Create Interactive Tour

Windows Analysis Report
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com

Overview

General Information

Sample URL:	https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com
Analysis ID:	642518
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4460 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,11442245268399047705,5675396249055895647,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

HTTPS traffic detected: 142.250.203.100:443 -> 192.168.2.5:49765 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\1e347051-1b61-44c0-a3f1-a6b0af66dfed.tmp

Jump to behavior

Source: classification engine

Classification label: mal56.win@25/86@8/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,11442245268399047705,5675396249055895647,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,11442245268399047705,5675396249055895647,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62A274CE-116C.pma

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label	Link
https://dns.google	0%	URL Reputation	safe
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell	100%	Avira URL Cloud	malware

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	172.217.168.3	true	false	high
accounts.google.com	172.217.168.45	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
www.google.com	142.250.203.100	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
f.xdref.com	72.29.121.220	true	false	unknown
abuell.myafricawealth.co.za	160.119.248.129	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/fonts/glyphicons-halflings-regular.woff2	false	high
https://www.google.com/recaptcha/api2/payload?p=06AGdBq278HIlcPEe1V0oE22VDhO6bITlTd1VEYnr-Wfv4IAMkXA5CXojhNywrFzmkMPg9PNS2UTq39_pU0WTviljSsrMOauAWULcB9gwrpCnO4TxoiM5oQiGshRhWlR0GTLDI7zi8HNZfuxM6sUFlHTneLkdl4C727PEwOdo6eHGFoECw1tA2HdZUw2JfHjwf8L3pytIHKXFL&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
http://abuell.myafricawealth.co.za/a9bc224bd710f56d27affffddc764239b58c3faa0/shield.png	false	high
http://abuell.myafricawealth.co.za/?id=abuell@carollo.com	false	high
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css	false	high
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com	true	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js	false	high
https://www.google.com/recaptcha/api.js?hl=en	false	high
http://abuell.myafricawealth.co.za/?id=abuell@carollo.com	false	high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S&co=aHR0cDovL2FidWVsbC5teWFmcmljYXdlYWx0aC5jby56YTo4MA..&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=qnzglyzhopme	false	high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr, 9a493237-2958-47c0-9ef8-347859b6f861.tmp.3.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_background.js.1.dr, craw_window.js.1.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.1.dr	false		high
https://ogs.google.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.1.dr	false		high
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell	History Provider Cache.1.dr	true	Avira URL Cloud: malware	unknown
https://payments.google.com/payments/v4/js/integrator.js	manifest.json.1.dr, craw_window.js.1.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	manifest.json.1.dr, craw_window.js.1.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.1.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.1.dr	false		high
https://www.google.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.1.dr	false		high
http://abuell.myafricawealth.co.za/?id=abuell	History Provider Cache.1.dr	false		high
https://accounts.google.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
https://clients2.googleusercontent.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
https://apis.google.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
http://abuell.myafricawealth.co.za?id=abuell	History Provider Cache.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.1.dr	false		high
https://www.google.com/	manifest.json.1.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_background.js.1.dr, craw_window.js.1.dr	false		high
https://clients2.google.com	1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
160.119.248.129	abuell.myafricawealth.co.za	South Africa	37153	xneeloZA	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
142.250.203.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.3	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
72.29.121.220	f.xdref.com	United States	36024	AS-TIERP-36024US	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	642518
Start date and time: 09/06/202215:30:31	2022-06-09 15:30:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@25/86@8/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.168.14, 142.250.203.99, 173.194.187.10, 74.125.162.40, 172.217.168.10, 142.250.203.106, 216.58.215.234
Excluded domains from analysis (whitelisted): r3.sn-4g5lznek.gvt1.com, fonts.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, ajax.googleapis.com, fonts.gstatic.com, r5.sn-4g5e6ns6.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, redirector.gvt1.com, r5---sn-4g5e6ns6.gvt1.com, www.gstatic.com, r3---sn-4g5lznek.gvt1.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Source: https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com	Sample URL: PII: abuell@carollo.com&to
Source: https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com	Sample URL: PII: rmorling@datateam.co.uk&url
Source: https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com	Sample URL: PII: abuell@carollo.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: global traffic	HTTP traffic detected: GET /?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com HTTP/1.1Host: f.xdref.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.6/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: http://abuell.myafricawealth.co.zaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?hl=en HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S&co=aHR0cDovL2FidWVsbC5teWFmcmljYXdlYWx0aC5jby56YTo4MA..&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=qnzglyzhopmeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-aliveOrigin: https://www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S&co=aHR0cDovL2FidWVsbC5teWFmcmljYXdlYWx0aC5jby56YTo4MA..&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=qnzglyzhopmeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.6/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: http://abuell.myafricawealth.co.zaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AGdBq278HIlcPEe1V0oE22VDhO6bITlTd1VEYnr-Wfv4IAMkXA5CXojhNywrFzmkMPg9PNS2UTq39_pU0WTviljSsrMOauAWULcB9gwrpCnO4TxoiM5oQiGshRhWlR0GTLDI7zi8HNZfuxM6sUFlHTneLkdl4C727PEwOdo6eHGFoECw1tA2HdZUw2JfHjwf8L3pytIHKXFL&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /?id=abuell@carollo.com HTTP/1.1Host: abuell.myafricawealth.co.zaConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a9bc224bd710f56d27affffddc764239b58c3faa0/shield.png HTTP/1.1Host: abuell.myafricawealth.co.zaConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Referer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.comAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: cl-bypass-cache=yes
Source: global traffic	HTTP traffic detected: GET /a9bc224bd710f56d27affffddc764239b58c3faa0/shield.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: abuell.myafricawealth.co.za

Source: History Provider Cache.1.dr	String found in binary or memory: http://abuell.myafricawealth.co.za/?id=abuell
Source: History Provider Cache.1.dr	String found in binary or memory: http://abuell.myafricawealth.co.za?id=abuell
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.1.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://apis.google.com
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr, 9a493237-2958-47c0-9ef8-347859b6f861.tmp.3.dr	String found in binary or memory: https://dns.google
Source: History Provider Cache.1.dr	String found in binary or memory: https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://ogs.google.com
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.1.dr, craw_window.js.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.1.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.1.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr, craw_background.js.1.dr, craw_window.js.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp.3.dr	String found in binary or memory: https://www.gstatic.com

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 9, 2022 15:31:46.571635962 CEST	61356	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:46.629848003 CEST	53	61356	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:46.849159956 CEST	57278	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:46.859194994 CEST	53757	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:46.876919031 CEST	53	57278	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:46.878568888 CEST	53	53757	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:49.299926043 CEST	63187	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:49.491765022 CEST	53	63187	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:50.158332109 CEST	60658	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:50.179553032 CEST	53	60658	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:50.473079920 CEST	52982	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:31:50.490755081 CEST	53	52982	8.8.8.8	192.168.2.5
Jun 9, 2022 15:31:51.232206106 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.264820099 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.267263889 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.296367884 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.296416044 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.296439886 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.296462059 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.298335075 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.300348043 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.368623972 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.384810925 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.410723925 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.413301945 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.427381039 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.440861940 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.440900087 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.440923929 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.440948009 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.440965891 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.441761017 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.441884041 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.449218035 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449254990 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449280977 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449306011 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449330091 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449353933 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.449372053 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.454206944 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.454248905 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.456366062 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.456398964 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.456423998 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.456449986 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.458170891 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.458210945 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.458234072 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.464517117 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465179920 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465311050 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465384007 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465467930 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465574026 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465660095 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.465742111 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:51.515954018 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:51.523313999 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:52.747212887 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:52.783031940 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:52.783107042 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:52.783139944 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:52.783812046 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:52.809129953 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.028019905 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.068418980 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.068454027 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.068468094 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.071017981 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.101182938 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.764786005 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.764902115 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.764945030 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.764986038 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.765019894 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.765057087 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.782452106 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.837644100 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.838020086 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.838059902 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.838090897 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.838113070 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.838742018 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.838809013 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.839037895 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839072943 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839102030 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839131117 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839160919 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839190006 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.839212894 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.840337038 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.840409040 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.840493917 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.840588093 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.840827942 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.840863943 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.841666937 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.842031956 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.842060089 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.842493057 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.843533039 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.843554974 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.843574047 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.843592882 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.843801975 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.844553947 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:53.845902920 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:53.871404886 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.175512075 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.176651001 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.207648039 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.207686901 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.207706928 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.211406946 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.212352037 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.212388039 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.212404966 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.212416887 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.214920998 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.214942932 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.214962959 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.214978933 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.214997053 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.215013027 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.215024948 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.221844912 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.221892118 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.221910000 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.221929073 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.223830938 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.223851919 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.223872900 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.223889112 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.224540949 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.225981951 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.226026058 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.226043940 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.226061106 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.226975918 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227102995 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227220058 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227338076 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227464914 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227582932 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227691889 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227834940 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.227953911 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.228080034 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.228199959 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.228317022 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.228458881 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.231622934 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.231652021 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.231669903 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.231688023 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.233839989 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.233867884 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:31:54.252672911 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.252830029 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.252978086 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.253221989 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.256853104 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.274852037 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.275242090 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.279093027 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:31:54.304970980 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306051970 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306073904 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306091070 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306108952 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306129932 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306147099 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306165934 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306184053 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306202888 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306220055 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.306238890 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.308805943 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.308823109 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.335685968 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336251974 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336349964 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336441040 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336539030 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336627007 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.336747885 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.372905970 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.973553896 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:54.993128061 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993160963 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993187904 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993211985 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993233919 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993257046 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993279934 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993303061 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993330002 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:54.993355036 CEST	443	63542	172.217.168.3	192.168.2.5
Jun 9, 2022 15:31:55.002883911 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:55.003002882 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:55.003103971 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:55.003199100 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:55.003299952 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:31:56.115120888 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.146436930 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.147568941 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.179660082 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.179708004 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.179740906 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.179773092 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.244879961 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.244920015 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.244937897 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.244957924 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.305063963 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.305116892 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.305150032 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.305183887 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.425702095 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.425754070 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.425781012 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.425833941 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.560111046 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.579930067 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.579971075 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.588474035 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590082884 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590306997 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590415001 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590507984 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590610981 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590698957 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590800047 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.590908051 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.591639042 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.632514954 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.634809017 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.649626017 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.649666071 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.649682999 CEST	443	57811	142.250.203.110	192.168.2.5
Jun 9, 2022 15:31:56.752345085 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.752583027 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:31:56.968755960 CEST	57811	443	192.168.2.5	142.250.203.110
Jun 9, 2022 15:32:00.779268980 CEST	52333	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:32:00.801084995 CEST	53	52333	8.8.8.8	192.168.2.5
Jun 9, 2022 15:32:00.962560892 CEST	49407	53	192.168.2.5	8.8.8.8
Jun 9, 2022 15:32:00.981313944 CEST	53	49407	8.8.8.8	192.168.2.5
Jun 9, 2022 15:32:09.200144053 CEST	61942	443	192.168.2.5	142.250.203.100
Jun 9, 2022 15:32:09.242364883 CEST	443	61942	142.250.203.100	192.168.2.5
Jun 9, 2022 15:32:09.277120113 CEST	63542	443	192.168.2.5	172.217.168.3
Jun 9, 2022 15:32:09.319287062 CEST	443	63542	172.217.168.3	192.168.2.5

