e 60 b2 0e 14 ba b2 e6 6b cc 2e 56 fd a4 82 94 e8 cb 99 ed 33 0b 70 17 a4 d5 b3 b9 8b 38 2e dd 46 9a 4d 5b 3b 9a f3 80 ed d4 46 92 1f 2f 5f c1 a6 60 5d ba 11 9a 4d 59 6c 6b 53 2b b7 d4 88 d2 6a cb 98 31 e7 64 c8 86 9a 4c ce cb a5 ad 4c 8e 15 e0 46 69 1d 9b 2e 86 2c e5 38 11 9a 3d 59 6c 62 53 2b b6 46 69 35 6c fa 58 d4 c1 76 f9 91 1a 4b 61 96 c6 6a 98 0e de 15 21 55 24 Data Ascii: 1}hk^r8R6]ycVb+dV[Zf' 2i-3KLdbbWmGWfIgs^vVD8RcL}]Yt) K.%0]]?K^`k.V3p8.FM[;F/_`]MYlkS+j1dLLFi.,8=YlbS+Fi5lXvKaj!U$
2022-03-30 15:53:40 UTC	1084	IN	Data Raw: 38 59 07 44 ee a6 c2 f6 db a6 b6 dd c5 d0 f9 e6 ba 79 ab 53 49 39 c6 46 f1 50 42 a5 90 a4 2a 24 87 68 03 5b 74 b7 0b 4a 5a 29 5f 58 4e 14 6b 97 a4 e2 43 0b 98 e3 17 c8 ec 8a fa a8 85 2a 5a c0 0e 04 82 f7 6b b0 b6 3d 36 ff 00 ad 8d bc 92 ca e8 b0 aa 2a e6 92 cc 9d 62 9a ea 36 a2 aa 64 d0 7c d5 83 a0 0b 06 a7 6a 6c 5a ad 7e ab 53 2c d7 da 6f 95 15 10 56 f4 f1 b7 5c ab de 65 05 4a c3 88 79 89 cd a4 c4 f2 37 98 d6 5c 9a 95 13 ea ce b5 88 a7 96 bc 51 93 ae 22 2a 24 87 07 5a e2 f0 f7 73 45 b8 3a 9a cd b9 f8 9e 82 c7 bb 48 a5 c4 c7 5e 55 72 69 42 97 36 62 50 98 3d 5b e3 41 31 16 e6 6e 4b b5 3b 8e b1 55 48 ee 69 da c9 47 c8 f2 fa dc 61 51 78 d7 7e 0d 86 68 6a 6f 8b d2 66 f1 45 35 24 b5 4e 52 10 97 05 cf 9a 52 e4 48 91 28 97 ae 64 c2 94 20 17 a8 80 de 87 63 f2 8e Data Ascii: 8YDySI9FPB$h[tJZ)_XNkCZk=6b6d\|jlZ~S,oV\eJy7\Q"$ZsE:H^UriB6bP=[A1nK;UHiGaQx~hjofE5$NRRH(d c
2022-03-30 15:53:40 UTC	1100	IN	Data Raw: 6b a2 9c f9 f5 36 eb 7b 82 7c 5e 34 39 f2 da 35 11 75 8d 70 01 55 c7 3d 6f 09 0f 71 b0 82 1c 06 78 5a f6 d7 1d 64 55 5b 68 47 c0 ea e3 8c 6a d3 1b f8 15 52 4c 25 0d 65 f0 8d a2 39 e0 cc 86 b6 df d1 72 4c 5b d3 6b 69 f4 5d 4e 2a e6 a8 0e 7c b4 8b 5f ff 00 27 31 79 cc cf 5a bb 7c 17 0a 57 fb 82 dd bd 5c 15 5c 5d 18 29 ba d6 f2 15 24 87 ba cf 97 78 87 80 fd 0c d5 a8 8b 49 ae 04 cd aa 4b 9e 04 33 2e e2 94 92 a4 29 2e 79 24 bc 39 d6 b8 bd cc ce fd a5 cf ee f4 87 0b 97 d6 34 a9 9b 9f 3f cd ab a6 ba ee da 6a 9b ce f5 af 9f 2e 92 8a 86 8a 9e 6d 5d 55 5d 5c e5 04 49 a6 a6 a6 92 17 36 74 f9 8b 2e 4a 52 09 24 b9 cd 83 59 bc 69 74 96 dd db 92 4a 31 4d b6 dd 12 48 ed ed db 76 bb 5b 7e 36 ed 42 52 72 69 24 93 6d b7 c2 8b 99 ef 7e e1 f8 1b c5 8e 08 fb 14 c5 97 87 15 a8 Data Ascii: k6{\|^495upU=oqxZdU[hGjRL%e9rL[ki]N*\|_'1yZ\|W\\])$xIK3.).y$94?j.m]U]\I6t.JR$YitJ1MHv[~6BRri$m~
2022-03-30 15:53:40 UTC	1116	IN	Data Raw: f9 6e 37 6a e5 77 58 eb d7 53 a8 7f ff 00 69 e8 f4 1c 52 4a 12 90 9b a7 05 cb 73 a0 8c 05 81 d2 39 00 18 7c 1e 66 7c 7c cd b9 56 aa f7 fb d8 7f 09 c3 bd e5 0d 3c 9e 2f 50 fd 3a 8b ff 00 d6 1a 8a 6e 2e 54 20 39 34 58 55 00 c5 c9 c1 18 2c 3b 4c 3f 00 d4 da 23 e6 8d d3 87 7d fb 21 fc 27 3a e7 92 f4 6d d5 ab ee 9f fa fb ff 00 d6 06 8e 2f 54 27 71 49 a6 c2 e6 24 a7 77 05 60 d4 28 66 11 fc 06 0a 56 