Timestamp	kBytes transferred	Direction	Data
Jun 9, 2022 15:31:49.754678011 CEST	883	OUT	GET /?id=abuell@carollo.com HTTP/1.1 Host: abuell.myafricawealth.co.za Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jun 9, 2022 15:31:49.955425978 CEST	884	IN	HTTP/1.1 200 OK Date: Thu, 09 Jun 2022 13:31:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: cl-bypass-cache=yes; Expires=Thu, 09-Jun-22 14:31:49 GMT; Domain=abuell.myafricawealth.co.za; Path=/; HttpOnly; SameSite=Lax Server: imunify360-webshield/1.18 Last-Modified: Thursday, 09-Jun-2022 13:31:49 GMT Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 cf-edge-cache: no-cache Expires: Thu, 01 Jan 1970 00:00:01 GMT Data Raw: 35 31 30 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 61 70 74 63 68 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 0a 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 36 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 0a 20 20 20 20 20 20 20 20 20 20 69 6e 74 65 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 31 71 38 6d 54 4a 4f 41 53 78 38 6a 31 41 75 2b 61 35 57 44 56 6e 50 69 32 6c 6b 46 66 77 77 45 41 61 38 68 44 44 64 6a 5a 6c 70 4c 65 67 78 68 6a 56 4d 45 31 66 67 6a 57 50 47 6d 6b 7a 73 37 22 0a 20 20 20 20 20 20 20 20 20 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 41 41 41 41 41 51 45 41 59 41 41 41 42 50 59 79 4d 69 41 41 41 41 42 6d 4a 4c 52 30 54 2f 2f 2f 2f 2f 2f 2f 38 4a 57 50 66 63 41 41 41 41 43 58 42 49 57 58 4d 41 41 41 42 49 41 41 41 41 53 41 42 47 79 57 73 2b 41 41 41 41 46 30 6c 45 51 56 52 49 78 32 4e 67 47 41 57 6a 59 42 53 4d 67 6c 45 77 43 6b 62 42 53 41 63 41 43 42 41 41 41 65 61 52 39 63 49 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 3d 22 0a 20 20 20 20 20 20 20 20 20 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 22 0a 20 20 20 20 20 20 20 20 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 32 2e 34 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 Data Ascii: 5102<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Captcha</title> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous"> <link href="data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=" rel="icon" type="image/x-icon"/> <link href="https://fonts.googleapis.com/css?family=Noto+Sans" rel="stylesheet"> <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script> <script src="https://maxcdn.bootstrap
Jun 9, 2022 15:31:49.955466032 CEST	886	IN	Data Raw: 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 Data Ascii: cdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> <script src="https://www.google.com/recaptcha/api.js?hl=en" async defer> </script> <style> html, body { height: 100%; } .wra
Jun 9, 2022 15:31:49.955495119 CEST	887	IN	Data Raw: 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6c 6f 67 6f 5f 73 68 69 65 6c 64 20 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 Data Ascii: display: inline-block; } .logo_shield img { width: 54px; height: 72px; } .cap_side { width: 295px; } h4#text { font-size: 20px;
Jun 9, 2022 15:31:49.955517054 CEST	889	IN	Data Raw: 2e 72 65 2d 63 61 70 74 63 68 61 2d 77 72 61 70 70 65 72 20 7b 20 2f 2a 20 73 68 69 66 74 20 72 65 43 41 50 54 43 48 41 20 62 65 6c 6f 77 20 6f 75 72 20 74 65 78 74 20 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 70 3a 20 33 35 30 70 78 20 Data Ascii: .re-captcha-wrapper { /* shift reCAPTCHA below our text / top: 350px !important; } .invisible_mode .re-captcha-wrapper > div:first-child { / hide reCAPTCHA mask */ display: none !important; }
Jun 9, 2022 15:31:49.958069086 CEST	890	IN	Data Raw: 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d Data Ascii: rotate(360deg); transform: rotate(360deg); } } </style>...This whole tempalte goes to inside <head></head> tagsModify this file to add javascript or css files for your page from customize/static fol
Jun 9, 2022 15:31:49.958132982 CEST	891	IN	Data Raw: 77 6e 20 7b 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 20 20 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e Data Ascii: wn { position: absolute; top: 10px; right: 0; } .dropdown .dropdown-toggle { background-color: #fff; border: none; outline: none; color: #858585; font-size: 13px;
Jun 9, 2022 15:31:49.958158016 CEST	893	IN	Data Raw: 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 72 6f 70 64 6f 77 6e 20 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 20 3e 20 6c 69 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 Data Ascii: ; } .dropdown .dropdown-menu-content > li:hover { cursor: pointer; } .dropdown .dropdown-menu-container { max-height: 365px; overflow: hidden; width: 164px; padding: 0; border:
Jun 9, 2022 15:31:49.958179951 CEST	894	IN	Data Raw: 20 27 74 72 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 49 6e 64 6f 6e 65 73 69 61 6e 3a 20 27 69 64 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 50 6f 72 74 75 67 75 65 73 65 3a 20 27 70 74 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 48 65 62 Data Ascii: 'tr', Indonesian: 'id', Portuguese: 'pt', Hebrew: 'he', German: 'de', Malay: 'ms', Norwegian: 'no', Farsi: 'fa', }; var currentLocale = $('htm
Jun 9, 2022 15:31:49.958204031 CEST	895	IN	Data Raw: 74 72 28 31 29 2e 73 70 6c 69 74 28 27 26 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6b 76 70 20 3d 3d 20 27 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 Data Ascii: tr(1).split('&'); if (kvp == '') { document.location.search = '?' + key + '=' + value; } else { var i = kvp.length; var x; while (i--) {
Jun 9, 2022 15:31:49.958234072 CEST	897	IN	Data Raw: 20 20 20 20 20 20 20 20 57 65 20 68 61 76 65 20 6e 6f 74 69 63 65 64 20 61 6e 20 75 6e 75 73 75 61 6c 20 61 63 74 69 76 69 74 79 20 66 72 6f 6d 20 79 6f 75 72 20 3c 62 3e 49 50 20 38 34 2e 31 37 2e 35 32 2e 31 33 3c 2f 62 3e 20 61 6e 64 20 62 6c Data Ascii: We have noticed an unusual activity from your <b>IP 84.17.52.13</b> and blocked access to this website. </p> <p class="cap_mess cap_text text-center"> <b>Please confirm that you are not a robot<
Jun 9, 2022 15:31:50.152748108 CEST	898	IN	Data Raw: 38 32 31 39 35 20 32 34 2e 32 33 31 39 33 39 2c 30 2e 31 35 38 38 38 32 39 32 37 20 43 32 35 2e 31 39 30 32 38 30 35 2c 32 2e 32 32 34 35 39 30 32 34 20 32 35 2e 38 31 39 30 34 38 38 2c 34 2e 34 33 39 38 39 35 31 32 20 32 36 2e 37 37 36 38 31 37 Data Ascii: 82195 24.231939,0.158882927 C25.1902805,2.22459024 25.8190488,4.43989512 26.7768171,6.47579756 C29.1417195,7.40376098 31.7164024,7.7929439 34.1116829,8.69110244 C28.9623171,11.2663585 23.7229634,13.7510537 18.4836098,16.176139 C19.7709512,12.2

Timestamp	kBytes transferred	Direction	Data
Jun 9, 2022 15:31:50.476072073 CEST	1206	OUT	GET /a9bc224bd710f56d27affffddc764239b58c3faa0/shield.png HTTP/1.1 Host: abuell.myafricawealth.co.za Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8 Referer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.com Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: cl-bypass-cache=yes
Jun 9, 2022 15:31:50.690783978 CEST	1220	IN	HTTP/1.1 200 OK Date: Thu, 09 Jun 2022 13:31:50 GMT Content-Type: image/png Content-Length: 4027 Last-Modified: Thu, 02 Jun 2022 16:41:12 GMT Connection: close ETag: "6298e828-fbb" Server: imunify360-webshield/1.18 Accept-Ranges: bytes
Jun 9, 2022 15:31:50.690917969 CEST	1222	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4d 00 00 00 66 08 06 00 00 00 8e 62 1c 45 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0f 75 49 44 41 54 78 01 ed 5d 0b 74 14 d5 19 fe ef cc 66 f3 86 c8 3b 80 02 72 50 21 2a 04 d1 1e 8b 55 Data Ascii: PNGIHDRMfbEsRGBuIDATx]tf;rP!Uc}T=hUXH#PZ,XED#D<Bx$;dfv7wvgwC{syJ<yk+rN)xd_/>`]Y]Oo
Jun 9, 2022 15:31:50.690943956 CEST	1223	IN	Data Raw: a8 27 a1 7f 6a 6f 0d 97 03 75 47 e1 77 df bc 09 b8 cf ac a5 45 12 e8 74 a0 fd 1a c7 b0 e1 19 43 34 4c 4e b9 6b a1 b8 6c 29 34 49 a1 5f 48 6b 95 42 04 3a 15 68 93 86 dd 0f 63 fb 8e d2 44 be d0 d2 00 f3 cb 96 c0 d9 e6 f3 5a 9a 1d 81 4e 03 da dd 03 Data Ascii: 'jouGwEtC4LNkl)4I_HkB:hcDZNs4L<^c'41FW_mps64} <w 2]>-UQ;zK~XEt(7i.$&jr;d\|Sp/X(b$%+/+$$E@R
Jun 9, 2022 15:31:50.690968037 CEST	1224	IN	Data Raw: 70 f1 6d d1 0f 34 ca c0 9d 25 3f 54 7d 0b 07 86 85 a3 4e 60 f8 2d e5 c5 e4 88 5f e2 9b d7 19 e1 d1 0e b4 54 96 b4 9a b6 e4 78 89 3a 76 f1 7d ee c7 4b 2f da e5 ac f0 4b 38 10 1e 81 3c b5 03 cd e5 9a 49 db df ed 0a 06 56 54 e3 0c 17 f1 f4 d9 f3 c5 Data Ascii: pm4%?T}N`-_Tx:v}K/K8<IVTO[_vQCpJW48JQ8MHD?w+PQ9CV~{%Ff#;]0mp0J%)1R2M/QE :3Lv\|w\|aC[&aQt
Jun 9, 2022 15:31:50.691008091 CEST	1224	IN	Data Raw: 95 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: IENDB`

Timestamp	kBytes transferred	Direction	Data
Jun 9, 2022 15:32:01.054282904 CEST	1967	OUT	GET /a9bc224bd710f56d27affffddc764239b58c3faa0/shield.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: abuell.myafricawealth.co.za
Jun 9, 2022 15:32:01.276084900 CEST	2029	IN	HTTP/1.1 200 OK Date: Thu, 09 Jun 2022 13:32:01 GMT Content-Type: image/png Content-Length: 4027 Last-Modified: Thu, 02 Jun 2022 16:41:12 GMT Connection: close ETag: "6298e828-fbb" Server: imunify360-webshield/1.18 Accept-Ranges: bytes
Jun 9, 2022 15:32:01.276124954 CEST	2031	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4d 00 00 00 66 08 06 00 00 00 8e 62 1c 45 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0f 75 49 44 41 54 78 01 ed 5d 0b 74 14 d5 19 fe ef cc 66 f3 86 c8 3b 80 02 72 50 21 2a 04 d1 1e 8b 55 Data Ascii: PNGIHDRMfbEsRGBuIDATx]tf;rP!Uc}T=hUXH#PZ,XED#D<Bx$;dfv7wvgwC{syJ<yk+rN)xd_/>`]Y]Oo
Jun 9, 2022 15:32:01.276144028 CEST	2032	IN	Data Raw: a8 27 a1 7f 6a 6f 0d 97 03 75 47 e1 77 df bc 09 b8 cf ac a5 45 12 e8 74 a0 fd 1a c7 b0 e1 19 43 34 4c 4e b9 6b a1 b8 6c 29 34 49 a1 5f 48 6b 95 42 04 3a 15 68 93 86 dd 0f 63 fb 8e d2 44 be d0 d2 00 f3 cb 96 c0 d9 e6 f3 5a 9a 1d 81 4e 03 da dd 03 Data Ascii: 'jouGwEtC4LNkl)4I_HkB:hcDZNs4L<^c'41FW_mps64} <w 2]>-UQ;zK~XEt(7i.$&jr;d\|Sp/X(b$%+/+$$E@R
Jun 9, 2022 15:32:01.276161909 CEST	2033	IN	Data Raw: 70 f1 6d d1 0f 34 ca c0 9d 25 3f 54 7d 0b 07 86 85 a3 4e 60 f8 2d e5 c5 e4 88 5f e2 9b d7 19 e1 d1 0e b4 54 96 b4 9a b6 e4 78 89 3a 76 f1 7d ee c7 4b 2f da e5 ac f0 4b 38 10 1e 81 3c b5 03 cd e5 9a 49 db df ed 0a 06 56 54 e3 0c 17 f1 f4 d9 f3 c5 Data Ascii: pm4%?T}N`-_Tx:v}K/K8<IVTO[_vQCpJW48JQ8MHD?w+PQ9CV~{%Ff#;]0mp0J%)1R2M/QE :3Lv\|w\|aC[&aQt
Jun 9, 2022 15:32:01.276213884 CEST	2033	IN	Data Raw: 95 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: IENDB`

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:48 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:48 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-06-09 13:31:48 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 09 Jun 2022 13:31:48 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-jWpizxZia6WPKrbbBDMfJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-jWpizxZia6WPKrbbBDMfJw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-09 13:31:48 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-06-09 13:31:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:48 UTC	0	OUT	GET /?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com HTTP/1.1 Host: f.xdref.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:49 UTC	5	IN	HTTP/1.1 302 Found Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization Access-Control-Allow-Methods: GET, HEAD, OPTIONS, POST, PUT Cache-Control: max-age=0, private, must-revalidate Content-Length: 0 Content-Type: text/html; charset=UTF-8 Date: Thu, 09 Jun 2022 13:31:48 GMT Location: http://abuell.myafricawealth.co.za?id=abuell@carollo.com Server: Caddy Server: Caddy Server: Apache/2.4.38 (Debian) Set-Cookie: PHPSESSID=37de05e7dc7a89344726acc2eff3ddc0; path=/ Set-Cookie: PHPSESSID=37de05e7dc7a89344726acc2eff3ddc0; path=/ X-Frame-Options: SAMEORIGIN X-Powered-By: PHP/7.4.27 Connection: close

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:48 UTC	1	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:48 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-VqJlOwARTb3w-QszAWYuRg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 09 Jun 2022 13:31:48 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5638 X-Daystart: 23508 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-09 13:31:48 UTC	2	IN	Data Raw: 33 36 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 33 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 33 35 30 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36e<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5638" elapsed_seconds="23508"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-06-09 13:31:48 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-06-09 13:31:48 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:50 UTC	163	OUT	GET /recaptcha/api.js?hl=en HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://abuell.myafricawealth.co.za/?id=abuell@carollo.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:50 UTC	164	IN	HTTP/1.1 200 OK Expires: Thu, 09 Jun 2022 13:31:50 GMT Date: Thu, 09 Jun 2022 13:31:50 GMT Cache-Control: private, max-age=300 Content-Type: text/javascript; charset=UTF-8 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-09 13:31:50 UTC	164	IN	Data Raw: 33 35 32 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 352/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2022-06-09 13:31:50 UTC	165	IN	Data Raw: 61 72 20 65 3d 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 27 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d 27 29 2c 6e 3d 65 26 26 28 65 5b 27 6e 6f 6e 63 65 27 5d 7c 7c 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 29 29 3b 69 66 28 6e 29 7b 70 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 6e 6f 6e 63 65 27 2c 6e 29 3b 7d 76 61 72 20 73 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 70 6f 2c 20 73 29 3b 7d 29 28 29 3b 0d 0a Data Ascii: ar e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();
2022-06-09 13:31:50 UTC	165	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:52 UTC	165	OUT	GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: https://www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S&co=aHR0cDovL2FidWVsbC5teWFmcmljYXdlYWx0aC5jby56YTo4MA..&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=qnzglyzhopme Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:52 UTC	166	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 15344 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 07 Jun 2022 12:53:17 GMT Expires: Wed, 07 Jun 2023 12:53:17 GMT Cache-Control: public, max-age=31536000 Age: 175115 Last-Modified: Mon, 16 Oct 2017 17:32:55 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-06-09 13:31:52 UTC	167	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 3b f0 00 12 00 00 00 00 8b 48 00 00 3b 8d 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 40 1c 83 4a 06 60 00 86 4c 08 54 09 83 3c 11 0c 0a 81 d6 78 81 bf 2e 0b 83 5e 00 12 81 78 01 36 02 24 03 87 36 04 20 05 82 74 07 20 0c 82 49 1b 68 7c 15 6c 9b 86 b3 db 41 00 a9 bf ec 62 36 a2 82 8d 03 12 0c fb d2 a2 28 db a4 a7 c9 fe ff 96 40 65 c8 ba 5d d3 0e e0 2a 3a 0a 8d 2d 97 30 91 cb 72 a8 29 cb c5 68 53 ac 93 68 ef d5 84 e6 4e 86 29 ab 44 d6 8d d2 bd a2 b8 b0 90 d7 a6 84 fa 62 d1 5d fb f2 f0 f0 f9 97 ee 5e 17 ce b3 74 3f f1 6d 7b ea f0 10 1e 22 38 34 86 0f cd 39 cb 9d bd 0b af e2 09 63 dd 08 ed 3f dd 0c 72 33 6f 9f ee 08 8d 7d 92 cb c3 53 5d 8f 7f 2e aa 7a 62 4f 00 ae e2 2f 7a 05 d0 7b e3 f5 10 Data Ascii: wOF2;H;d@J`LT<x.^x6$6 t Ih\|lAb6(@e]*:-0r)hShN)Db]^t?m{"849c?r3o}S].zbO/z{
2022-06-09 13:31:52 UTC	167	IN	Data Raw: f0 50 7c 7f 5b f9 08 91 16 72 ac 51 40 4d 10 49 ef ee 5f 97 39 b3 e8 9d 91 56 86 00 51 c5 ed 5d 15 a0 af ff 17 ec 5b 20 7b 75 80 11 4c 40 b2 83 92 5d 06 b0 4b 9f ea d2 13 94 da 5d 43 c2 af cf e1 d2 6c 24 8d 5a d9 5a ec bd f3 fa 5a 73 be 34 c4 02 e0 03 fa 80 05 c0 20 78 00 06 c0 00 f8 fe bf f7 fa 46 92 3f bb 37 4e b1 8a 5d 81 7c a6 77 62 5c f0 cd ed d4 5a 7b 31 4c 23 8d c8 74 d1 f4 16 cf 30 ab 64 4d a6 09 8f 24 4a 56 b9 bb 15 7b b7 00 6f 58 d9 01 98 69 00 a0 f0 f7 36 d3 76 df 7e e9 d0 f4 0f 0c dd 29 7c ea 54 74 41 50 26 29 dd a5 4b 51 ed be 5d 79 b5 ff 0b e8 12 ef 9d e1 c8 b0 27 93 c0 04 3a 19 64 85 80 2b 14 84 64 87 ce 17 22 43 e5 a4 68 88 ba 70 e9 32 08 4d 9b b6 65 2c ca 2a 55 50 85 e3 40 81 71 04 87 37 04 14 44 80 40 ff cb d4 2c fd af b1 00 97 e0 42 dc Data Ascii: P\|[rQ@MI_9VQ][ {uL@]K]Cl$ZZZs4 xF?7N]\|wb\Z{1L#t0dM$JV{oXi6v~)\|TtAP&)KQ]y':d+d"Chp2Me,*UP@q7D@,B
2022-06-09 13:31:52 UTC	168	IN	Data Raw: 95 d1 f7 ad b6 cd b6 80 b3 f2 28 27 eb dc 83 d6 f5 ec d3 ad 3d de d7 6f 7c 05 17 f3 61 fb 8d c6 7d f3 4d fe 32 15 03 8e d6 2d 77 75 c4 a4 1a cb a1 4c 76 00 4c 36 10 f4 9e c2 60 4a c3 49 3a 8d c9 39 4a 58 a8 d2 2a 63 0d 18 11 60 02 2a cc cc 51 84 35 5b a2 ec a9 04 67 c7 e3 5c b9 3b 81 ec 78 52 99 6a a7 d4 16 97 31 61 93 ac 3d af d8 4d 63 a2 2e 60 94 cd 12 3e c2 47 84 40 48 22 0a 23 45 05 9c a4 dc 4e 51 c8 69 8a 20 43 59 c9 52 36 72 94 97 22 85 28 51 1e aa 94 83 1a 65 a5 4e 05 5d a0 fc 34 28 9a 26 65 a7 45 b9 18 50 24 43 ca cc 88 1d 73 ab 1a 0a 98 4c 1b 4c 08 a0 70 b6 8c d9 c5 6a 58 60 91 40 31 dc 28 0b 77 ca 89 cc 99 a7 78 06 9f 0a 70 a1 a9 9e c1 a7 1a 54 48 2d 15 32 e1 08 a1 bb 01 66 b2 67 dc a6 cc 42 b8 e5 2e c8 b2 07 58 3d 54 8e ec 1e 59 83 f4 d4 f1 98 Data Ascii: ('=o\|a}M2-wuLvL6`JI:9JXc`Q5[g\;xRj1a=Mc.`>G@H"#ENQi CYR6r"(QeN]4(&eEP$CsLLpjX`@1(wxpTH-2fgB.X=TY
2022-06-09 13:31:52 UTC	170	IN	Data Raw: a5 80 89 cf 47 36 80 74 53 47 ba 53 f5 fa 81 4d 21 da b1 04 47 da 96 f4 11 34 d8 46 07 5b f7 38 f7 9e 4b 97 33 e2 80 f3 2d af 9c 0c f0 87 89 c2 69 f7 95 56 19 fa 26 a2 c0 d6 a6 fe e2 1f 22 f1 8b a6 71 a7 f6 78 1d 70 c0 09 00 d4 af 80 7c 20 70 ee 5b 20 80 e7 6a cf 43 10 e0 a0 4c d8 1b c0 18 5c bf 44 da 16 82 07 9e 49 07 56 d8 96 85 00 a6 bd 68 1f 29 b2 0b 2d 97 0d b2 82 c2 d6 80 29 ed 7d 13 6c 5d ba 72 fc f0 17 02 cf 80 1c 41 01 15 5c a2 19 50 36 05 0d ed 2b 05 9d d4 65 08 d9 2f c6 0a 95 27 dd fb f1 80 9a f3 11 ef 83 77 01 17 ed 78 9e 47 a7 d1 60 08 b2 dd 2d ce 95 97 ad 31 ad 97 88 b2 d3 17 af 58 54 7a 72 c6 99 d5 61 72 22 9a 3c 58 5d fb a8 77 55 c8 c2 69 a3 50 49 c4 c5 44 3b 27 5b ab ba b7 39 6a 6f 3c ce 79 72 c9 26 1b f6 3a 93 de 25 d3 61 d7 a2 3e 1e c7 Data Ascii: G6tSGSM!G4F[8K3-iV&"qxp\| p[ jCL\DIVh)-)}l]rA\P6+e/'wxG`-1XTzrar"<X]wUiPID;'[9jo<yr&:%a>
2022-06-09 13:31:52 UTC	171	IN	Data Raw: a3 73 6b 9b c6 44 6b 16 dc 51 cd 0c b9 10 37 40 6a 69 0e 5c 22 95 12 5c d9 1f 3f 3b 7e 67 b6 c0 4e 60 22 f6 78 69 54 1a a9 7d 5b 94 23 26 a2 ef 4b a1 d2 eb e8 b9 b1 ec a8 55 e4 af 89 41 4d c8 2d 2c 9a 9b 36 38 d9 aa 2a 6d 10 48 b4 a8 54 9f 04 a6 ba 48 09 d1 28 46 b3 ac e7 c0 98 e5 4d 67 9c 0d 16 0c 4b 3a 1e af 7d ca cd 2a 57 aa 54 66 89 e5 5a 1a c0 da 10 c3 b1 57 46 bd ae 26 9d 11 e7 08 81 d9 e9 9e 27 ff c6 9f 28 c5 27 21 e7 1b bc ab 28 64 c1 8b e8 01 cd 05 4f c7 ec 9f bd e4 11 26 fc 5f 6a ab a7 4e c4 7f 7b f1 03 68 af 46 f8 5f f4 34 54 91 20 f7 68 05 f2 42 66 e1 7e 2c 97 6d 0d 6c 07 b3 d2 29 16 32 71 ab bf 80 d6 8e 5e 81 aa dd ba c4 82 52 ac 0f e8 8b ed 34 d7 9a 17 c9 04 92 3a 3a 53 0a 95 fb dc 20 3e 48 8c 06 71 6c 43 da fc 3a 4e 1a 5e b3 db e0 7b 83 d1 Data Ascii: skDkQ7@ji\"\?;~gN`"xiT}[#&KUAM-,68mHTH(FMgK:}WTfZWF&'('!(dO&_jN{hF_4T hBf~,ml)2q^R4::S >HqlC:N^{