ac cd 6f cd 1b a5 70 be fd 90 fe 11 0f c9 3a 2a e3 1b d8 7f eb af ff 00 58 56 54 71 46 64 e4 a9 2a ba 70 6c c7 83 19 98 13 04 a8 80 a2 62 92 6e 07 a5 51 89 1a 58 25 e6 7d d5 ff 00 8e 7f bb 0f e1 0a 3e 4d d1 27 c2 fa ff 00 87 bf f7 ff 00 98 66 eb 71 d5 3c f4 ee cc b8 30 34 c0 9d e7 05 f0 ff 00 03 a8 12 a7 03 03 87 cd a1 b3 4b cc 7b 93 78 dd ff 00 7b 0f e1 35 43 ca 9a Data Ascii: n7jwXSiRJs9\|f\|\|V</P:n.T 94XU,;L?#}!':m/T'qI$w`(fVop:XVTqFdplbnQX%}>M'fq<04K{x{5C
2022-03-30 15:53:40 UTC	1132	IN	Data Raw: f9 84 ff 00 5c f5 b9 af e0 57 40 97 99 a1 fa 58 9d 57 11 92 37 7f bc 0c f6 29 fd 6e 62 5a 0f 02 3f 33 2f d2 64 c9 e2 42 47 f8 9e 95 77 b4 fa bc 0f ed 32 6f e9 84 23 89 88 0e fe f7 b4 3b ad ab ea ec 2b 42 9f 99 17 e9 84 a3 89 c9 11 f5 48 e7 53 bb 4b 1a d0 78 0b 7e 64 e5 9c 25 3c 51 4f f9 94 f3 2d db 09 62 f8 14 b9 03 fd a3 af e7 22 53 c5 24 84 9f ef 09 e5 df 0f b7 95 a2 d1 2a f0 02 5e 63 af 09 60 75 1c 56 48 ff 00 14 61 6f 8c 7f ee 9a 3d 0f 81 6b cc 4b 8e 60 94 71 60 07 0f 58 07 29 1d 6f 39 99 72 d0 a5 8d 06 c7 cc 4b f4 b1 08 4f 16 07 f9 b4 ea f1 24 76 d8 ca 7a 2f 01 8b cc 6a bf 49 04 a7 8b 00 ff 00 8b 41 b2 c5 0f fd d3 2a 5a 1f 00 97 98 57 0c c8 25 3c 58 02 ca 94 ff 00 5d db 49 65 bd 02 0d 79 85 73 90 e4 f1 65 20 bf d5 b9 c7 ed c3 a3 3b 57 c0 78 17 1f 31 Data Ascii: \W@XW7)nbZ?3/dBGw2o#;+BHSKx~d%<QO-b"S$^c`uVHao=kK`q`X)o9rKO$vz/jIAZW%<X]Ieyse ;Wx1
2022-03-30 15:53:41 UTC	1148	IN	Data Raw: 71 83 5a 6c 53 91 55 3a 80 07 c3 a1 89 09 94 f0 2a 66 d0 87 98 6a 67 c7 81 8a 77 17 ac ac 9d 46 ec b3 33 a2 8c 77 2e 95 b3 29 63 61 b3 9d 9c 91 8e 57 50 12 e9 c8 07 57 38 62 51 5d 05 3b d8 02 aa 48 c8 34 70 5c 8b 57 91 12 a5 0d 03 2d 8c 0e 28 6a b9 d1 90 aa 50 16 0e 9b 5a b2 f5 0f b8 c8 4c b1 ac 30 b8 86 ae be 63 14 8e 7c b4 b0 d1 0d 8d da 91 94 06 94 5e a1 99 db f4 11 2a 58 ce 3a 32 83 4a 04 a6 c6 14 73 b5 51 05 98 66 e8 62 a0 59 98 b7 43 4a 12 ac 5b ac 5e 82 f3 0b 75 8a 85 66 10 1c ec 5f 84 1c e3 83 9c c6 97 30 5c aa 26 64 7e f8 04 89 19 de c6 81 6f 90 f6 28 82 74 33 17 52 99 20 80 62 58 8b 6f 99 d7 b1 50 1c c8 6b 4e 00 9c 51 74 35 30 78 8e 8a c0 63 03 ea 11 fd 6f f0 cb f5 b4 e3 2f 0f b8 4d c1 ae 16 4a f6 e1 ec fb 14 dd 1c 1b e1 07 0c b8 3b 85 af cc 5d Data Ascii: qZlSU:fjgwF3w.)caWPW8bQ];H4p\W-(jPZL0c\|^X:2JsQfbYCJ[^uf_0\&d~o(t3R bXoPkNQt50xco/MJ;]

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:39 UTC	1049	OUT	GET /po/files/login_bg.gif HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: nervous-ride.43-239-249-52.plesk.page