2022-06-09 13:31:52 UTC	172	IN	Data Raw: 82 3d bf f0 94 f1 20 9a d4 cd bd 20 a2 ae c8 c8 f9 21 1b 9e 6a db 68 47 cc 2f 89 22 57 d7 17 d0 6f c1 7e 3c bd fd 76 e5 ca 13 ee 53 39 9d eb 96 fc 3e 0a 94 4c a8 22 87 08 8e 82 22 52 24 7d e0 ef fe ec f2 c1 d3 19 8f c4 2b 81 67 e3 24 33 07 d3 e6 8e d2 b5 60 73 8c 11 55 91 9f 9a 5b 48 c9 4a ab cb 2b 85 28 49 aa 5e 07 4b 55 4b 36 0c 9b aa d0 53 b3 9f e6 4f 7e 59 9c 5f 72 30 bd fb d4 64 f5 4d 9f f9 d9 82 20 2d d2 e2 01 72 67 f7 33 ec d9 f4 97 55 f4 b5 41 74 32 35 35 36 a3 74 b0 ae b4 91 96 9d 80 57 62 f6 55 fa 76 a5 41 e2 09 fc e8 47 b1 43 cc 5a bc b1 c7 b6 b2 fb 95 63 f9 01 5c e7 9f 51 a9 7d b7 0d d3 03 aa 47 53 a4 a8 1d 7e a4 65 3d 21 a5 68 bc a2 b2 78 c2 5a cf ce 58 72 d4 78 46 b2 82 9f a7 7a 4d 51 6b 4e 29 94 d8 e3 25 1b 29 97 7d 35 ee fa ff ed fb 0f ff Data Ascii: = !jhG/"Wo~<vS9>L""R$}+g$3`sU[HJ+(I^KUK6SO~Y_r0dM -rg3UAt2556tWbUvAGCZc\Q}GS~e=!hxZXrxFzMQkN)%)}5
2022-06-09 13:31:52 UTC	173	IN	Data Raw: 92 a6 4f 0a b6 5f bd be db 7f e6 71 da e9 c7 7d 27 d5 d2 ab ca ab ca 85 45 da 9f 35 41 92 db c7 4f 1d b1 dc 28 3d 67 b8 f9 ce 08 a5 07 30 0e 46 ec bc a2 88 91 3e 39 3e 46 0c 6b 62 e5 9c 43 ec d5 47 0c 78 db e7 0a 49 07 f4 d7 02 87 3a 27 09 a3 ad 12 db 45 87 28 af 64 3d 18 f7 cf e7 e7 a6 ee 86 17 a3 92 7b 01 12 7c d1 0c 27 93 77 4e c3 27 98 ae 97 dc cd 1f b7 ec 59 b1 ed 19 c9 29 bb eb af 99 e9 53 16 c7 ec 34 c8 e4 1a d3 35 e7 13 b6 c9 24 05 c4 1a a3 be ad e5 95 8f 7d 7c ca 3c 30 c8 1c 50 94 1b 58 58 bb 34 75 fc 6a cd ad 8b ee 92 bf de ca 4c de 08 cb 50 a2 03 24 78 8d 8a 0a cb 5b b8 f6 4e f1 e7 04 72 a2 ea 5e 2e cd aa e1 93 4d 75 3f a9 ea 81 bf 19 76 03 8b fb 2c d1 92 f8 77 a3 28 e3 d1 c1 31 b8 f9 26 bc 69 68 8e ec 9d 67 a9 a0 1b e1 90 77 1f 13 b5 14 51 d5 Data Ascii: O_q}'E5AO(=g0F>9>FkbCGxI:'E(d={\|'wN'Y)S45$}\|<0PXX4ujLP$x[Nr^.Mu?v,w(1&ihgwQ
2022-06-09 13:31:52 UTC	175	IN	Data Raw: 87 64 23 ed 5c c6 31 e8 cd bd 06 ce f8 f5 bf 0a a2 06 9f ed 6a fa 9b 1b 1b ae 3d 1c 0b a3 dd 78 58 d7 dc d7 56 51 ea e3 6e eb e2 1e 9c 9f 14 19 1f 9c ef ee ea 4a f0 fb 9f d5 df 74 02 d3 a1 c3 dd d1 74 a2 bf b7 41 1c d3 d9 d2 8c 6d 6f 3c 4e ec 59 62 38 99 2e a4 9b 2c 30 9c 96 e6 87 1d 4c ef 2f cc 9b 2e 8f 3a d4 04 4e 5d b1 bb 68 97 1e 97 91 74 29 bc 33 ae 3f 44 29 2f d9 c0 42 59 b1 99 ed 52 5f 46 7e 4e 4d 51 ae 86 97 80 95 4b e2 59 87 93 8c a2 08 1b e0 a8 a5 e8 1e 7e 61 37 8e 81 ca 69 d1 16 72 5a d3 18 26 2e 58 70 6d cd 2d d8 ee 7a f1 fe be 7a 1c 36 fe 11 34 f9 d5 a6 d0 9a a7 a6 3b 33 25 29 4d 27 41 1e d4 68 da 23 d0 25 8f e8 38 2e 0f 22 7c 30 ad de 08 72 d0 55 31 31 d7 f0 25 0f 28 bc e0 6d a6 36 0b a0 4e 4c 05 94 d7 05 05 94 d6 06 06 95 56 04 04 56 54 fc Data Ascii: d#\1j=xXVQnJttAmo<NYb8.,0L/.:N]ht)3?D)/BYR_F~NMQKY~a7irZ&.Xpm-zz64;3%)M'Ah#%8."\|0rU11%(m6NLVVT
2022-06-09 13:31:52 UTC	176	IN	Data Raw: e9 be 7e de b7 c4 0a ce 05 18 39 93 60 d5 74 7a 7b 88 f7 c3 0d ed cc 43 c8 68 0f f6 bc 2f 8f 6a 63 72 08 0b 77 75 89 0c 71 93 74 08 0d 75 77 0b 0b 73 e4 13 91 84 0a 0a a5 b2 b0 52 d9 85 68 ce a8 d1 b3 1c 66 2d 82 0a a1 22 74 6b e8 a5 5f b8 48 a7 b5 cd 82 55 c6 88 a4 c3 67 86 1f 74 44 fb 89 63 9b e2 44 e2 7f 0a 9f 40 b0 0d 25 0f e5 0f a5 0c b1 20 84 45 bf 04 e5 8a 62 5b 42 24 c2 da 69 4b 88 ab 69 29 e9 f9 e9 14 ad 21 8a 7e 95 be f0 d2 f8 71 95 b8 8e 2e df ba 1e d1 ab 21 5a 97 2c 1f 19 17 10 14 ec be 49 dd ec 33 61 a8 33 72 14 11 3e 49 58 b3 9b 0f 83 c7 94 8c 7e e4 8b 1c 0b fa 27 c7 af f8 9d d1 00 88 35 ba fb f8 73 a9 62 65 02 31 26 30 c4 7d 8b ba f5 ea a5 51 dc 57 4a 57 a7 37 15 48 55 ba 14 30 89 85 0e 4b 48 5f 37 eb 3b 6c d9 de 25 56 a9 c7 b7 56 0d 14 52 Data Ascii: ~9`tz{Ch/jcrwuqtuwsRhf-"tk_HUgtDcD@% Eb[B$iKi)!~q.!Z,I3a3r>IX~'5sbe1&0}QWJW7HU0KH_7;l%VVR
2022-06-09 13:31:52 UTC	177	IN	Data Raw: 88 17 cb a2 2f 62 80 96 2a ff 1b 20 29 c6 58 4a 94 c0 35 1c 52 96 be 39 f5 f5 80 1e fd 0e 53 ad f2 5d 6b 4d 58 1a 4c 59 47 e1 92 26 2f 5e c8 2e 5a 58 e5 a4 d6 53 20 4b 79 aa c8 97 c7 50 9d 02 7c bb 75 64 3e 19 e8 86 c6 31 3b 96 a9 e9 aa f5 02 69 96 93 48 a5 7b 5d 68 f5 8c cd 64 f7 fd 89 23 6b 91 08 a7 6e dd ba d9 2c 05 ac c1 b0 61 63 cf a4 66 fa 22 03 67 b6 57 39 dd ed f7 74 eb d3 74 74 c2 a5 2b d9 b7 e9 a4 ad 97 dd 3e d6 1e 7f c1 07 f8 62 0e 1f f3 bf e0 0c 31 62 ec a7 68 b3 d6 d9 e6 71 f2 00 b7 c5 f2 d5 b0 d5 a9 49 47 bb db d9 8e ed e2 f0 76 c7 74 dd 89 df 47 23 7b d1 27 a0 0f f3 11 7b ca 7a d9 24 44 dd 71 f6 d1 00 e1 bb 3b 49 60 0d 5f 27 d1 00 51 3a 91 e6 bc ee 70 cf b9 60 0a 6c 31 66 f2 f5 69 46 35 e4 55 3c 90 4b a9 34 85 08 01 32 93 aa 0b 2a be 2f 41 Data Ascii: /b* )XJ5R9S]kMXLYG&/^.ZXS KyP\|ud>1;iH{]hd#kn,acf"gW9ttt+>b1bhqIGvtG#{'{z$Dq;I`_'Q:p`l1fiF5U<K42*/A
2022-06-09 13:31:52 UTC	178	IN	Data Raw: ac 7e 91 89 a5 ed 47 6d c2 64 31 58 42 a2 20 f0 b1 1e 10 26 42 98 c1 5a 5a 36 54 b4 68 b5 d9 35 9c 81 08 dd 02 14 1c a6 d9 9b 8a 70 9b 9a 34 5c 52 52 10 56 77 ea 09 5f 74 87 e3 18 e2 db a8 e0 e4 c2 53 2c 84 9c bc 6f ff a9 99 cb 9e 33 f5 70 fa c9 5f a1 f4 c3 9f 02 fb 47 bf 05 c8 f0 af f3 22 07 25 37 20 e0 90 fa ca e9 ae 07 94 87 cb 37 18 fc 60 5f 9a 79 e5 f9 03 2b 99 9d b2 56 bd bc 15 6c a8 4d 40 19 e4 2c 64 bd 10 58 59 da ad 76 93 0d e6 7b a9 08 40 0a cd 5c 1a 32 61 7b b7 5d e0 05 15 53 9d a0 a1 cb ba 6b d1 9e 9d ae f2 1a ea c2 c8 11 c6 a7 0f a6 69 50 50 62 28 45 48 f5 01 ce 34 36 9d 89 30 85 92 6a a1 61 b1 d6 96 a8 15 5d a9 fc 18 1d 86 49 66 c8 52 e4 3d b0 49 c6 15 be 40 f4 11 e6 e7 a6 63 9f 0e 34 96 af ba 39 19 50 0e e4 30 d9 47 81 a2 30 6f 34 c8 13 b2 Data Ascii: ~Gmd1XB &BZZ6Th5p4\RRVw_tS,o3p_G"%7 7`_y+VlM@,dXYv{@\2a{]SkiPPb(EH460ja]IfR=I@c49P0G0o4
2022-06-09 13:31:52 UTC	180	IN	Data Raw: 92 de 1c ae cf 58 36 5b fb e3 da 30 75 4b e2 11 55 2c 6d 4b 55 9a eb aa 3f 04 96 35 74 df 9b 6e 3c a0 ae ba 4a ba 3d cd 65 31 3f fa a4 5e 96 5c 12 92 26 9b 03 e6 c1 bc 5e 96 52 49 cb 16 ae 2c cd 52 90 9c 5c b5 a5 7b 0f b8 54 91 e3 ab fb c7 bd 8f 4c 45 b2 d6 b5 c7 d1 49 fe 4f 7d e6 bc 8b 1b 9d 1e b4 05 de 37 b2 9c f8 97 87 cf d3 0b f4 97 15 de ce 0f 94 65 ff 60 08 23 d6 ed 3d 1e 24 6f bf 25 e1 17 a4 98 6d 1a 02 b8 95 cd 9d 28 5e 20 4f 25 81 e4 c8 5e 04 7f db 77 31 ad fe 1c 3e 63 1b 73 34 88 bf 07 5f b0 bc fa 9c 32 31 52 50 07 f3 4d 73 90 94 b1 4f 49 2a 12 9d 90 55 72 84 37 6a c4 d3 59 2d 4a c0 08 16 92 92 17 04 28 31 fc 08 54 68 a0 70 36 84 77 7c 72 65 d0 2e 18 cc bb 03 49 f9 a0 2a cc 07 7d 0b 6d 4c d3 e1 41 4d 18 c3 fa 39 c1 38 a0 99 5f b6 95 42 6e 58 46 Data Ascii: X6[0uKU,mKU?5tn<J=e1?^\&^RI,R\{TLEIO}7e`#=$o%m(^ O%^w1>cs4_21RPMsOIUr7jY-J(1Thp6w\|re.I}mLAM98_BnXF
2022-06-09 13:31:52 UTC	181	IN	Data Raw: 72 19 23 f8 f9 a5 88 2b 7e ab ac 5f 73 2e 47 7e d3 84 4b 95 29 ab 69 fe 1d 26 6d 9a 72 ae 5e 45 f9 4f 66 1b f2 ca 43 7a 79 48 2b 33 25 35 49 6d 1d d0 4f 5e 65 f1 47 74 1e 4a ac 36 89 35 c5 7f 6c b0 9b ca ac a6 9a f0 ba 05 bf 24 ae 9f 1b cf 69 a4 8b 6d 86 ce 9e 41 99 d3 2c 9a 26 b5 4b 18 35 89 4b d7 ab 88 df ea 96 16 01 0b 9e 57 cd e9 c9 01 09 b5 20 69 e8 68 9d da 8a a3 86 67 d4 90 8b 2a 27 72 45 40 ae d3 c8 69 27 72 08 79 38 2b 4f 7f 21 e9 cf a9 da 5c c8 43 2a 9d ca a3 4b 75 77 18 b1 a6 d0 98 2b 4f 2e 17 f4 44 80 15 68 81 0a b8 80 3d a8 83 25 98 80 55 fa fd 48 61 a4 64 fb 70 c3 4c a5 b4 4f 48 2d 85 56 1a 43 08 ac 3b a8 40 ab 5c 0f 7c ab 94 ea 16 90 4e 29 80 80 94 49 cb 90 42 48 9f 14 36 38 7e af 0b 15 2a 2b d7 7b be ab d4 e9 16 90 36 29 80 70 93 78 41 80 Data Ascii: r#+~_s.G~K)i&mr^EOfCzyH+3%5ImO^eGtJ65l$imA,&K5KW ihg'rE@i'ry8+O!\CKuw+O.Dh=%UHadpLOH-VC;@\\|N)IBH68~*+{6)pxA

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:52 UTC	182	OUT	GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive Origin: https://www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcLaPwUAAAAAOLoPlKRFZnQW2QNKjKN2v1ReY2S&co=aHR0cDovL2FidWVsbC5teWFmcmljYXdlYWx0aC5jby56YTo4MA..&hl=en&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=qnzglyzhopme Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:52 UTC	182	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 15552 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 07 Jun 2022 13:00:16 GMT Expires: Wed, 07 Jun 2023 13:00:16 GMT Cache-Control: public, max-age=31536000 Age: 174696 Last-Modified: Mon, 16 Oct 2017 17:33:02 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-06-09 13:31:52 UTC	183	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 3c c0 00 12 00 00 00 00 8b e4 00 00 3c 5a 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 64 1b 99 7a 1c 83 4a 06 60 00 86 4c 08 5c 09 83 3c 11 0c 0a 81 d7 3c 81 c0 06 0b 83 5e 00 12 81 78 01 36 02 24 03 87 36 04 20 05 83 00 07 20 0c 82 53 1b 18 7d 25 d3 cd 11 cf ed 00 a6 7c ea 0d 1c 85 78 1c 80 5b 6a 18 45 cd a2 9c 92 64 ff ff 2d 41 b3 01 83 5d 3d 73 6a 66 24 58 7f 6f ca 35 b1 8d d2 da 0d ad 56 ec e4 a2 9f de dd a3 69 3f 7d d6 5c ed 16 de b6 3b e5 ef fb 56 9d b2 85 a0 1a 8c 35 ed af d5 6d 4f 3d 2c 5b c5 a1 42 ab ca 64 27 da eb af 3d 9a 8b 4d c7 2e ea 8e 71 8f e2 ed 38 ea f2 55 27 9f d9 4e fd f7 47 01 f9 d0 5b a0 88 38 06 14 88 12 4a 70 0c 04 78 50 c6 8e d0 d8 27 b9 3f cf cf ed cf 7d ef 2d 92 31 46 Data Ascii: wOF2<<ZdzJ`L\<<^x6$6 S}%\|x[jEd-A]=sjf$Xo5Vi?}\;V5mO=,[Bd'=M.q8U'NG[8JpxP'?}-1F
2022-06-09 13:31:52 UTC	184	IN	Data Raw: 49 b6 e9 2e db ba d2 59 fe 42 ca 1b 69 0f 4b da 30 b6 3a df 94 64 0b 45 b9 4c 77 f7 f6 04 00 51 fd 12 7e fd 36 dc 7d 42 16 86 c2 62 54 0c 46 84 2c 3c 0a 2f 11 1e 0f c2 51 75 c3 03 fc b1 7c 17 ab b0 48 9a 96 0e 93 46 6b a0 2a 2d aa e2 48 d0 d9 70 34 ca 24 b8 fe 03 b4 cd 0e 7b e1 86 ba 32 d6 2e d2 c2 c2 22 94 54 27 8a cd 14 a3 b0 19 08 16 a2 12 56 61 e4 36 2b 86 39 75 76 ce f8 bd 8b 52 57 ba 90 55 24 38 1b 00 ca 70 86 c1 95 f3 17 ae 9b aa 06 82 a4 48 35 0b 92 dc 42 c1 8d 4e e9 f8 56 a7 cf ef 7b 86 31 e3 16 dc ae ab 35 7d 70 ff 71 36 93 f1 54 94 0b 01 55 a3 50 b8 4e 8d a9 f2 55 c0 0b 07 21 b8 77 ea 7f 3f d2 8c d4 6d 49 ee b1 e3 38 71 da 7d a5 14 00 1f 20 3e 8b 5a bb 4b fb e1 15 b0 05 74 71 07 a4 7d c4 3e 3c 4f 6b a9 dd 77 ff e6 20 fc 13 76 99 96 e5 0a 57 84 Data Ascii: I.YBiK0:dELwQ~6}BbTF,</Qu\|HFk*-Hp4${2."T'Va6+9uvRWU$8pH5BNV{15}pq6TUPNU!w?mI8q} >ZKtq}><Okw vW
2022-06-09 13:31:52 UTC	185	IN	Data Raw: 55 5d 9f a7 0e cd 7b aa 4e 53 13 00 01 41 da ba a5 ed b0 a3 56 7a b9 87 e0 f9 12 eb 7b 2e 6f 37 15 20 34 3e a0 cc 8f 78 21 6c 6a a8 7c d0 94 bf c7 ac 3d bf 35 fc e0 69 3d fa 97 d4 5b b5 c5 61 72 69 f2 47 59 e6 17 84 99 4d 70 4d 94 8d 14 a8 08 97 b6 ec 0b bd ba d9 da 4a 46 2f a7 30 9b 2e d6 72 00 cf 80 04 91 c1 63 50 dc 86 72 ce bd 85 3e 0a a8 bc 8c d2 34 a8 d1 70 8b 3b d4 90 d0 93 76 aa 62 32 ed 43 99 6d d8 0e e8 63 2f eb 64 39 49 56 4c 85 ce 7c 04 64 3a d2 fd 06 cf eb 82 2f f3 12 bf 5f 5f 7f dd 46 f3 d3 9e 36 f4 c2 0d 79 6c 62 96 e6 b9 d3 1a bb fa 2c 18 90 82 57 14 09 14 13 7e 0b 6e 61 43 48 5c 58 1e 33 84 5e 3e 63 fc 84 8e 0f f4 4f 08 0d 9b 18 a1 93 a3 fd 66 b1 f1 e6 5a bf d5 e6 5a eb ed cf 97 e9 da ed 7b 06 c3 bf 02 3a 18 83 b9 ba 15 63 31 96 71 8c 0b Data Ascii: U]{NSAVz{.o7 4>x!lj\|=5i=[ariGYMpMJF/0.rcPr>4p;vb2Cmc/d9IVL\|d:/__F6ylb,W~naCH\X3^>cOfZZ{:c1q
2022-06-09 13:31:52 UTC	186	IN	Data Raw: 84 84 64 83 e7 4e 9e 84 7d 74 ff 84 b9 73 71 96 89 a7 88 a1 d1 6d d9 cd b4 56 d5 5a 55 f0 6c 88 da d5 6a bd 66 a6 28 d7 f3 26 ad 59 d4 74 06 0d 19 df 23 48 a7 53 f4 92 b8 85 97 f1 97 87 34 aa e5 03 1b c4 64 22 46 7b 39 ee 93 c5 53 4a b2 24 01 6a 8d 97 e7 a1 a8 79 19 63 4b 48 89 97 44 1c 2c 3d 3c ae e4 ac 15 aa 16 6b d5 9a 0b 0a 20 a4 dc 30 a1 7a f0 72 68 90 e0 43 0b c3 71 a4 99 5a 43 8a ab 75 04 55 08 70 77 3c 09 a9 a8 d6 1d 21 7a f4 ac 14 3c eb 92 48 aa 76 6b f1 73 e0 c2 f4 47 40 aa ef 01 6c 9f 02 a8 ed 7d e4 94 78 95 02 0c 63 00 fc 8d 52 58 a1 12 2e 27 6a 1c 1c 5b 5e 7e 03 1e 2c 98 54 2c 30 32 4b 4f 48 a9 00 dc 56 4b 06 27 ce aa c1 a8 6c 95 83 c5 76 a3 ed d2 19 2f aa 91 0a bb a4 93 56 a4 16 72 8b cf 6e ed 36 c5 04 02 06 12 64 d3 14 a3 5b d8 50 4e 16 76 Data Ascii: dN}tsqmVZUljf(&Yt#HS4d"F{9SJ$jycKHD,=<k 0zrhCqZCuUpw<!z<HvksG@l}xcRX.'j[^~,T,02KOHVK'lv/Vrn6d[PNv
2022-06-09 13:31:52 UTC	187	IN	Data Raw: 1d 24 d8 ec f3 a3 73 48 60 2b ff a5 aa 07 75 73 58 7b 08 e4 f2 ce 66 f0 a8 95 f7 e3 0e 75 71 22 41 84 68 34 e9 ab cb 0e ad 18 f1 58 8d 4a 46 61 d1 24 62 c7 f4 e9 fb 66 e5 41 90 29 3d 3a 2a 88 fb 30 10 57 ee 4c a1 68 a0 2a 61 e1 81 11 6d 5f 98 17 62 8e db d3 02 a3 8e 70 53 82 48 c0 d9 44 5a 51 16 26 e0 e6 fe c9 8a 05 95 04 ab d1 88 52 59 2f 4f 49 92 21 c9 a9 69 09 ee 3c e3 9e fc 4b 1b 6b 9c d2 d4 e4 e0 eb 73 40 bf 3b 58 04 b2 85 1f 31 c2 34 4a 8c 32 46 da 06 0d a9 3c 8a bc 23 60 1a 1a 09 d4 ac b7 77 5e f9 a2 0d 35 ac d6 1a 28 1f 2b 78 74 70 90 40 fb 6a d8 a1 76 07 3d e2 1c 00 dc 1b a0 85 6a bb 80 a4 bb 31 df e1 9b 4a bd 58 80 47 d3 98 37 0f 62 2c 4f 50 79 37 1f 38 23 ef 10 9c 73 0b a2 a4 bc fd 74 07 cb f5 f1 2c de 3e da 9d 65 76 c8 3d 83 25 4f 6c 96 36 87 Data Ascii: $sH`+usX{fuq"Ah4XJFa$bfA)=:0WLham_bpSHDZQ&RY/OI!i<Kks@;X14J2F<#`w^5(+xtp@jv=j1JXG7b,OPy78#st,>ev=%Ol6
2022-06-09 13:31:52 UTC	189	IN	Data Raw: 1e e0 75 e5 21 70 1a b2 32 97 15 6d 64 64 47 64 85 06 ff 4c b1 e6 50 7d 2c ce 14 8e c7 d2 b0 e6 a7 07 a2 fa 4f af 5e e9 57 40 9c f2 82 be 35 fe f8 e1 93 9b 98 fa 88 fc ad fe a7 cf ef 1c c5 d4 bf 19 cc 06 f7 45 30 82 db c4 fa 71 33 a1 e3 11 f4 e0 4e b1 11 cc bf 9d 4c cf f0 59 dd 85 e3 50 d8 52 f5 3a d8 97 e6 50 7c cd 97 16 e3 11 16 9b 1e 2d e2 32 97 9f 95 65 2f 7f 5e be 1c 18 f1 3e 39 cf 23 aa c2 ea 88 07 3a 27 18 88 2b 0a f0 0d a0 86 b8 47 87 38 8b 42 c2 ee 2e 7b 73 d6 be af dd 4c 8e 6a 70 bf c4 38 1f 75 27 62 64 ef e0 c3 26 4e 67 b7 28 91 cd 08 0c 8d 65 50 6f f0 23 79 e9 a1 50 4d e9 f6 e1 76 53 91 29 5d 2a fb 1c f2 c1 af 73 e2 b5 d1 e4 e3 b8 c6 45 cb c7 fb 9a 4c cf 39 7b ea c7 2c 6c b2 ba 9f 50 57 e7 04 bd 67 f7 85 77 b2 59 91 21 9e 21 51 65 49 dc c4 c2 Data Ascii: u!p2mddGdLP},O^W@5E0q3NLYPR:P\|-2e/^>9#:'+G8B.{sLjp8u'bd&Ng(ePo#yPMvS)]*sEL9{,lPWgwY!!QeI