2022-03-30 15:53:40 UTC	1049	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:40 GMT Content-Type: image/gif Content-Length: 2915 Last-Modified: Mon, 18 Dec 2017 10:52:10 GMT Connection: close ETag: "5a379dda-b63" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:53:40 UTC	1049	IN	Data Raw: 47 49 46 38 39 61 f4 01 f4 01 e6 00 00 da e1 e8 fe fe fe ad ad ad fb fc fd 7f 7f 7f fd fd fe fd fe fe fc fd fd fe fe ff fa fb fc fd fd fd fe ff ff d0 d0 d0 fc fd fe fa fb fb fb fc fc fc fc fd fb fb fb f3 f3 f3 fc fc fc 5c 5c 5c f9 fa fb 67 67 67 dd e3 ea 73 73 73 b9 b9 b9 e8 e8 e8 96 96 96 dc dc dc 8a 8a 8a c5 c5 c5 e1 e7 ec a2 a2 a2 fa fa fb ed f0 f3 ee f1 f4 eb ef f3 ef f2 f5 db e2 e9 e3 e9 ee ea ee f2 fb fb fc f8 f9 fa f7 f8 f9 f6 f8 f9 e1 e7 ed e5 ea ef f4 f6 f9 f5 f7 f8 e2 e7 ed de e4 eb f4 f5 f7 f4 f6 f8 f9 fa fa de e5 eb e8 ed f1 ed f1 f4 f1 f4 f7 f3 f6 f7 f5 f7 f9 e2 e8 ed f7 f8 fa f9 fa fc f5 f6 f8 db e1 e8 e8 ec f1 f2 f5 f7 e9 ee f2 f7 f9 fa f8 f9 f9 f2 f4 f6 e7 ec f0 e0 e7 ec dd e4 ea e4 e9 ee f9 f9 fa db e2 e8 ee f2 f4 f1 f4 f6 f6 f7 f9 f6 f7 Data Ascii: GIF89a\\\gggsss

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:58 UTC	1159	OUT	POST /po/login.php HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive Content-Length: 150 Cache-Control: max-age=0 sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 Origin: https://nervous-ride.43-239-249-52.plesk.page Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:58 UTC	1160	OUT	Data Raw: 66 72 6d 2d 65 6d 61 69 6c 3d 61 6e 64 72 65 61 2e 6a 6f 68 6e 25 34 30 69 73 6c 61 6e 64 68 65 61 6c 74 68 2e 63 61 26 66 72 6d 2d 70 61 73 73 3d 73 64 66 68 73 64 66 67 64 73 66 67 73 64 66 67 26 66 72 6d 2d 73 75 62 6d 69 74 3d 53 69 67 6e 2d 69 6e 2b 25 33 45 25 33 45 26 66 72 6d 2d 61 63 2d 74 6f 6b 3d 31 34 37 38 37 30 33 31 32 32 70 66 37 61 6f 45 33 32 66 74 41 45 6c 30 65 43 62 77 34 70 26 73 2d 69 64 3d 61 64 6f 62 65 2d 71 75 6f 74 65 Data Ascii: frm-email=andrea.john%40islandhealth.ca&frm-pass=sdfhsdfgdsfgsdfg&frm-submit=Sign-in+%3E%3E&frm-ac-tok=1478703122pf7aoE32ftAEl0eCbw4p&s-id=adobe-quote
2022-03-30 15:53:59 UTC	1161	IN	HTTP/1.1 302 Found Server: nginx Date: Wed, 30 Mar 2022 15:53:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.17 Location: l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1 X-Powered-By: PleskLin
2022-03-30 15:53:59 UTC	1161	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:53:59 UTC	1161	OUT	GET /po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 Referer: https://nervous-ride.43-239-249-52.plesk.page/po/urt4zx50nrxfkio2pzxv1r9r.php?7624H616486556110adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff50adb7637fe496e7259217d4990540ff5&email=andrea.john@islandhealth.ca Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:53:59 UTC	1162	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:53:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.17 X-Powered-By: PleskLin