2022-06-09 13:31:52 UTC	190	IN	Data Raw: 3b f4 58 b7 a8 6a 13 f4 c7 b2 f9 c8 b1 f8 fc 23 7f 4d 8e 65 e7 2b 6a c4 4e ee 7e 60 58 a1 76 00 b6 35 33 e9 26 ea e4 e8 c2 21 80 1e 59 d9 9b 0f 30 9a f2 55 41 66 c2 8f 96 52 57 be 18 00 77 d6 15 02 8c a6 c2 de 6a 80 1e 59 7d 4e 99 58 d5 3c 33 67 bb 5a 7f 61 75 d6 4a 9f dd 2f e8 17 a8 9c c8 59 9c e2 c9 0c 55 c5 ff 72 bc 6e 30 6b ca 67 bb 12 1b 01 dd 67 01 9a 78 dd 93 6c e3 67 0d 13 39 d2 0b a7 ec a3 fb 9e f7 89 35 bc ce 3a 6f 27 27 d6 84 61 99 fd 9c a9 e4 f3 af db a1 48 d6 09 c8 53 f2 bf bb 6c 46 fb fc 12 f6 d0 1e 01 74 10 5d f5 8d 6c 19 7b 6e 21 b3 43 27 23 ef 84 95 9a 24 f6 c1 52 ca a8 91 b5 a0 7a 6f bd 46 67 86 9f b8 c5 86 78 2a bd 69 d2 8b fe 72 97 05 ae f8 8b 61 dd 37 f8 ed 19 ed ef 0d f1 d8 30 06 29 2c a6 0e 38 65 25 64 35 58 58 aa fe 1c 94 0d 37 f8 Data Ascii: ;Xj#Me+jN~`Xv53&!Y0UAfRWwjY}NX<3gZauJ/YUrn0kggxlg95:o''aHSlFt]l{n!C'#$RzoFgx*ira70),8e%d5XX7
2022-06-09 13:31:52 UTC	191	IN	Data Raw: d7 2c b8 4e dd 3a f7 34 7b 03 49 05 81 9d 35 8e 30 0d 24 df b3 4e 7e 7a f3 cb 9e ae 99 ef 94 8c 18 66 64 92 8b 35 91 61 17 e7 33 18 e2 98 af 19 68 75 00 af ec 7f 2e 8a e0 6e 9b 73 b5 05 f2 94 7a 95 4e e0 93 79 92 2b 76 9a 08 64 18 12 e9 89 44 86 21 90 13 ea af fe 9d 3e 6d f6 82 98 df 74 0b d6 b3 dc 16 da d4 b7 5c 5a de 50 21 28 26 3b 5b 3b 90 bc f9 61 f4 30 1f ae b3 a3 a3 95 7b 25 a7 4a a0 22 57 57 5e 06 2e 2f 3a 4e 2c 3c 0e ae 82 c9 d7 e6 1d 27 80 ab a7 ba 1d 71 63 6c ec 58 b7 63 4e b7 23 7a 62 e8 ba ef f8 3d c7 2c d7 01 30 d2 9c 10 15 16 17 e1 17 54 cd 6c f4 d6 8a a1 c1 31 9a ea 0d b2 be 4d ec 84 c4 82 0c 8e a1 9b a2 95 6b ec 79 9b d3 35 89 14 3c 60 3b 55 c3 21 cb f0 64 d8 84 c4 c2 7a a4 b2 dd 03 82 b7 4c 00 4f f7 60 2c 64 cd 89 90 67 ad 58 50 cf 8b a6 Data Ascii: ,N:4{I50$N~zfd5a3hu.nszNy+vdD!>mt\ZP!(&;[;a0{%J"WW^./:N,<'qclXcN#zb=,0Tl1Mky5<`;U!dzLO`,dgXP
2022-06-09 13:31:52 UTC	192	IN	Data Raw: 2c e6 6a 8e 74 10 4b e0 aa 7f d3 11 72 d6 41 0d 21 57 a5 14 69 ee c4 11 4b cf 5f 49 02 12 d2 17 8e ee fe 0c 1c e8 18 27 96 59 ba 92 e4 e3 bb 70 b4 e1 42 84 05 91 25 96 9d bd c6 05 62 d3 e6 15 85 46 2c 0b 62 82 58 f1 e4 da 45 20 c7 2d 54 dd e3 1b 8c 65 61 9f 2a 2e 98 5e fb db c3 eb d1 29 99 78 71 57 26 d3 d3 87 c1 74 3f e3 12 16 e6 e3 c1 a4 82 48 87 0d 8e 7c 5d 57 7d 9c ab 70 9c 5b 0d de df 5a fb 48 be 17 7e 5d 0f ae 0d c8 b1 bc de bb 14 dc 6e ef f7 94 6c bc 5d 9f 1f e4 72 42 79 9a a1 c2 06 2c 8e 4b 83 1a 52 1b d8 0d a9 8d 7b ff da 29 fd c9 e6 1c 53 9e f1 3a e9 95 77 ab 5e a6 dc 23 d5 93 ed 99 66 bc 93 47 18 21 c8 f7 86 8e cf 1f 0e 60 65 b5 0f 3a 27 58 65 9d b4 54 54 9d 48 54 a3 06 7b 90 dd 4c 57 da 56 78 3e 22 a8 a8 4c 4b 60 e2 25 8b 1b e9 74 0e 2a 99 e8 Data Ascii: ,jtKrA!WiK_I'YpB%bF,bXE -Tea.^)xqW&t?H\|]W}p[ZH~]nl]rBy,KR{)S:w^#fG!`e:'XeTTHT{LWVx>"LK`%t
2022-06-09 13:31:52 UTC	194	IN	Data Raw: 65 20 fc 78 f6 f2 0c 43 11 50 98 84 f0 53 80 62 e7 50 76 bd 00 76 66 53 72 64 f9 38 21 9f 37 36 29 17 21 43 72 44 76 61 ec b1 cf 29 b2 fd 05 1f 5e 34 6f 06 ff 86 4d c4 75 ca c6 66 8e b1 18 b3 ce b5 4f 83 1a 51 e8 45 82 76 3c 76 f8 39 f4 25 ce d0 21 ae c6 33 f0 90 13 7a f4 57 38 36 dc a3 af 8d 22 60 5d 12 a5 bb c1 a0 1d b9 b8 2e a8 3a 76 96 72 aa a9 e8 47 42 d5 85 9a 3e 10 ba ca bf b5 d1 8d 4d 5e 7d 5a 4b b3 43 8f 60 ca 06 fb f2 1e db 60 2b 57 cd f6 e6 15 09 37 cd 84 0c e5 9e bc 5a ca f3 59 d3 5e b9 fa b4 0d 47 8a 5f c7 f9 c3 82 50 ea b6 30 14 2e ce 3f 54 a5 67 04 8f 65 50 cf dc 0c 8e 38 f2 33 d9 af 55 22 09 5f f7 2c 92 74 e7 c9 31 cc a6 8b 65 69 a6 d4 6b f1 e6 18 dc d5 37 22 6f 7e da a6 9b 14 93 67 0b 8f e2 01 43 79 40 17 74 62 3b e9 2b bc 28 87 9d c4 e3 Data Ascii: e xCPSbPvvfSrd8!76)!CrDva)^4oMufOQEv<v9%!3zW86"`].:vrGB>M^}ZKC``+W7ZY^G_P0.?TgeP83U"_,t1eik7"o~gCy@tb;+(
2022-06-09 13:31:52 UTC	195	IN	Data Raw: fa 1a 45 b4 4d 9b a0 28 43 33 17 33 a4 88 38 59 1c a2 07 ef 0f d0 8b fd 2b bd f7 5b 8b 7d 2b 15 4c d7 5f da 29 ad 8b ff a7 a7 5f e5 77 c9 2c e2 43 e8 93 8b 42 5b 88 30 11 7a 9a 42 ad aa dd 5d e7 b2 74 d4 e2 0c 64 9f 4d 3e 64 4c 09 46 33 31 5f cd 65 98 a3 3b 8f 62 1c e4 98 64 b0 c1 a0 e5 b3 4d 47 b4 83 7c 9f 3e 43 5f 87 e3 ed 2d d4 3a 46 ea 46 e7 15 6b 61 c7 49 d2 04 33 a9 33 d5 8d f5 56 b1 57 99 7f 73 31 5a 32 f2 90 bf 4b 23 22 db 6d dc 74 b3 0a b9 e8 b2 23 4c 83 91 72 10 38 32 f8 1e 2b 91 d0 7a 4d 91 7c 2b 38 1a 6b 45 7d 94 27 7b 75 29 29 a6 8d 73 50 65 05 98 0a 3c 13 85 da 53 7b 4f 0b 76 b8 8f 22 d4 b6 57 89 19 3a 5c 84 b3 77 09 28 03 72 77 8e 24 82 2d 90 a5 20 ea 84 9f 86 cc d4 5c 17 5a 0c d4 64 53 57 89 0a 9d b6 61 4b a6 a1 e5 33 4c 83 61 d7 00 6d 7b Data Ascii: EM(C338Y+[}+L_)_w,CB[0zB]tdM>dLF31_e;bdMG\|>C_-:FFkaI33VWs1Z2K#"mt#Lr82+zM\|+8kE}'{u))sPe<S{Ov"W:\w(rw$- \ZdSWaK3Lam{
2022-06-09 13:31:52 UTC	196	IN	Data Raw: 91 13 e9 7d fb 5b bc f0 c7 c6 2c 68 23 e0 b4 65 d7 23 93 f0 31 a4 7e 97 1e 8b 9d 7c 72 90 e5 c9 7e 3c fd 92 6f fd 28 38 f0 d7 8f f7 5f 5c f8 dd 0f b3 f8 40 04 d5 bd 19 34 58 8e 38 97 dc 0a 34 44 1f 48 f5 b8 4a aa 74 81 d5 c4 55 8e 02 44 08 2b f6 6f 65 ea 54 7e 15 bb b2 35 76 cc e5 db e8 45 97 22 db 94 dc 44 d7 5d 72 e1 b4 85 86 73 30 36 65 4c 48 db 9a d1 b9 54 68 35 c9 f0 7a be 30 78 f7 b1 be 8e d7 44 e7 42 8f db 0d fb 66 e9 4a 25 87 87 1e 50 97 ed 74 22 9e fd 3c 80 7d 3e f3 cd 4d fe ed 8b 6e 75 b8 cb 2c 15 31 6f bf 1c 84 dc 9f e7 f0 01 80 49 c8 b3 83 15 88 c6 0b 39 93 81 e0 ad b5 c3 9b 08 5f d4 df 5c 7d de 51 04 36 6f 5e 7b 6f e6 2d 74 f2 aa 8d a4 44 18 d2 e1 ba 12 5b 71 6b e3 3d 88 5b 62 27 9f ac cf 70 d6 92 1a ad 5c c5 36 9d d3 2a f5 e2 ec 35 0d db 9e Data Ascii: }[,h#e#1~\|r~<o(8_\@4X84DHJtUD+oeT~5vE"D]rs06eLHTh5z0xDBfJ%Pt"<}>Mnu,1oI9_\}Q6o^{o-tD[qk=[b'p\6*5
2022-06-09 13:31:52 UTC	198	IN	Data Raw: 02 97 61 2f 9c f9 5c c7 d5 24 cb ce 2b b2 d1 37 73 16 d8 38 17 95 f7 ba 69 b7 b5 98 55 13 2e 17 6a 56 5f fa ca d5 0c 4f 50 af 73 33 55 f6 9e c9 51 08 07 26 94 74 39 29 44 d4 6e 10 15 6f 13 e5 b5 f2 09 45 55 e2 8c 7e 20 67 99 ff b4 92 ae bb c5 2b 25 bc d9 e0 b0 02 36 d3 85 11 7f 26 a4 1c 2d 6f 07 a2 72 c4 8d e5 70 ed 9d f0 68 0d c7 09 13 3d 15 16 8d 03 e5 2c a7 9c 00 ea 7a 45 3a ab a8 a6 c8 fc e2 c0 e2 42 54 fb 5d b1 b8 38 b0 e6 fa 6a d1 94 98 3f eb 28 6d d0 6a bd 1a 71 26 a6 02 ea 18 66 bc d8 dc fe c9 68 bf 31 1d 3a 4c ea 7e 5c 31 b5 aa ce f0 28 0c 4e bf 31 e3 36 54 59 4d 54 35 d1 52 e7 2f f1 bb 4b dc 28 70 22 23 aa e7 bb e8 5e 21 ee f2 14 d9 1b ad ed 17 22 27 cf 52 7d 4f ad 76 f4 6e 58 3a fe 12 6a d8 34 ff 73 ee 5e 3b 14 ce 25 9b 7a 9b 57 fd 61 5d 81 e5 Data Ascii: a/\$+7s8iU.jV_OPs3UQ&t9)DnoEU~ g+%6&-orph=,zE:BT]8j?(mjq&fh1:L~\1(N16TYMT5R/K(p"#^!"'R}OvnX:j4s^;%zWa]

Timestamp	kBytes transferred	Direction	Data
2022-06-09 13:31:55 UTC	198	OUT	GET /bootstrap/3.3.6/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive Origin: http://abuell.myafricawealth.co.za User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-09 13:31:55 UTC	199	IN	HTTP/1.1 200 OK Date: Thu, 09 Jun 2022 13:31:55 GMT Content-Type: font/woff2 Content-Length: 18028 Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: DE Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: "448c34a56d699c29117adc64c43affeb" Last-Modified: Mon, 25 Jan 2021 22:03:59 GMT CDN-CachedAt: 06/08/2022 09:12:38 CDN-ProxyVer: 1.02 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 722 CDN-Status: 200 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-RequestId: c5fdd3f59586fca8fad7f7e35e9f497d CDN-Cache: HIT CF-Cache-Status: MISS Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 718a3af5b9c29a15-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-06-09 13:31:55 UTC	200	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 46 6c 00 0f 00 00 00 00 b1 5c 00 00 46 09 00 01 02 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 20 06 60 00 8c 72 08 04 11 08 0a 82 a9 24 81 e5 65 01 36 02 24 03 86 74 0b 84 30 00 04 20 05 87 22 07 95 51 3f 77 65 62 66 06 1b 65 8c 35 ec 98 8f 80 f3 40 a0 c2 3f fe be 08 0a da f6 88 20 1b ac 74 f6 ff 9f 94 a0 86 8c c1 93 c7 d8 dc 2c 33 2b 0f 32 71 0d cb 46 16 ae 59 4f 1b ec 04 26 3e b1 e9 b1 62 d2 6d a4 35 81 5a 8e e6 48 24 b1 aa 59 8a 19 9c bd 7b ec 48 09 6a 64 86 0b d5 89 0c fc b2 25 f7 b9 d9 a7 7f 79 22 a7 04 03 f7 f6 d7 2b 8d 40 b9 8c 5d bd ab 65 9f fb 7b fa d2 fb 76 90 a0 4e 63 8b 29 0e bb 6e f9 93 c9 3f 7e 3f e8 90 a4 68 f2 00 ff 9e 5f e7 26 69 1f c6 ca c8 1d d1 9d 05 c1 a4 8b 3f ba Data Ascii: wOF2Fl\FM?FFTM `r$e6$t0 "Q?webfe5@? t,3+2qFYO&>bm5ZH$Y{Hjd%y"+@]e{vNc)n?~?h_&i?
2022-06-09 13:31:55 UTC	200	IN	Data Raw: 13 56 58 73 6a 0e a1 a2 9e e5 67 4d 6e 19 aa d3 99 48 81 57 95 a9 c3 d4 08 20 72 32 f4 3e 69 54 60 56 37 b8 cd 52 28 b1 a8 c9 cf 1a e0 ff 2b a0 6f 36 f3 27 63 c5 c8 42 b0 8f e6 06 eb 34 e7 b7 d6 ce b9 dd 7f 87 83 8b e3 bf 9a ae 54 09 5d 61 5b 51 64 3c 33 77 71 38 2c 8e 85 ee 72 54 49 16 a1 38 e1 12 1c 8e 30 3e 45 b8 3f f9 2a 45 a8 e7 97 a6 95 23 cf fa 37 27 8d ec dd fd 86 53 09 0c 0b 6f 63 fb ca b7 ed 5f 8b 37 26 23 2a d1 2b 29 bd b3 a0 d0 2b 34 61 01 b0 41 36 b6 63 8c e7 79 b1 d9 a3 86 66 28 62 19 46 e9 e6 e4 ff e9 b4 24 3b 7b 20 59 41 c3 31 76 50 2d 74 47 f8 ff 8c e1 c0 b1 15 cd 22 fb b0 95 db 01 43 c2 66 2d 20 57 82 f7 ae 02 9a d4 99 ce 75 4b d6 b0 4b 08 e3 23 ad ed 0e e4 ac d6 2a 4b 86 3c db fc 04 20 28 d1 df eb d4 f7 d7 ff 5a fe 60 d9 ab 0c e5 b5 5b Data Ascii: VXsjgMnHW r2>iT`V7R(+o6'cB4T]a[Qd<3wq8,rTI80>E?E#7'Soc_7&#+)+4aA6cyf(bF$;{ YA1vP-tG"Cf- WuKK#*K< (Z`[
2022-06-09 13:31:55 UTC	202	IN	Data Raw: d1 42 17 25 9f a1 1e 6f 20 1f 43 f5 ea ba 6e 95 37 8b dc 3a 05 7c f5 79 83 4b 74 b2 26 f7 24 a7 d8 73 af 7c b9 f5 77 50 88 f9 c4 5c 69 5d be 24 5a 12 40 2b 01 cd 0c b6 b6 d5 80 39 30 78 5d bb 72 b8 ad 25 be c8 d5 2b f6 07 52 55 ac 45 6d 87 2b 16 dc b0 aa a3 3b 77 a0 75 ac c0 39 2f 49 bc 05 d4 37 c8 37 d5 a6 b9 51 fe 6c 75 5c a6 79 d0 0e 57 8b 10 4e 29 eb 38 89 dc b0 76 59 ee 2a 75 b4 6d 02 94 a1 b1 bf e9 e2 a9 e2 04 ba 6d 28 09 66 06 ca 45 bd f2 ff 47 38 b2 0c a2 6a 23 49 ac bd 52 8e cc 17 f9 7a 0c 23 71 b8 df b7 df 01 06 09 84 29 59 a0 d7 24 8b 0b e1 d0 9b 86 63 5f 25 bf 6d 2d 7b 21 30 2d 60 0b 3b e1 e5 85 ac f1 14 68 79 56 f5 e4 c1 5d 48 76 21 09 cf 1f 74 1c 61 bd 5c 4b ef c5 10 1e 06 a5 5b cc 31 7b 1a 03 22 e7 6a 20 36 40 ec 96 33 54 30 25 a5 13 bf 0f Data Ascii: B%o Cn7:\|yKt&$s\|wP\i]$Z@+90x]r%+RUEm+;wu9/I77Qlu\yWN)8vY*umm(fEG8j#IRz#q)Y$c_%m-{!0-`;hyV]Hv!ta\K[1{"j 6@3T0%
2022-06-09 13:31:55 UTC	203	IN	Data Raw: 17 64 ba 53 4a e3 78 1c 4e 34 44 bd b3 c0 4b d3 21 b4 b9 d4 f9 09 21 d9 ab 76 89 ac 68 41 60 db 45 96 b7 58 10 90 95 00 02 bc ca 2d 0d a2 50 0d ed c4 3a 9f 82 db d1 a4 1b 7f 43 ea 3a c2 c2 57 cd 7a 53 bd 73 c4 64 4f 0c 3a 08 10 b6 5f bf ab d4 cb 60 8a 3a 74 c1 61 ce b7 d0 91 0b 1e a5 86 b2 cd d8 b3 fa a2 16 81 ae 0d bc 49 59 f0 04 34 c7 0c 23 20 10 90 f8 2a d2 1c cd 2b 3c 03 ea 71 00 6e b0 6f d4 00 b8 75 0a 55 08 04 cc 63 77 77 8f f3 78 24 64 b5 b3 f0 1b c6 bf 0e 9d 7d cf 81 fb d6 c1 39 34 cc fd 9a ed fc 03 39 70 ac 2a 54 3a fa 25 47 15 51 e6 85 5e 61 9f 8b 15 87 10 e4 03 dd cb 27 a8 e7 65 83 1e f4 62 f6 a8 04 14 14 8a 6c 2d d5 dc 2a 58 dd 4c e7 25 2a c5 ba 08 19 b8 2e 85 da 8a c8 5c 8a 40 70 52 24 54 e5 2a 4b d6 18 cd 05 bd 08 b8 68 70 87 c0 88 c8 e8 c1 Data Ascii: dSJxN4DK!!vhA`EX-P:C:WzSsdO:_`:taIY4# +<qnouUcwwx$d}949pT:%GQ^a'ebl-XL%.\@pR$T*Khp
2022-06-09 13:31:55 UTC	204	IN	Data Raw: 82 48 b8 45 ab ae 3f 89 ab b0 11 7d d1 0a c8 9d a1 bb ad dc ee bc d9 a4 3d 7d 42 9e 57 76 de aa 55 65 f0 e5 68 9a 17 83 da 00 47 1d 8a 93 46 90 85 89 91 e6 3b 9d 40 32 53 a5 d8 01 9c 80 40 cb 66 20 05 fe c2 cb fc 6e cd e2 32 d0 23 8d 8e e6 1e b9 f1 13 66 dd 59 3a 5d bf 4a 79 e5 08 48 5d 1a ad 95 2d b7 98 47 d7 8c 77 67 76 27 a1 07 04 e2 7c 88 c4 30 65 f1 0a c3 5f 37 88 f0 d2 90 ab 6e 2b 66 1e df d9 b8 e2 e0 59 3c ab e7 28 cd 0a aa 3f f6 ec 92 10 a9 91 79 f2 f9 a1 25 77 6d ac 2b 6a 0e 83 26 26 21 e8 a2 63 93 5e a1 75 27 9d 62 fc 26 f1 68 9f 6d 36 10 04 c2 a4 9a ce fb b9 2a 32 0c 3f 1c b4 41 c7 49 1c ab b6 c6 b2 35 46 06 57 be d8 99 5b e2 c6 9c 06 a8 42 f5 55 7a ef 49 ce 45 94 93 21 92 6d 3a 8b d2 fb 9c 78 68 d4 65 97 dd c7 ae 6e bc 7a 7c 5d 25 0c 8d 90 6d Data Ascii: HE?}=}BWvUehGF;@2S@f n2#fY:]JyH]-Gwgv'\|0e_7n+fY<(?y%wm+j&&!c^u'b&hm6*2?AI5FW[BUzIE!m:xhenz\|]%m
2022-06-09 13:31:55 UTC	206	IN	Data Raw: b2 cd ee ff 5f 06 0f e3 a9 5d 51 71 41 13 9a 6e 88 d1 5f f0 51 19 e7 07 12 3e 62 de 98 34 67 a1 19 a8 ad 13 b1 2d ae 01 30 26 07 45 23 63 a6 dc 69 38 bf 09 76 52 2f d5 34 ff 18 72 9e 8a eb 08 9a 50 37 95 a3 4b 03 73 4f 57 05 b5 4e 33 d5 8f 1e 76 45 5c 62 71 86 7f fb 51 df 35 18 12 8d 5a b9 da bd 56 79 35 07 5d 8d 13 bd d6 f6 e0 68 2f 09 69 29 c5 fb 9d a6 8e 2d 2f b4 b0 e3 a1 6b b5 4e ac d1 8e be c8 c4 1c 13 23 65 ec 29 22 50 17 ed f1 fc 08 09 7b fd 4b 53 51 90 78 89 b2 b8 9d a6 3e 61 e3 26 b5 ed b6 8e 3c 61 2c eb a6 8c 17 48 45 48 cf f2 f3 89 0d 02 1c 5d 94 25 2c 65 44 9e b3 55 7e 57 bb 6c fd 17 8f 03 da 9b ab 3b 63 be e1 98 93 f7 07 60 fe 9d 3f 20 a1 be 70 91 4d 0d b2 0b 6c eb ea 2e 82 50 b2 57 37 f5 06 a1 d9 a3 c8 2e 1a 2f f4 57 9c 23 3b 57 f5 64 2a 96 Data Ascii: _]QqAn_Q>b4g-0&E#ci8vR/4rP7KsOWN3vE\bqQ5ZVy5]h/i)-/kN#e)"P{KSQx>a&<a,HEH]%,eDU~Wl;c`? pMl.PW7./W#;Wd*
2022-06-09 13:31:55 UTC	207	IN	Data Raw: a9 0b d0 94 08 cd dd 2b a1 86 0b 61 ca 2f bb fd ba ba f0 3b 37 7a 44 d8 5a ce b7 11 7b d7 74 8f 4d 09 4d 70 97 a3 09 69 d8 9a 6b bc 4e 50 77 88 d8 91 cd ba f0 48 60 54 0d f6 24 32 33 1b 96 86 66 1e d3 f6 c0 d0 da 30 9a 7a 1f c6 c8 3b ad a1 a6 9e e7 22 f0 5d 8c f2 aa 82 2a 8e 59 b2 a4 e9 10 2c e4 51 a1 57 81 d8 1b e0 0e f4 b8 6c 53 e9 b5 c6 c5 4f 8e 72 57 24 35 06 5d 4b a1 56 d9 bb 42 e2 16 85 dc 9a 85 49 b8 18 8a 18 6b da 7c df 3d b2 26 c1 5b d4 e8 ea de d1 de c5 35 38 45 d3 52 a4 30 de 8b 47 6b ab 73 1b 53 ee f1 c1 6e e3 f2 6e 11 6e 75 e3 fa f1 45 78 4b 8d d0 7f 72 f4 a2 ac 8c 7d 87 7e 6d 1f f1 d9 60 10 8e 47 34 02 75 7b d0 d1 f1 3d 5d 36 66 a4 00 f7 e2 08 d7 a8 0a 42 6f d6 1e 26 3c 0d 99 c3 b1 63 3b 32 a0 ae 10 50 24 c3 c7 83 7b 6d 57 5f 63 1b 9e f5 c2 Data Ascii: +a/;7zDZ{tMMpikNPwH`T$23f0z;"]*Y,QWlSOrW$5]KVBIk\|=&[58ER0GksSnnnuExKr}~m`G4u{=]6fBo&<c;2P${mW_c