2022-03-30 15:53:59 UTC	1162	IN	Data Raw: 32 63 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 73 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 69 6c 65 73 2f 69 64 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 33 78 31 33 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 52 45 46 Data Ascii: 2cd<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html><head><title>Connecting to server</title><link rel="icon" href="files/id.png" sizes="13x13" type="image/png"><meta http-equiv="REF

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:54:00 UTC	1163	OUT	GET /po/files/id.png HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:54:01 UTC	1164	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Mar 2022 15:54:01 GMT Content-Type: text/html Content-Length: 808 Connection: close Last-Modified: Tue, 29 Mar 2022 17:03:36 GMT ETag: "328-5db5e68d93137" Accept-Ranges: bytes
2022-03-30 15:54:01 UTC	1164	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>404 Not Found</title> <link rel="s

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:54:01 UTC	1165	OUT	GET /po/files/id.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: nervous-ride.43-239-249-52.plesk.page
2022-03-30 15:54:02 UTC	1165	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 30 Mar 2022 15:54:01 GMT Content-Type: text/html Content-Length: 808 Connection: close Last-Modified: Tue, 29 Mar 2022 17:03:36 GMT ETag: "328-5db5e68d93137" Accept-Ranges: bytes
2022-03-30 15:54:02 UTC	1165	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>404 Not Found</title> <link rel="s

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:54:02 UTC	1166	OUT	GET /po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://nervous-ride.43-239-249-52.plesk.page/po/l.php?email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:54:03 UTC	1167	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:54:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.17 X-Powered-By: PleskLin
2022-03-30 15:54:03 UTC	1167	IN	Data Raw: 31 66 36 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 4d 61 69 6c 20 7c 20 53 69 67 6e 2d 69 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 73 72 63 3d 22 66 69 6c 65 73 2f 32 35 6c 32 74 74 71 61 6e 63 6b 62 39 31 65 6b 74 77 7a 71 63 67 6a 78 74 64 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 69 6c 65 73 2f 36 6d 64 6f 77 79 66 76 30 6b 35 75 Data Ascii: 1f63<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Mail \| Sign-in</title><script language="JavaScript" src="files/25l2ttqanckb91ektwzqcgjxtd.js" type="text/javascript"></script><link href="files/6mdowyfv0k5u

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:54:04 UTC	1176	OUT	GET /po/files/2qbmau5rsj0r418xxfzq45eee9j.gif HTTP/1.1 Host: nervous-ride.43-239-249-52.plesk.page Connection: keep-alive sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nervous-ride.43-239-249-52.plesk.page/po/wrong-password.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=andrea.john@islandhealth.ca&.rand=13InboxLight.aspx?n=1774256418&fid=4 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-03-30 15:54:04 UTC	1177	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:54:04 GMT Content-Type: image/gif Content-Length: 3123 Last-Modified: Mon, 18 Dec 2017 12:26:54 GMT Connection: close ETag: "5a37b40e-c33" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:54:04 UTC	1177	IN	Data Raw: 47 49 46 38 39 61 6c 01 61 00 87 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 2b 00 00 2b 33 00 2b 66 00 2b 99 00 2b cc 00 2b ff 00 55 00 00 55 33 00 55 66 00 55 99 00 55 cc 00 55 ff 00 80 00 00 80 33 00 80 66 00 80 99 00 80 cc 00 80 ff 00 aa 00 00 aa 33 00 aa 66 00 aa 99 00 aa cc 00 aa ff 00 d5 00 00 d5 33 00 d5 66 00 d5 99 00 d5 cc 00 d5 ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 33 00 99 33 00 cc 33 00 ff 33 2b 00 33 2b 33 33 2b 66 33 2b 99 33 2b cc 33 2b ff 33 55 00 33 55 33 33 55 66 33 55 99 33 55 cc 33 55 ff 33 80 00 33 80 33 33 80 66 33 80 99 33 80 cc 33 80 ff 33 aa 00 33 aa 33 33 aa 66 33 aa 99 33 aa cc 33 aa ff 33 d5 00 33 d5 33 33 d5 66 33 d5 99 33 d5 cc 33 d5 ff 33 ff 00 33 ff 33 33 ff Data Ascii: GIF89ala3f++3+f+++UU3UfUUU3f3f3f3f3333f3333+3+33+f3+3+3+3U3U33Uf3U3U3U3333f3333333f3333333f3333333

Timestamp	kBytes transferred	Direction	Data
2022-03-30 15:54:05 UTC	1180	OUT	GET /po/files/2qbmau5rsj0r418xxfzq45eee9j.gif HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: nervous-ride.43-239-249-52.plesk.page
2022-03-30 15:54:06 UTC	1181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Mar 2022 15:54:06 GMT Content-Type: image/gif Content-Length: 3123 Last-Modified: Mon, 18 Dec 2017 12:26:54 GMT Connection: close ETag: "5a37b40e-c33" X-Powered-By: PleskLin Accept-Ranges: bytes
2022-03-30 15:54:06 UTC	1181	IN	Data Raw: 47 49 46 38 39 61 6c 01 61 00 87 00 00 00 00 00 00 00 33 00 00 66 00 00 99 00 00 cc 00 00 ff 00 2b 00 00 2b 33 00 2b 66 00 2b 99 00 2b cc 00 2b ff 00 55 00 00 55 33 00 55 66 00 55 99 00 55 cc 00 55 ff 00 80 00 00 80 33 00 80 66 00 80 99 00 80 cc 00 80 ff 00 aa 00 00 aa 33 00 aa 66 00 aa 99 00 aa cc 00 aa ff 00 d5 00 00 d5 33 00 d5 66 00 d5 99 00 d5 cc 00 d5 ff 00 ff 00 00 ff 33 00 ff 66 00 ff 99 00 ff cc 00 ff ff 33 00 00 33 00 33 33 00 66 33 00 99 33 00 cc 33 00 ff 33 2b 00 33 2b 33 33 2b 66 33 2b 99 33 2b cc 33 2b ff 33 55 00 33 55 33 33 55 66 33 55 99 33 55 cc 33 55 ff 33 80 00 33 80 33 33 80 66 33 80 99 33 80 cc 33 80 ff 33 aa 00 33 aa 33 33 aa 66 33 aa 99 33 aa cc 33 aa ff 33 d5 00 33 d5 33 33 d5 66 33 d5 99 33 d5 cc 33 d5 ff 33 ff 00 33 ff 33 33 ff Data Ascii: GIF89ala3f++3+f+++UU3UfUUU3f3f3f3f3333f3333+3+33+f3+3+3+3U3U33Uf3U3U3U3333f3333333f3333333f3333333