2022-06-09 13:31:55 UTC	208	IN	Data Raw: 66 32 14 90 a2 b4 04 97 59 a0 c4 e7 2f b8 c2 df bc 99 7f 65 84 df b7 b9 b1 7c 76 de 2f 16 1f b8 22 de ff d5 70 e5 80 d8 7e e5 88 8b f1 54 e3 f4 38 1e 4f 4b f3 72 2a d2 0f 9e dd 2a 0d 86 83 1d c0 13 34 68 69 e0 40 51 9b 99 33 67 22 1f d1 06 6a b2 9f 1c 3a f4 24 fb 95 3b 1d 3a 94 fd a4 66 e0 cd fc 96 f7 8c 2c 64 bd ae ae 7a cd c8 c8 9a d9 c6 d4 8c ea ba b3 03 b0 ab 1a 75 25 e7 a0 cb a3 7d 4f f5 26 b3 be 82 69 19 32 0f 55 e8 2c 0b 40 02 cd 6b ea 6a 0f 25 75 3f db 1a e3 34 a7 4e 9c 4b 6d f6 de f9 d0 64 3f 35 c9 dd 93 3b ca 30 99 59 ef 9d da fc 65 7d 73 5a f4 80 1b 87 aa 3e 45 c6 ab 55 73 5e 14 dd 9c 76 7b a0 7f eb 04 a4 a6 66 51 3c c4 90 a1 89 56 50 fc ef c3 ca 54 0e 66 cd a6 ee 3f a5 90 f5 6d d8 70 d9 50 2a 00 c8 26 01 a6 f7 d0 51 87 47 89 f9 7b 63 9c 03 4a Data Ascii: f2Y/e\|v/"p~T8OKr*4hi@Q3g"j:$;:f,dzu%}O&i2U,@kj%u?4NKmd?5;0Ye}sZ>EUs^v{fQ<VPTf?mpP&QG{cJ
2022-06-09 13:31:55 UTC	210	IN	Data Raw: 8c 47 e1 35 9c 09 74 5e 1d c4 86 24 af de f2 6a 2d 61 e3 a0 8d 67 1a 5e c1 0e ca 90 43 a4 12 96 85 83 41 02 73 d6 54 3d 6b a1 54 53 2c 7c 0e 80 72 e0 e5 0f 9a 39 49 b7 0f bd 42 cf 98 07 d0 ac 86 f6 27 01 c2 ec 76 47 00 41 b6 ce 11 40 90 cd 74 04 10 c0 cc 68 51 d5 4e 6a 86 26 18 80 05 e5 54 3d ce 03 78 74 3b 32 5d af 12 50 a1 7c 54 2d 07 09 4c c3 9e 83 92 c9 e7 bf f1 65 31 14 e3 dd bd 04 57 c3 5a c5 9a 2a 4d 72 48 35 3f 84 f1 82 3d e0 00 fd d1 6f b0 03 ac 22 eb c6 39 d1 4b 35 ce f8 3d ab 27 6b c9 2d 2a 07 95 84 e8 41 a6 12 0f 16 45 7c 09 fe 20 de 20 71 d2 94 13 91 5f 3f 5c a3 37 25 1e f6 8e 7c 4d 36 b0 66 aa 2b 93 93 2b 92 53 2a 7d e7 57 00 5f dc 5d 33 aa a8 fa b6 66 6d dc ae d8 d2 cb b3 d2 dc 6d 20 77 21 96 97 ee f7 e5 2e db 52 23 89 e9 ac aa 3b c6 ed 1f Data Ascii: G5t^$j-ag^CAsT=kTS,\|r9IB'vGA@thQNj&T=xt;2]P\|T-Le1WZMrH5?=o"9K5='k-AE\| q_?\7%\|M6f++S*}W_]3fmm w!.R#;
2022-06-09 13:31:55 UTC	211	IN	Data Raw: fe 0d 39 ab 56 1c 7d ef 09 94 ce 8f 56 d1 77 34 71 55 e4 33 26 6a db c4 b1 48 59 62 bc 20 fc b9 88 0b 15 bf 74 15 74 8d 54 9c f5 88 37 cf 81 f2 92 ab d9 61 16 72 42 77 50 39 3f 29 db 75 95 e9 8b 54 2f d9 61 a3 95 8e 41 31 39 96 11 b1 6b aa 4d 0a 5c d3 e4 50 dd df 73 9b 3c d8 54 61 9e 8d d0 e3 40 82 3c 3f 4d e2 0b 28 10 7f ea 08 bc 2e a1 2c 27 25 3f 2c c7 25 81 61 1c 7e 65 ce 05 eb 12 8e c0 9d 8e 55 e1 96 30 b5 cd 2f 7a 51 d5 f6 28 d1 b8 fd 93 f7 a4 61 99 ac aa 70 3a 2e 36 ab 6a c2 ff 64 46 40 5c 56 ae 34 a6 c9 7f 7b d3 52 69 ec fe 19 0b 88 cd 38 e9 af c9 aa 06 6e 75 fd ae 46 ef 98 4d 5f 86 a7 3d a6 bd f5 5a 38 e1 a4 03 48 e3 ee 8a 6c 87 73 79 35 6b 25 f5 cc 7c 17 28 f0 69 39 02 0b 22 d9 36 e4 ba 7d d4 8b 7e 57 4b 84 db 9f 04 91 68 59 a9 6b 8a ca f6 17 a4 Data Ascii: 9V}Vw4qU3&jHYb ttT7arBwP9?)uT/aA19kM\Ps<Ta@<?M(.,'%?,%a~eU0/zQ(ap:.6jdF@\V4{Ri8nuFM_=Z8Hlsy5k%\|(i9"6}~WKhYk
2022-06-09 13:31:55 UTC	212	IN	Data Raw: 38 c7 97 f3 78 d6 0c 98 9d f4 fe 3f 1f b1 7b 7d a2 ff c0 ee df 46 5f 84 fc e1 c7 a0 99 7a f8 af 89 6b 74 a9 c9 b1 f0 88 37 b3 ca da 82 7c 74 fb a7 2b 61 ae 6d b8 3c 78 07 65 24 82 e9 65 96 8f e3 c9 8d aa d7 3c 5b 1c b9 54 f7 a6 ff 8f 58 5b 1c fe e1 9a 1b 0b 9e 7f f8 03 a3 d9 f6 00 1b bf 73 bb 1d 56 c3 cc 8b ab de a7 55 9e c9 2a 11 b3 e1 8c 68 97 53 a9 4b 3d 46 65 cb 73 77 20 75 59 e9 6f cd df d9 af 6e 51 ab 17 b3 3d 4e 1b 45 3a 5b d2 28 7f 17 74 5d e5 0d 6b d7 7c e7 40 91 d9 bf 75 5a 5c 39 7b 68 81 b1 8f 76 10 7f 18 80 14 da dc 95 d3 86 2e da a1 fa 73 61 83 89 24 75 2b 9f 71 b9 19 77 3a 23 e3 1f e6 3f e5 65 fa 54 89 33 3d d0 14 ac 07 d0 bb d0 21 b5 70 ec 50 4c 60 cd 3a 85 93 dd d0 52 03 3b 0c d8 67 08 ca ae 0b 9d 06 46 68 61 9d ce 90 3b af 14 07 13 cc 13 Data Ascii: 8x?{}F_zkt7\|t+am<xe$e<[TX[sVU*hSK=Fesw uYonQ=NE:[(t]k\|@uZ\9{hv.sa$u+qw:#?eT3=!pPL`:R;gFha;
2022-06-09 13:31:55 UTC	214	IN	Data Raw: 3e 7f 72 92 cf 9b 66 40 07 1f 3d 9a e2 42 46 99 8b ef 43 42 00 b1 a9 89 89 83 87 26 27 87 46 7d 19 40 a9 26 d3 c8 ff 19 04 84 79 d7 75 62 e2 d0 c1 c9 c9 43 3f 27 ab 1e ea e5 f1 e7 18 53 01 e6 34 39 2b 97 c3 93 e4 b1 43 f8 ae b3 ed 49 c3 ae f0 a4 d9 1f 8c 2b d7 e7 98 eb 66 05 2f 52 ab 06 55 ea 0d cc 12 ee 43 0b b0 01 46 75 3a 14 43 11 2a a3 7d 0c 86 54 3a 1f ba b6 7d 7b c2 dc dd bd 01 e2 b2 b7 d4 75 aa ce d7 17 f8 95 ac 65 5b 21 ae 96 3e fa 3f 0b 8b c4 0f e5 fd da b8 b8 22 c7 4d 0a 38 67 7a 83 f4 30 5c 48 6b 83 d4 06 5a b3 3a c4 68 e5 02 ad 1b 7e 99 03 40 13 aa 2b 1d f4 23 ab 4e 9d ea 0c d6 66 6a be e7 18 79 b5 ee e5 8b 69 6f c0 21 84 42 f7 09 fe f1 f4 b7 93 b1 52 27 a9 35 3e da 13 03 60 da f2 5b 21 1a c2 c4 54 18 88 60 6d 1f 43 01 9a 9d 0b 49 85 d1 9d c3 Data Ascii: >rf@=BFCB&'F}@&yubC?'S49+CI+f/RUCFu:C*}T:}{ue[!>?"M8gz0\HkZ:h~@+#Nfjyio!BR'5>`[!T`mCI
2022-06-09 13:31:55 UTC	215	IN	Data Raw: 6a 0c af eb b7 1b 53 1f 5f 45 dc 83 22 8e aa 8b 8a 40 9e 7e 82 9f e7 b9 08 3e ad 38 36 ba f1 23 ce 79 b1 da e4 e5 5b ef e8 63 f2 53 ef 84 a5 d9 c5 ac 96 90 94 f2 f2 23 ad 53 4a 94 47 5a fb ae 79 19 76 76 12 dd df 53 f9 d1 8f 1a e6 89 9d 70 b8 77 61 54 9a 9e cf f5 c5 2f 13 2c 1f 14 0a 39 27 4a 6b 76 25 25 2e 86 7e 6f f2 5b cc f3 9f 20 e8 a1 a7 fc 1c 9c 13 c2 52 b1 42 6a a2 9f 53 e8 c8 80 2a 24 27 f8 e8 85 81 08 a9 70 c3 a7 53 a5 75 00 0b e0 2b e7 07 39 18 5c ac ed 5f 66 2b e5 f2 fc f9 38 f5 10 75 5c 2c b6 ca 14 8f d3 74 e6 e5 f0 70 9e d1 8d d0 1e 6b d8 ae 13 4a 30 68 f3 28 5d 18 4e 11 84 51 c8 76 f3 b3 57 1f ac 81 c7 cc 37 f3 0c 95 38 ab 83 36 3a dc d6 dd a3 cf e2 0b b7 f1 57 63 93 af 59 5f 69 3e fa ac 8c dd 22 91 df 52 a1 10 e7 f5 92 e2 81 28 d3 65 18 5d Data Ascii: jS_E"@~>86#y[cS#SJGZyvvSpwaT/,9'Jkv%%.~o[ RBjS*$'pSu+9\_f+8u\,tpkJ0h(]NQvW786:WcY_i>"R(e]
2022-06-09 13:31:55 UTC	216	IN	Data Raw: 93 64 5c 6a 17 6d 1a 66 9f e4 18 4f cf 61 25 f2 39 9a 91 88 04 63 4b 9b 78 d3 d0 0f db a5 c5 21 6b a9 25 48 81 de 44 6e 93 10 7f fc 7b 59 dc 22 93 17 7b 6e 5f d6 7d 0a df 29 39 83 3d 0d 5f 2f fb 1e 87 5a ce 28 e9 f9 3e 16 6c fa b6 ad f7 59 9e 06 9f d6 56 f7 8b 1b 06 67 51 23 a7 df ad 3a 51 c4 01 95 17 c8 62 77 07 83 c7 f7 d5 24 be 1b 7a 77 b1 f0 d9 ae 8b 23 bf bb e3 7f 55 14 98 3f 7c c5 f0 ef 47 08 d4 ce 05 84 68 c1 1e 7f 7a fc 7b f9 6f ba 24 77 f1 d7 cf 9c 9d b4 ba 04 1c 29 7c 56 68 89 da 3f bb 8c 0d 14 5a 56 8f 37 be 25 9f fc 47 fb 6f 2f a3 d7 86 87 f4 e9 45 cf 22 b9 4b d3 b2 85 a0 ec 15 b5 08 6c 06 a5 70 37 36 ce 00 1f 2d 7a 0d 21 c1 6c 80 34 17 6e 3e 94 bc 24 5c e1 d7 7a 56 3f 73 7a fb 71 65 6a ec 51 e7 eb e9 5d 6d 8b 9b 04 e6 5e e6 3d 5e b5 0d e4 a7 Data Ascii: d\jmfOa%9cKx!k%HDn{Y"{n_})9=_/Z(>lYVgQ#:Qbw$zw#U?\|Ghz{o$w)\|Vh?ZV7%Go/E"Klp76-z!l4n>$\zV?szqejQ]m^=^

Target ID:	1
Start time:	15:31:40
Start date:	09/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	3
Start time:	15:31:43
Start date:	09/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,11442245268399047705,5675396249055895647,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1936 /prefetch:8
Imagebase:	0x7ff6a7220000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\52427726-e3c5-42d6-8ae0-e4b46d1f6a05.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6b4f5c06-06bf-4636-99c0-6d6b71f7d1e3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1016328c-3bd4-453c-8e43-3a38f77db1b9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\525d53a6-b749-46a8-be6d-07c348891ccf.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7cba7972-fd12-45e3-bd18-4efaf84411db.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\8c0d0bb5-1994-4ef6-b902-6b499f699f1b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\9a493237-2958-47c0-9ef8-347859b6f861.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\d4378885-3131-4b0e-a811-533a4e3bef13.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f635ab01-df94-4ba5-b67d-77669938579f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\b34c758d-1937-42a0-8f02-7d6fd1db8f48.tmp

Windows Analysis Report
https://f.xdref.com/?id=3D19LAKY1n039892&from=abuell@carollo.com&to=rmorling@datateam.co.uk&url=http://abuell.myafricawealth.co.za?id=abuell@carollo.com

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre