Edit tour

Windows Analysis Report
https://stammeszeit.ch/

Overview

General Information

Sample URL:	https://stammeszeit.ch/
Analysis ID:	1527896
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,2912820162522885628,7329998329596348689,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stammeszeit.ch/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 07 Oct 2024 09:04:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Mon, 07 Oct 2024 09:04:35 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXsTrj4ACoqR%2Bp%2BIyi9Zorx4r1Hgg9fBkhDT1gNXJx25F%2BD4SIuMP4rS5qHvO17TpdrwRfVUNMXG%2FzdxDiHEfGlYy6mEAupRxgdy%2BhohPq9RjElgWpnTgV7tCpOsBqiDslf%2F3lasJS4tFVjV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cecb91e1be5186d-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 07 Oct 2024 09:04:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Mon, 07 Oct 2024 09:04:38 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rFE3bxdJflwufxRvoxeTneulPeOTV5G9fsW9iy2pIZq%2F0djDIkk2wXAHWyLEqA5qfFeM6%2FhSgVX%2BJEFMD%2BY4AWdl7YSYFC3Tmt7vdV7%2BcVTTJwAawPKpYAoZOcDjatuZMQY2Ig9WDSdXL5Ft"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8cecb9316bb64232-EWR

Source: chromecache_58.2.dr, chromecache_61.2.dr

String found in binary or memory: https://www.cloudflare.com/5xx-error-landing

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49786 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/21@12/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,2912820162522885628,7329998329596348689,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stammeszeit.ch/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,2912820162522885628,7329998329596348689,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
billings.7712billings.com	188.114.96.3	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
stammeszeit.ch	188.114.97.3	true	false	unknown
www.google.com	142.250.185.164	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://stammeszeit.ch/	false	unknown
https://billings.7712billings.com/cdn-cgi/styles/cf.errors.css	false	unknown
https://billings.7712billings.com/cdn-cgi/challenge-platform/scripts/jsd/main.js	false	unknown
https://billings.7712billings.com/cdn-cgi/challenge-platform/h/g/jsd/r/8cecb91e1be5186d	false	unknown
https://a.nel.cloudflare.com/report/v4?s=dBb%2BJjBpSBAJNrfMhPd%2BrfDmDuKdrj6iPRf%2FObgUSH2hFr6OqMTuIKNmT%2Fem6bSdvaeA%2BiVj%2B%2Bms%2FmFIOYkQeDWnqFtT9QFmbxaESpKBv%2Fk3%2BpHUaEH21Xlc0Okz0q9VptjZuh3wBJx3Z5CN	false	unknown
https://billings.7712billings.com/favicon.ico	false	unknown
https://billings.7712billings.com/cdn-cgi/images/cf-no-screenshot-error.png	false	unknown
https://billings.7712billings.com/en-US/captcha.php	false	unknown
https://billings.7712billings.com/cdn-cgi/images/browser-bar.png?1376755637	false	unknown
https://a.nel.cloudflare.com/report/v4?s=uXsTrj4ACoqR%2Bp%2BIyi9Zorx4r1Hgg9fBkhDT1gNXJx25F%2BD4SIuMP4rS5qHvO17TpdrwRfVUNMXG%2FzdxDiHEfGlYy6mEAupRxgdy%2BhohPq9RjElgWpnTgV7tCpOsBqiDslf%2F3lasJS4tFVjV	false	unknown
https://billings.7712billings.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/5xx-error-landing	chromecache_58.2.dr, chromecache_61.2.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	stammeszeit.ch	European Union	13335	CLOUDFLARENETUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	billings.7712billings.com	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.23
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527896
Start date and time:	2024-10-07 11:02:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://stammeszeit.ch/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/21@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 40.126.31.67, 40.126.31.69, 20.190.159.0, 20.190.159.71, 20.190.159.75, 20.190.159.2, 40.126.31.71, 40.126.31.73, 93.184.221.240, 142.250.181.227, 142.250.185.206, 66.102.1.84, 34.104.35.123, 52.149.20.212, 13.85.23.206, 20.3.187.198, 13.95.31.18
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://stammeszeit.ch/

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://billings.7712billings.com/en-US/captcha.php Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Sorry, you have been blocked You are unable to access 7712billings.com", "has_visible_qrcode":false}

Input

Output

URL: https://billings.7712billings.com/en-US/captcha.php Model: jbxai

{
"brand":[],
"contains_trigger_text":false,
"trigger_text":"",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"text":"Sorry,
 you have been blocked You are unable to access 7712billings.com",
"has_visible_qrcode":false}

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 08:04:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9753993155001264
Encrypted:	false
SSDEEP:	48:8XAdoT6LsKH5idAKZdA19ehwiZUklqeh6y+3:8vvwBy
MD5:	194D432FC941D2415D3BCEC3D83662D6
SHA1:	06004184ED05DCEA26821025F2782BB9E17C16BC
SHA-256:	14363671FD0C683B7D7D1A371E95A632BF03F498C2BF89C1DFE9ABA6F3717466
SHA-512:	94B1E3D61E899D9B6EFDF79113574754FFE67D195CA5DB151398125B204C2599984A23A568F26AAD4A12B7D9C375240936B0E8ACAA5204A09AE6EB3E6527C6AE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?V-....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGY.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 08:04:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9919687326374307
Encrypted:	false
SSDEEP:	48:8ldoT6LsKH5idAKZdA1weh/iZUkAQkqehxy+2:8QvK9QQy
MD5:	AFBD3C9E9D11F9CF2D7C52CEA3B9E62F
SHA1:	0D0782877F08CC84A647E116654135454B1B8917
SHA-256:	F16DD402743E7EBAD85ACABDF7856878208C7654D3DAB19724538C1BAAEF33A2
SHA-512:	9B4F7A768C85145239F209229621420FDDBA4765C1E4352FF7789C1F7C651528319D388187E1FE77304FF11EBBB1E8C4E06BC066A9B06E7AF5E4A49C3466E329
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....U!....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGY.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.000529020817168
Encrypted:	false
SSDEEP:	48:8xFdoT6LssH5idAKZdA14tseh7sFiZUkmgqeh7s/y+BX:8xwvQnVy
MD5:	5078CD8FA96FFF3206B2FC6E4C353AA2
SHA1:	333DA622F2F88A36F6195B1F6542B417BE100C31
SHA-256:	14C5D5335CFC6210E248565390E8DD4D71FCB45E49858EBAF8FA22197E420960
SHA-512:	730D1A3768A9113D4532BB01F8AF5DC9FBD3F88F38345BFFE3FC4DB47982B9D1C55C9CB8CBFFFA7EF63E236A418544834A8DDACFC2EC96FA333A97FC321B9476
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 08:04:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992947740665478
Encrypted:	false
SSDEEP:	48:8PudoT6LsKH5idAKZdA1vehDiZUkwqeh9y+R:8PZvRHy
MD5:	4D080A92123A4CF4518D2AF7DC97CB2E
SHA1:	94C4DE187D262B9DFFD8188361686D1007AE9810
SHA-256:	E871B05621BA8FCEE9066068F0E2A51A0EF54061F1D0F68B3BAB2071F14534BA
SHA-512:	FE659A62011A82D79DA4D2E2A84C497BBEFC168718D3911CE97FD7471295D9C51F94325EAA24EC762D018BF281F4D5B8EECE8DC63DE61763C8A23EA7DC4448CA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....,.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGY.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 08:04:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9813064764984865
Encrypted:	false
SSDEEP:	48:8cdoT6LsKH5idAKZdA1hehBiZUk1W1qehjy+C:87vx9Dy
MD5:	CD9DA11749F48E8D1CB1BCA8A674A1AE
SHA1:	90ECED2CE4F3E6CBD8DF1C555ED49224D65B06F6
SHA-256:	CBD01AB8D31027E79EE15B95AF5B643F50C2303C716BE096EAD82B282972542B
SHA-512:	E196243A39F7C28A5CC6E83015751C169BBA4BB9A4B5775D8613D7962ED851D39651C70769721D13BD5439CA9E7588E765DA5EFEFA8700812143FAB6FA5FD85E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....'....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGY.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 08:04:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9892065881424212
Encrypted:	false
SSDEEP:	48:8+doT6LsKH5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVy+yT+:8JvtT/TbxWOvTbVy7T
MD5:	DE44F4A5D33F56A770B36F3F5CE24740
SHA1:	29EE6B0B7BE876FD1D62C859E7F435DCAB62438A
SHA-256:	69AE9FD6F3BC9FDEB485C5FC910801F53BF60373E6305F94CDA7754AD59DA7E3
SHA-512:	EE0327B3AD90EFFA958155E51A6771550C2B1F14C9430A56B998204DD161E225C427BD4A7E9064BB1FC9AE0A8F16845FC1782831530975D69F2B870B8C37EDB4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....W......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IGY.H....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VGY.H....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VGY.H....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VGY.H..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VGY.H...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........E..e.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 178 x 175, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3213
Entropy (8bit):	7.553565995366911
Encrypted:	false
SSDEEP:	96:35QRRzQqgtYCWBzmuvuLf33Pf309TxeL+vD+7SrQ9o6Br2eJk:GRRsqgOBzvcnM9TxVk9JCeJk
MD5:	0D768CBC261841D3AFFC933B9AC3130E
SHA1:	AFF136A4C761E1DF1ADA7E5D9A6ED0EBEA74A4B7
SHA-256:	1C53772285052E52BB7C12AD46A85A55747ED7BF66963FE1993FCEF91FF5B0D0
SHA-512:	CE5B1BBB8CF6B0C3D1FA146D1700DB2300ABD6F2BDBE43ECAAC6AEBC911BE6E1BCD2F8C6704A2CFA67BBB45598793DDEC017E05C2C37CE387293AAE08E7C342F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............n.t.....PLTE..........UU.@@.33..$I.@@.99.33.....''.$7.33.00.--..((.&&.$1....,,..)).''.&/.$..,,..)).((.''..)).((.''.&&.%,.$..)).((.''.&&.%.$.)).((.&&.&.%.$).((.''.&&.&.%).$(.$(.''.''.&&.%).$(.''.&&.%).%(.$(.$'.''.&&.&).%(.$'.$'.''.&&.&).%(.%(.$'.$'.&&.&&.&(.%(.%'.&&.&&.%(.%(.$'.$&.&&.&(.%(.%'.%'.$'.$&.&&.&(.%'.%'.$'.$&.&&.&(.%'.%'.$&.$&.&(.%'.%'.$&.$&.$(.%'.%'.%'.$&.$&.$(.%'.%'.%'.%&.$&.$&.$'.%'.%'.%'.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%&.%&.%&.$'.$'.$'.%'.%&.%&.%&.$'.$'.$'.$'.%&.%&.%&.$'.$'.$'.$&.%&.%&.%&.$'.$'.$'.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$&.$&.$&.$&........tRNS................................ !$%&'()*+,-./01235678:;<=>?@ABCEFHIKLMNOPQRTUVWXYZ[\]^_`adefgijklmnopqrsuvwxyz\|}..................................................................................................................

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (394)
Category:	downloaded
Size (bytes):	4517
Entropy (8bit):	5.0197835895038745
Encrypted:	false
SSDEEP:	96:1j9jwIjYj5jDK/D5DMF+C8MZqXKHvpIkdNO9rR49PaQxJbGD:1j9jhjYj9K/Vo+nxaHvFdNO9rO9ieJGD
MD5:	E33D23ACB25BF4DE52513B8A0E914F76
SHA1:	BA9F542D4CF348240361EC33E73950201F7BB032
SHA-256:	C404959A8F4D2B8F24950B5CE390A668C070A0747F38708F9754CD3FC35112D7
SHA-512:	7A155C29857221228F29F05EBA07A613860E17E870349534630D95831D92A86FA676ED87E37AFDA23A5A0CA3A4C0E6D1C1C3E120F3A55D0E59EDCC2BEEB4A386
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/favicon.ico
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8027), with no line terminators
Category:	downloaded
Size (bytes):	8027
Entropy (8bit):	5.787736425617027
Encrypted:	false
SSDEEP:	192:789mkaKELa5JiZ1FuZ9MPyRDPMSe7iMRJFie+yq8O:IQtQW1AZ9MPydkz7d3R68O
MD5:	A82AA30BAD05CE9FEEA5BC7390C52BFA
SHA1:	60702B778C2C4E164CD8267BD90F65B34166F7CB
SHA-256:	8D55ECDF2C9BE468E856EC867E9C57134A1A9E33980C33944212EAA7D5505A99
SHA-512:	3C599D87EB6103EE920DB1A18EFEB09FC44F2116BB1EF2320B0596D3A92B156575D6B56D9BAFFA0EBA5D5C70D27D136B23370E1157B7D32BD9899F14ED7BA049
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,f,g,l,m,v,x,z){V=b,function(c,d,U,B,C){for(U=b,B=c();!![];)try{if(C=parseInt(U(469))/1(-parseInt(U(404))/2)+parseInt(U(395))/3+parseInt(U(490))/4(parseInt(U(464))/5)+-parseInt(U(470))/6(parseInt(U(436))/7)+-parseInt(U(406))/8(parseInt(U(442))/9)+-parseInt(U(421))/10+parseInt(U(462))/11,C===d)break;else B.push(B.shift())}catch(D){B.push(B.shift())}}(a,966716),f=this\|\|self,g=f[V(443)],l={},l[V(457)]='o',l[V(452)]='s',l[V(430)]='u',l[V(478)]='z',l[V(425)]='n',l[V(431)]='I',m=l,f[V(397)]=function(B,C,D,E,a4,G,H,I,J,K,L){if(a4=V,C===null\|\|void 0===C)return E;for(G=s(C),B[a4(408)][a4(472)]&&(G=G[a4(423)](B[a4(408)][a4(472)](C))),G=B[a4(413)][a4(480)]&&B[a4(460)]?B[a4(413)][a4(480)](new B[(a4(460))](G)):function(M,a5,N){for(a5=a4,M[a5(465)](),N=0;N<M[a5(417)];M[N]===M[N+1]?M[a5(459)](N+1,1):N+=1);return M}(G),H='nAsAaAb'.split('A'),H=H[a4(501)][a4(449)](H),I=0;I<G[a4(417)];J=G[I],K=o(B,C,J),H(K)?(L='s'===K&&!B[a4(403)](C[J]),a4(438)===D+J?F(D+J,K

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 960 x 53, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	715
Entropy (8bit):	7.3533249502413565
Encrypted:	false
SSDEEP:	12:6v/7et+/37c7jvBjLg+UnhdeNdLI4dACGHJovQpMZP5ajgj7xbKwkRR/:Lu490+NdcCqJlpMZxajnwCR/
MD5:	226DCB8F6144BDAAFDFBD8F2F354BE64
SHA1:	3785CC5B3BF52F8E398177B0FF1020B24AA86B8C
SHA-256:	8C873472F4925D5D47521DB4D52532D2983E9CB1BDE8B43143A6CC6DB56C35DB
SHA-512:	ED898B12C4895F7ACEAAB443C1071E6376DB71B4DFDBD769F5F3BE71D562438A18B5E5DC36DD7CC610926E380603A894B2E81DF4302680C736A412BFD3360D3A
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/cdn-cgi/images/browser-bar.png?1376755637
Preview:	.PNG........IHDR.......5.......r....]PLTE........................................................................................9W)....tRNS...u... ........IDATx....n.0....#.......?.f....I.B..g........O...hW...Y^.<..v..E..."....@D;u.#.h....WD.u...nq..vL...J?T.(D..&JtZ`&.....e..!.'m..5..$p.$..k`....+wCk.N=..(<....[.I.O4&.56..kR..O0.H`...%.b.Q........D..X...L.D..(.bT..... ..b+5I.+....W^. .....Y.....L.Ob.&26..IR.$0.y.^6*/..D..X.0_`..s.}..+S.. ..../D......I...ew..Qh.Nn......u.t0k.fX..b.&.!.\..I.cf..RgKC+2.M....6.)o. ..`c..M....../a.&....".Q.....uU.]@....j.......O.'......."....t....d...?z..p.q.Y.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a/..Y.x.I....IEND.B`.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (945)
Category:	downloaded
Size (bytes):	5455
Entropy (8bit):	5.139185140369425
Encrypted:	false
SSDEEP:	96:1j9jwIjYj5jDK/D5DMF+C8MZqXKHvpIkdN9rR49PaQxJbKynx/IR:1j9jhjYj9K/Vo+nxaHvFdN9rO9ieJXnu
MD5:	F164D922555A25088D0572540C942E9E
SHA1:	65A777D8893C548E23DD37B85F9C28F54D08D579
SHA-256:	F7A1A31216DB4367457AEC3CEF32FFC64B383500E6EF69678000CC40580FC53F
SHA-512:	57D122D488451FDA8C1B6D7C636B2D44DE2738E19F005646A5DD52A6920F859E139A75C7F92707FBCFECE0C9FEBAE45296639E60A7831FCECFE4EE99D32D2DCA
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/en-US/captcha.php
Preview:	<!DOCTYPE html>. [if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->. [if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->. [if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->. [if gt IE 8]> > <html class="no-js" lang="en-US"> <![endif]-->.<head>.<title>Attention Required! \| Cloudflare</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />. [if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]-->.<style>body{margin:0;padding:0}</style>... [if gte IE 10]> >.<script>. if (!navigator.cookieEnabled) {. window.addEventListener('DOMContentLoaded', f

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 960 x 53, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.3533249502413565
Encrypted:	false
SSDEEP:	12:6v/7et+/37c7jvBjLg+UnhdeNdLI4dACGHJovQpMZP5ajgj7xbKwkRR/:Lu490+NdcCqJlpMZxajnwCR/
MD5:	226DCB8F6144BDAAFDFBD8F2F354BE64
SHA1:	3785CC5B3BF52F8E398177B0FF1020B24AA86B8C
SHA-256:	8C873472F4925D5D47521DB4D52532D2983E9CB1BDE8B43143A6CC6DB56C35DB
SHA-512:	ED898B12C4895F7ACEAAB443C1071E6376DB71B4DFDBD769F5F3BE71D562438A18B5E5DC36DD7CC610926E380603A894B2E81DF4302680C736A412BFD3360D3A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......5.......r....]PLTE........................................................................................9W)....tRNS...u... ........IDATx....n.0....#.......?.f....I.B..g........O...hW...Y^.<..v..E..."....@D;u.#.h....WD.u...nq..vL...J?T.(D..&JtZ`&.....e..!.'m..5..$p.$..k`....+wCk.N=..(<....[.I.O4&.56..kR..O0.H`...%.b.Q........D..X...L.D..(.bT..... ..b+5I.+....W^. .....Y.....L.Ob.&26..IR.$0.y.^6*/..D..X.0_`..s.}..+S.. ..../D......I...ew..Qh.Nn......u.t0k.fX..b.&.!.\..I.cf..RgKC+2.M....6.)o. ..`c..M....../a.&....".Q.....uU.]@....j.......O.'......."....t....d...?z..p.q.Y.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a.C...&0...a/..Y.x.I....IEND.B`.

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8028), with no line terminators
Category:	dropped
Size (bytes):	8028
Entropy (8bit):	5.764984500780075
Encrypted:	false
SSDEEP:	96:hi/DmDkFaNRx8cW4h2cA6+l9P8hBRVwSNazkyPNut789HbHW0fBpANpv:sDgBN8c72cn+lJ8DIlkQxtpWv
MD5:	5DDBA2FB27252D160047B4E7383C0243
SHA1:	AB523688153A4CAD9442BB487D9752FB1C0FF458
SHA-256:	E6D8070DFC8D8ED18C59F1270863C34EE8BD71D0D2E543AF1A01AD3E945FB0C6
SHA-512:	BA30DB68DA00378648E0AFA904A1596AFD3F58A911CD74FEA12A879A324DECADD7E4082394969BE79F7B751DC92715AC3165FAB601A06667C9783433C58A9812
Malicious:	false
Reputation:	low
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,g,h,i,j,n,o,v){V=b,function(d,e,U,f,C){for(U=b,f=d();!![];)try{if(C=parseInt(U(484))/1(parseInt(U(512))/2)+parseInt(U(509))/3+-parseInt(U(433))/4+parseInt(U(522))/5+parseInt(U(467))/6+-parseInt(U(445))/7(-parseInt(U(447))/8)+parseInt(U(456))/9*(-parseInt(U(500))/10),C===e)break;else f.push(f.shift())}catch(D){f.push(f.shift())}}(a,264082),g=this\|\|self,h=g[V(534)],i={},i[V(483)]='o',i[V(489)]='s',i[V(487)]='u',i[V(488)]='z',i[V(523)]='n',i[V(453)]='I',j=i,g[V(493)]=function(C,D,E,F,a0,H,I,J,K,L,M){if(a0=V,D===null\|\|void 0===D)return F;for(H=m(D),C[a0(451)][a0(440)]&&(H=H[a0(480)](C[a0(451)][a0(440)](D))),H=C[a0(506)][a0(511)]&&C[a0(457)]?C[a0(506)][a0(511)](new C[(a0(457))](H)):function(N,a1,O){for(a1=a0,N[a1(527)](),O=0;O<N[a1(444)];N[O+1]===N[O]?N[a1(437)](O+1,1):O+=1);return N}(H),I='nAsAaAb'.split('A'),I=I[a0(481)][a0(471)](I),J=0;J<H[a0(444)];K=H[J],L=l(C,D,K),I(L)?(M=L==='s'&&!C[a0(517)](D[K]),a0(537)===E+K?G(E+K,L):M\|\|G(E+K,D[K])):G(E+

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24050)
Category:	downloaded
Size (bytes):	24051
Entropy (8bit):	4.941039417164537
Encrypted:	false
SSDEEP:	192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk
MD5:	5E8C69A459A691B5D1B9BE442332C87D
SHA1:	F24DD1AD7C9080575D92A9A9A2C42620725EF836
SHA-256:	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
SHA-512:	6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/cdn-cgi/styles/cf.errors.css
Preview:	#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-w

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 178 x 175, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3213
Entropy (8bit):	7.553565995366911
Encrypted:	false
SSDEEP:	96:35QRRzQqgtYCWBzmuvuLf33Pf309TxeL+vD+7SrQ9o6Br2eJk:GRRsqgOBzvcnM9TxVk9JCeJk
MD5:	0D768CBC261841D3AFFC933B9AC3130E
SHA1:	AFF136A4C761E1DF1ADA7E5D9A6ED0EBEA74A4B7
SHA-256:	1C53772285052E52BB7C12AD46A85A55747ED7BF66963FE1993FCEF91FF5B0D0
SHA-512:	CE5B1BBB8CF6B0C3D1FA146D1700DB2300ABD6F2BDBE43ECAAC6AEBC911BE6E1BCD2F8C6704A2CFA67BBB45598793DDEC017E05C2C37CE387293AAE08E7C342F
Malicious:	false
Reputation:	low
URL:	https://billings.7712billings.com/cdn-cgi/images/cf-no-screenshot-error.png
Preview:	.PNG........IHDR.............n.t.....PLTE..........UU.@@.33..$I.@@.99.33.....''.$7.33.00.--..((.&&.$1....,,..)).''.&/.$..,,..)).((.''..)).((.''.&&.%,.$..)).((.''.&&.%.$.)).((.&&.&.%.$).((.''.&&.&.%).$(.$(.''.''.&&.%).$(.''.&&.%).%(.$(.$'.''.&&.&).%(.$'.$'.''.&&.&).%(.%(.$'.$'.&&.&&.&(.%(.%'.&&.&&.%(.%(.$'.$&.&&.&(.%(.%'.%'.$'.$&.&&.&(.%'.%'.$'.$&.&&.&(.%'.%'.$&.$&.&(.%'.%'.$&.$&.$(.%'.%'.%'.$&.$&.$(.%'.%'.%'.%&.$&.$&.$'.%'.%'.%'.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%'.%&.%&.$&.$'.$'.%'.%&.%&.%&.$'.$'.$'.%'.%&.%&.%&.$'.$'.$'.$'.%&.%&.%&.$'.$'.$'.$&.%&.%&.%&.$'.$'.$'.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$'.$&.$&.%&.%&.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$'.$&.$&.$&.%&.%'.%'.$&.$&.$&.$&........tRNS................................ !$%&'()*+,-./01235678:;<=>?@ABCEFHIKLMNOPQRTUVWXYZ[\]^_`adefgijklmnopqrsuvwxyz\|}..................................................................................................................

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 11:04:04.525715113 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.525897026 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.544158936 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.544174910 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.544589996 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.545136929 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.545187950 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.545231104 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.951793909 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.951828957 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.951910019 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.952116966 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.952116966 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.952157021 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.952174902 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.952244997 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.952541113 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.952564955 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.952579975 CEST	49726	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.952589035 CEST	443	49726	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.973095894 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.973181963 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:04.973400116 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.973472118 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:04.973490953 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:05.945056915 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:06.069886923 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:06.116905928 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:06.806384087 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:06.807219028 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:06.807308912 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:06.811539888 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:06.811558008 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:06.811613083 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:06.811630011 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.317970991 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.318005085 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.318042040 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.318094015 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.318099976 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:07.318180084 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:07.318180084 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:07.318655968 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:07.318702936 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.318733931 CEST	49728	443	192.168.2.5	20.190.159.23
Oct 7, 2024 11:04:07.318749905 CEST	443	49728	20.190.159.23	192.168.2.5
Oct 7, 2024 11:04:07.370903969 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:07.370945930 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:07.371047020 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:07.371885061 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:07.371916056 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.168539047 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.168741941 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.245148897 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.245227098 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.245707989 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.247104883 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.247162104 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.247175932 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.247508049 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.295413017 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.419251919 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.419358015 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:08.419406891 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.425335884 CEST	49732	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:08.425381899 CEST	443	49732	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:15.624546051 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:15.811963081 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:15.843178988 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:16.199150085 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:16.199237108 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:16.199322939 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:16.200951099 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:16.200995922 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.084460974 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.084552050 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.087764978 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.087776899 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.088087082 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.090305090 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.090406895 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.090414047 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.090711117 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.135400057 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.255347967 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.255405903 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.255619049 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.255651951 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.255655050 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.255733967 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.256186962 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.256208897 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.256536961 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.256552935 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.260057926 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.260139942 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.260205984 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.260375023 CEST	49739	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:17.260384083 CEST	443	49739	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:17.311089039 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:17.311209917 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:17.714073896 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.715459108 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.715487003 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.716618061 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.716680050 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718219042 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718219042 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718302965 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718317032 CEST	443	49740	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.718429089 CEST	49740	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718959093 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.718997955 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.719074965 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.719342947 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.719358921 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.729425907 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.729753971 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.729769945 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.730855942 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.731095076 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.731511116 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.731511116 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.731606960 CEST	443	49741	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.731612921 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.731770039 CEST	49741	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.732065916 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.732110977 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:17.732285023 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.738454103 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:17.738481045 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.179251909 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.188222885 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.188251019 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.188731909 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.190551996 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.190566063 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.203975916 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.226049900 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.252916098 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.289422989 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.289437056 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.289571047 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.289608002 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.290679932 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.290738106 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.290791035 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.290864944 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.383780956 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.383989096 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.384284019 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.384430885 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.388875008 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.388911963 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.426234961 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.426244974 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.440125942 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.470232010 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.487282991 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.487368107 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.487448931 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.931760073 CEST	49744	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:18.931791067 CEST	443	49744	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:18.968467951 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:18.968519926 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:18.968786955 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:18.968915939 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.968986988 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.974029064 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.974051952 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.974323988 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.974598885 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:18.974611044 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:18.976809025 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.978110075 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:18.978117943 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:18.978496075 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:19.023395061 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:19.151360035 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:19.151468992 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:19.151638031 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:19.152096987 CEST	49746	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:19.152142048 CEST	443	49746	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:19.341836929 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:19.341890097 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:19.341964006 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:19.347822905 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:19.347852945 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:19.435250044 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.435543060 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:19.435580969 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.436655045 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.436719894 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:19.828999043 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:19.829216957 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:19.829251051 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.829289913 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.876463890 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:19.876504898 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:19.922314882 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.130044937 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:20.132069111 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:20.132098913 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:20.133744955 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:20.133821011 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:20.145077944 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:20.145315886 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:20.215044975 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215121031 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215152025 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215173006 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215192080 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.215226889 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215248108 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.215440989 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.215491056 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.238404036 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.238455057 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.238527060 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.239500999 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.239523888 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.331756115 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:20.331794977 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:20.372903109 CEST	49747	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.372936010 CEST	443	49747	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.436445951 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:20.477694035 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.477742910 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.477818966 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.478210926 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:20.478228092 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:20.684756994 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:20.684806108 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:20.685045958 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:20.692615986 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:20.692631006 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:20.697416067 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.697889090 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.697901011 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.698987007 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.699049950 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.700237036 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.700330973 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.700517893 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.743395090 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.749372959 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.749383926 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.798850060 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.823462009 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.823597908 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.823673964 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.880673885 CEST	49749	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.880700111 CEST	443	49749	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.881411076 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.881460905 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:20.882013083 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.882396936 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:20.882421970 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.167301893 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.219975948 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.353184938 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.353281975 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.366086960 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.477490902 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.494529963 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.494579077 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.494847059 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.494879961 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.495176077 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.495341063 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.499174118 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.499216080 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.499547958 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.508483887 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.508683920 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.509464979 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.509613037 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.509665012 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.510030985 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.546614885 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.555411100 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.555424929 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.591411114 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.609766006 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.609838963 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.609854937 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.609888077 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.609900951 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.609925032 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.609942913 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.610089064 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.610135078 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.610141993 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.610505104 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.610557079 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.610563993 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.610723972 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.610765934 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.610776901 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.641073942 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.641153097 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.641201019 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.641546011 CEST	49752	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:04:21.641566038 CEST	443	49752	35.190.80.1	192.168.2.5
Oct 7, 2024 11:04:21.659276009 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.659300089 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700099945 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700134039 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700167894 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.700195074 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700254917 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.700268984 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700496912 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700555086 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.700562000 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700757980 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.700802088 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.700992107 CEST	49750	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:21.701005936 CEST	443	49750	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:21.735476017 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.735543966 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.735610008 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.735743999 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.735788107 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.735817909 CEST	49751	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.735833883 CEST	443	49751	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.775680065 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.775732994 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:21.775820971 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.776217937 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:21.776232004 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.010656118 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.010704041 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.010776043 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.011667013 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.011679888 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.012317896 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.012377024 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.012435913 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.026161909 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.026206017 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.169682026 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.169754028 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.170075893 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.170520067 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.170536041 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.411014080 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.411098003 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:22.415056944 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:22.415074110 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.415477991 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.418514013 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:22.459400892 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.487345934 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.489553928 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.530241966 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.536097050 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.540005922 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.540024996 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.540451050 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.540467024 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.540693998 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.540947914 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.541357040 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.541454077 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.541990995 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.542090893 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.542515039 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.542608023 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.587405920 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.587409973 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.626490116 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.627547979 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.627563000 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.628700972 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.628985882 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.629654884 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.629726887 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.629868031 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.629878044 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.639913082 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.639967918 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.640341043 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.640367985 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.640567064 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.640629053 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.641547918 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.641608953 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.642096043 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.649352074 CEST	49754	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.649379015 CEST	443	49754	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.650968075 CEST	49755	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.650985956 CEST	443	49755	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.687807083 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.687889099 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.688148975 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:22.693698883 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.693734884 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.693918943 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.694264889 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.694274902 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.695694923 CEST	49753	443	192.168.2.5	184.28.90.27
Oct 7, 2024 11:04:22.695719957 CEST	443	49753	184.28.90.27	192.168.2.5
Oct 7, 2024 11:04:22.748291016 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.748374939 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.769682884 CEST	49756	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.769720078 CEST	443	49756	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.771464109 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.771495104 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.771675110 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.771908045 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.771917105 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.772088051 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.773231030 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.773248911 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.773459911 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.773468018 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.774688005 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.774714947 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:22.774843931 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.775043964 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:22.775063992 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.171087980 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.183667898 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.183686972 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.184267998 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.184926987 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.185015917 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.185153961 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.222805977 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.223129988 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.223138094 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.224291086 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.224390984 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.224889040 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.224951982 CEST	443	49759	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.224960089 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225007057 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225007057 CEST	49759	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225347042 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225380898 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.225663900 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225821972 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.225846052 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.226252079 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.226547003 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.226557016 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.227689028 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.227798939 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228189945 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228189945 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228234053 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228260994 CEST	443	49760	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.228359938 CEST	49760	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228579044 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228601933 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.228724957 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228967905 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.228980064 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.231408119 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.237500906 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.237761021 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.237778902 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.238121033 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.238485098 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.238560915 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.238734961 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.283405066 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.319736004 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.319782972 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.319812059 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.319835901 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.319848061 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.319900036 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.319905043 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.320664883 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.320894003 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.321090937 CEST	49758	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.321105003 CEST	443	49758	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360095978 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360171080 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360199928 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360223055 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360240936 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.360249043 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360282898 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.360496044 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360526085 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360557079 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.360563993 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360596895 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.360605955 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.360707998 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.361346960 CEST	49761	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.361366987 CEST	443	49761	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.680900097 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.687868118 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.727411985 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.742361069 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.759025097 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.759036064 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.759234905 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.759252071 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.760453939 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.760468960 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.760503054 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:23.760514021 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:23.760571003 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.010952950 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.011159897 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.011627913 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.011791945 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.011987925 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.012005091 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.012037992 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.012054920 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.051912069 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.113255024 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.113303900 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.113481045 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.113766909 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.113779068 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.148366928 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.198930979 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.198945045 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.198987007 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.199002028 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.199055910 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.199069977 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.199070930 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.199121952 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.199162006 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.285372019 CEST	49762	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.285401106 CEST	443	49762	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.285877943 CEST	49763	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.285914898 CEST	443	49763	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.338735104 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.338781118 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.338841915 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.339235067 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.339250088 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.589858055 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.590513945 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.590545893 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.590936899 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.591363907 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.591459036 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.591705084 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.591788054 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.591813087 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:24.591859102 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:24.635423899 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.734148026 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.734222889 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.734476089 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.735338926 CEST	49764	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.735358953 CEST	443	49764	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.736262083 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.736870050 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.736896038 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.737977982 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.738049030 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.738564014 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.738585949 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.738630056 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.738637924 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.738802910 CEST	443	49765	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.738847017 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.738904953 CEST	49765	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.739027023 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.739053011 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.739114046 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.739607096 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.739615917 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.739993095 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.740017891 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.740073919 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.740546942 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:25.740564108 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:25.825001001 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:25.825119972 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:25.825213909 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:25.825912952 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:25.825951099 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.380007029 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.380320072 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.380361080 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.381444931 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.381534100 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.381993055 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382014036 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382072926 CEST	443	49767	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.382090092 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382128000 CEST	49767	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382452011 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382550955 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.382646084 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382853985 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.382888079 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.400511026 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.400829077 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.400855064 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.401216984 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.401554108 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.401621103 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.401696920 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.447397947 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.455317020 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.534651995 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.534697056 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.534727097 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.534764051 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.534780979 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.534981966 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.535037994 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.535047054 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.535089970 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.535309076 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.535403013 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.536600113 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.536813021 CEST	49766	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.536828995 CEST	443	49766	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.702986956 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.703073025 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.704942942 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.704950094 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.705218077 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.707487106 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.707549095 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.707554102 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.707693100 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.755409002 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.846818924 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.847289085 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.847306967 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.848386049 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.848457098 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.848912954 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.848989964 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.849256992 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.849263906 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.876944065 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.877037048 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.877135038 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.877428055 CEST	49768	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:26.877446890 CEST	443	49768	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:26.892769098 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.968954086 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.969038010 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:26.969114065 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.972718954 CEST	49770	443	192.168.2.5	188.114.96.3
Oct 7, 2024 11:04:26.972775936 CEST	443	49770	188.114.96.3	192.168.2.5
Oct 7, 2024 11:04:27.277498007 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:27.277647972 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:27.278425932 CEST	49772	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:27.278469086 CEST	443	49772	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:27.278631926 CEST	49772	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:27.278912067 CEST	49772	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:27.278932095 CEST	443	49772	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:27.282318115 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:27.282423019 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:27.862411022 CEST	443	49772	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:27.862588882 CEST	49772	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:29.890068054 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:29.890139103 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:29.890238047 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:31.675934076 CEST	49748	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:04:31.675965071 CEST	443	49748	142.250.185.164	192.168.2.5
Oct 7, 2024 11:04:33.083427906 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:33.083642960 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:33.083746910 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:33.674741983 CEST	49742	443	192.168.2.5	188.114.97.3
Oct 7, 2024 11:04:33.674763918 CEST	443	49742	188.114.97.3	192.168.2.5
Oct 7, 2024 11:04:38.785556078 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:38.785662889 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:38.785828114 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:38.786458015 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:38.786490917 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.568965912 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.569066048 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.571350098 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.571372032 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.572160006 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.573555946 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.573625088 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.573638916 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.573759079 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.619390965 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.748163939 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.748523951 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.748611927 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.749638081 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:39.749682903 CEST	443	49773	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:39.749711990 CEST	49773	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.102616072 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.102694035 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.102790117 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.103435993 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.103468895 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.889826059 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.890028000 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.892498970 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.892532110 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.893013000 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.894893885 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.894949913 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.894962072 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:43.895095110 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:43.939409018 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:44.065315008 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:44.065517902 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:44.065711021 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:44.065804005 CEST	49774	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:44.065850019 CEST	443	49774	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:47.012685061 CEST	443	49772	23.1.237.91	192.168.2.5
Oct 7, 2024 11:04:47.012753963 CEST	49772	443	192.168.2.5	23.1.237.91
Oct 7, 2024 11:04:59.922715902 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:59.922758102 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:04:59.922868013 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:59.924818039 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:04:59.924833059 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.717922926 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.718158960 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.720570087 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.720582962 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.721460104 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.722948074 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.723012924 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.723021030 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.723110914 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.767398119 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.894840002 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.895042896 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:00.895193100 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.895303011 CEST	49775	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:00.895320892 CEST	443	49775	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.121229887 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.121280909 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.121398926 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.121978045 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.121995926 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.923511982 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.923612118 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.925528049 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.925537109 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.926309109 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.928679943 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.928765059 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.928772926 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:05.928973913 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:05.971412897 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:06.106502056 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:06.106817961 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:06.106899023 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:06.107229948 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:06.107259035 CEST	443	49777	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:06.107286930 CEST	49777	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:19.387793064 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:19.387856007 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:19.387964010 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:19.388638020 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:19.388653040 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:20.236697912 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.236728907 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:20.236854076 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.237329960 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.237344980 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:20.827594042 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:20.828278065 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:20.828298092 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:20.828629017 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:20.828926086 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.828950882 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:20.829190969 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.829452038 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:20.829472065 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:20.830087900 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:20.830157995 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:20.874357939 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:21.301177979 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.301214933 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.301497936 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.301510096 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.301635981 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.301645994 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.302833080 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.303318024 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.303453922 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.303488970 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.304800034 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.304877043 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.305241108 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.305326939 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.305367947 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.347419024 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.347441912 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.358746052 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.358746052 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.358767033 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.405661106 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.428963900 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.429157019 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.429224968 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.429300070 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.429322004 CEST	443	49782	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.429357052 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.429368973 CEST	49782	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.430356979 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.430404902 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.430525064 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.430761099 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.430777073 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.432286978 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.432370901 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.432466984 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.432564020 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.432564020 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.432580948 CEST	443	49781	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.432641983 CEST	49781	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.433026075 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.433064938 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.433167934 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.433384895 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.433399916 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.892287016 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.892699957 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.892734051 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.893170118 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.893563986 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.893631935 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.893692970 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.901411057 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.901748896 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.901760101 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.902880907 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.903420925 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.903420925 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.903444052 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.903507948 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.935445070 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:21.936973095 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:21.952569962 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.019449949 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.019665956 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.019838095 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.019886017 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.019886017 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.019906998 CEST	443	49784	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.020642042 CEST	49784	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.030961990 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.031075001 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.031136990 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.031280041 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.031301975 CEST	443	49783	35.190.80.1	192.168.2.5
Oct 7, 2024 11:05:22.031306982 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.031413078 CEST	49783	443	192.168.2.5	35.190.80.1
Oct 7, 2024 11:05:22.706810951 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:22.706851959 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:22.707212925 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:22.708164930 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:22.708185911 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.566333055 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.566795111 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.575930119 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.575962067 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.576316118 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.578088999 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.578313112 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.578319073 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.578465939 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.623400927 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.755333900 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.755561113 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:24.755628109 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.755894899 CEST	49785	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:24.755913973 CEST	443	49785	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:29.939609051 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:29.939682961 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:29.940025091 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:31.673439980 CEST	49780	443	192.168.2.5	142.250.185.164
Oct 7, 2024 11:05:31.673499107 CEST	443	49780	142.250.185.164	192.168.2.5
Oct 7, 2024 11:05:34.041495085 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:34.041543961 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:34.041668892 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:34.042289972 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:34.042304993 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.031681061 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.031884909 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.035098076 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.035109043 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.035912037 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.038198948 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.038651943 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.038661003 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.038937092 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.079407930 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.262526989 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.262926102 CEST	443	49786	40.115.3.253	192.168.2.5
Oct 7, 2024 11:05:35.262996912 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.263179064 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.263179064 CEST	49786	443	192.168.2.5	40.115.3.253
Oct 7, 2024 11:05:35.263196945 CEST	443	49786	40.115.3.253	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 11:04:15.499485016 CEST	53	60488	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:15.508810043 CEST	53	58096	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:16.661856890 CEST	53	56085	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:17.239805937 CEST	62452	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:17.240255117 CEST	63231	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:17.253521919 CEST	53	63231	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:17.253572941 CEST	53	62452	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:18.937309980 CEST	53698	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:18.937655926 CEST	58582	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:18.953519106 CEST	53	53698	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:18.973886013 CEST	53	58582	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:19.332684994 CEST	50429	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:19.333153963 CEST	57296	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:19.339564085 CEST	53	50429	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:19.340095043 CEST	53	57296	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:20.227411032 CEST	58332	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:20.227986097 CEST	61769	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:20.234076023 CEST	53	58332	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:20.234811068 CEST	53	61769	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:22.727916956 CEST	55834	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:22.728493929 CEST	63729	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:04:22.741636992 CEST	53	55834	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:22.770242929 CEST	53	63729	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:34.477574110 CEST	53	61387	1.1.1.1	192.168.2.5
Oct 7, 2024 11:04:53.561892033 CEST	53	54947	1.1.1.1	192.168.2.5
Oct 7, 2024 11:05:15.025451899 CEST	53	60680	1.1.1.1	192.168.2.5
Oct 7, 2024 11:05:16.949062109 CEST	53	53500	1.1.1.1	192.168.2.5
Oct 7, 2024 11:05:20.235589981 CEST	62805	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:05:20.235979080 CEST	63374	53	192.168.2.5	1.1.1.1
Oct 7, 2024 11:05:20.827486038 CEST	53	63374	1.1.1.1	192.168.2.5
Oct 7, 2024 11:05:20.827615976 CEST	53	62805	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 7, 2024 11:04:18.974029064 CEST	192.168.2.5	1.1.1.1	c284	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 11:04:17.239805937 CEST	192.168.2.5	1.1.1.1	0x6e05	Standard query (0)	stammeszeit.ch	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:17.240255117 CEST	192.168.2.5	1.1.1.1	0xa776	Standard query (0)	stammeszeit.ch	65	IN (0x0001)	false
Oct 7, 2024 11:04:18.937309980 CEST	192.168.2.5	1.1.1.1	0xc85a	Standard query (0)	billings.7712billings.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:18.937655926 CEST	192.168.2.5	1.1.1.1	0xe9cd	Standard query (0)	billings.7712billings.com	65	IN (0x0001)	false
Oct 7, 2024 11:04:19.332684994 CEST	192.168.2.5	1.1.1.1	0x2ecf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:19.333153963 CEST	192.168.2.5	1.1.1.1	0x1c4a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 11:04:20.227411032 CEST	192.168.2.5	1.1.1.1	0xedd4	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:20.227986097 CEST	192.168.2.5	1.1.1.1	0x672c	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 7, 2024 11:04:22.727916956 CEST	192.168.2.5	1.1.1.1	0xbf5a	Standard query (0)	billings.7712billings.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:22.728493929 CEST	192.168.2.5	1.1.1.1	0x8a5e	Standard query (0)	billings.7712billings.com	65	IN (0x0001)	false
Oct 7, 2024 11:05:20.235589981 CEST	192.168.2.5	1.1.1.1	0xc15	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:05:20.235979080 CEST	192.168.2.5	1.1.1.1	0x2ec6	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 11:04:04.586277962 CEST	1.1.1.1	192.168.2.5	0x616d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:04:04.586277962 CEST	1.1.1.1	192.168.2.5	0x616d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:17.253521919 CEST	1.1.1.1	192.168.2.5	0xa776	No error (0)	stammeszeit.ch			65	IN (0x0001)	false
Oct 7, 2024 11:04:17.253572941 CEST	1.1.1.1	192.168.2.5	0x6e05	No error (0)	stammeszeit.ch		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:17.253572941 CEST	1.1.1.1	192.168.2.5	0x6e05	No error (0)	stammeszeit.ch		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:18.953519106 CEST	1.1.1.1	192.168.2.5	0xc85a	No error (0)	billings.7712billings.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:18.953519106 CEST	1.1.1.1	192.168.2.5	0xc85a	No error (0)	billings.7712billings.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:18.973886013 CEST	1.1.1.1	192.168.2.5	0xe9cd	No error (0)	billings.7712billings.com			65	IN (0x0001)	false
Oct 7, 2024 11:04:19.339564085 CEST	1.1.1.1	192.168.2.5	0x2ecf	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:19.340095043 CEST	1.1.1.1	192.168.2.5	0x1c4a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 11:04:20.234076023 CEST	1.1.1.1	192.168.2.5	0xedd4	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:22.741636992 CEST	1.1.1.1	192.168.2.5	0xbf5a	No error (0)	billings.7712billings.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:22.741636992 CEST	1.1.1.1	192.168.2.5	0xbf5a	No error (0)	billings.7712billings.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:22.770242929 CEST	1.1.1.1	192.168.2.5	0x8a5e	No error (0)	billings.7712billings.com			65	IN (0x0001)	false
Oct 7, 2024 11:04:26.649982929 CEST	1.1.1.1	192.168.2.5	0xb976	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:04:26.649982929 CEST	1.1.1.1	192.168.2.5	0xb976	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:04:39.648706913 CEST	1.1.1.1	192.168.2.5	0x7a0a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:04:39.648706913 CEST	1.1.1.1	192.168.2.5	0x7a0a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:05:08.666160107 CEST	1.1.1.1	192.168.2.5	0xc5b2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:05:08.666160107 CEST	1.1.1.1	192.168.2.5	0xc5b2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:05:20.827615976 CEST	1.1.1.1	192.168.2.5	0xc15	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:05:28.163227081 CEST	1.1.1.1	192.168.2.5	0x6c9d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:05:28.163227081 CEST	1.1.1.1	192.168.2.5	0x6c9d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

stammeszeit.ch

billings.7712billings.com

https:

a.nel.cloudflare.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49726	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:04 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-07 09:04:04 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-07 09:04:04 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 07 Oct 2024 09:03:04 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30389.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C508_BAY x-ms-request-id: f552637b-4910-4ad9-a18e-4926921161e4 PPServer: PPV: 30 H: PH1PEPF0001B762 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 07 Oct 2024 09:04:04 GMT Connection: close Content-Length: 11389
2024-10-07 09:04:04 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49728	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:06 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4694 Host: login.live.com
2024-10-07 09:04:06 UTC	4694	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-07 09:04:07 UTC	656	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 07 Oct 2024 09:03:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=5&213=280810&215=0&315=1&215=0&315=1&214=30&288=16.0.30389.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C508_BAY x-ms-request-id: db86ea42-7f2f-466f-99ee-a0e8710902ce PPServer: PPV: 30 H: PH1PEPF0001B765 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 07 Oct 2024 09:04:06 GMT Connection: close Content-Length: 10901
2024-10-07 09:04:07 UTC	10901	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49732	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 70 51 50 70 6d 4e 62 50 66 55 36 45 4e 4e 6f 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 33 34 39 38 62 37 64 39 30 33 62 38 64 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: pQPpmNbPfU6ENNol.1Context: 3e3498b7d903b8d5
2024-10-07 09:04:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 70 51 50 70 6d 4e 62 50 66 55 36 45 4e 4e 6f 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 33 34 39 38 62 37 64 39 30 33 62 38 64 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: pQPpmNbPfU6ENNol.2Context: 3e3498b7d903b8d5<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:04:08 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 70 51 50 70 6d 4e 62 50 66 55 36 45 4e 4e 6f 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 33 34 39 38 62 37 64 39 30 33 62 38 64 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: pQPpmNbPfU6ENNol.3Context: 3e3498b7d903b8d5
2024-10-07 09:04:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 32 4e 59 68 79 4d 35 74 6b 6d 45 71 6a 65 2f 32 76 46 48 2f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 82NYhyM5tkmEqje/2vFH/Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49739	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 56 65 44 77 6a 6b 58 46 55 43 68 32 74 6f 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 65 63 34 34 64 35 32 35 38 66 38 31 35 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mVeDwjkXFUCh2toN.1Context: f0ec44d5258f8152
2024-10-07 09:04:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 56 65 44 77 6a 6b 58 46 55 43 68 32 74 6f 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 65 63 34 34 64 35 32 35 38 66 38 31 35 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mVeDwjkXFUCh2toN.2Context: f0ec44d5258f8152<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:04:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 56 65 44 77 6a 6b 58 46 55 43 68 32 74 6f 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 65 63 34 34 64 35 32 35 38 66 38 31 35 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mVeDwjkXFUCh2toN.3Context: f0ec44d5258f8152<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 09:04:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 74 54 76 77 53 32 64 71 30 4f 6d 55 70 59 65 41 6b 48 36 7a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6tTvwS2dq0OmUpYeAkH6zQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49744	188.114.97.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:18 UTC	657	OUT	GET / HTTP/1.1 Host: stammeszeit.ch Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:18 UTC	684	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 07 Oct 2024 09:04:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 07 Oct 2024 10:04:18 GMT Location: https://billings.7712billings.com/en-US/captcha.php Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ttkFGjZC1ambBzsbMrRuhFOKhcNH1g00CU9rhRivOSBwUmqGUJENbBQrfPPFnPIptOlEwp3KNg5TNZBW3Uw5iDDfLm2q6vSAKroDucJs7pOLSzOZ7UhZoB8h9U9otl5%2BuQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cecb9134bca4373-EWR
2024-10-07 09:04:18 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49746	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 30 65 38 35 55 45 30 58 6b 69 48 6b 61 38 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 65 37 63 30 63 34 34 63 66 37 34 64 33 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: V0e85UE0XkiHka87.1Context: 98e7c0c44cf74d30
2024-10-07 09:04:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 56 30 65 38 35 55 45 30 58 6b 69 48 6b 61 38 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 65 37 63 30 63 34 34 63 66 37 34 64 33 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: V0e85UE0XkiHka87.2Context: 98e7c0c44cf74d30<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:04:18 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 56 30 65 38 35 55 45 30 58 6b 69 48 6b 61 38 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 65 37 63 30 63 34 34 63 66 37 34 64 33 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: V0e85UE0XkiHka87.3Context: 98e7c0c44cf74d30
2024-10-07 09:04:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 6d 6c 53 4f 4a 56 43 56 30 79 6a 4d 54 79 73 45 55 31 5a 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fmlSOJVCV0yjMTysEU1Zaw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49747	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:19 UTC	685	OUT	GET /en-US/captcha.php HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:20 UTC	710	IN	HTTP/1.1 403 Forbidden Date: Mon, 07 Oct 2024 09:04:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Mon, 07 Oct 2024 09:04:35 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXsTrj4ACoqR%2Bp%2BIyi9Zorx4r1Hgg9fBkhDT1gNXJx25F%2BD4SIuMP4rS5qHvO17TpdrwRfVUNMXG%2FzdxDiHEfGlYy6mEAupRxgdy%2BhohPq9RjElgWpnTgV7tCpOsBqiDslf%2F3lasJS4tFVjV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cecb91e1be5186d-EWR
2024-10-07 09:04:20 UTC	659	IN	Data Raw: 31 35 34 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 154f<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 09:04:20 UTC	1369	IN	Data Raw: 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a Data Ascii: stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...>
2024-10-07 09:04:20 UTC	1369	IN	Data Raw: 6e 20 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 Data Ascii: n cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security
2024-10-07 09:04:20 UTC	1369	IN	Data Raw: 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 Data Ascii: " class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span clas
2024-10-07 09:04:20 UTC	697	IN	Data Raw: 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 61 2e 68 65 69 67 68 74 3d 31 3b 61 2e 77 69 64 74 68 3d 31 3b 61 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 Data Ascii: .src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.positi
2024-10-07 09:04:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49749	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:20 UTC	562	OUT	OPTIONS /report/v4?s=uXsTrj4ACoqR%2Bp%2BIyi9Zorx4r1Hgg9fBkhDT1gNXJx25F%2BD4SIuMP4rS5qHvO17TpdrwRfVUNMXG%2FzdxDiHEfGlYy6mEAupRxgdy%2BhohPq9RjElgWpnTgV7tCpOsBqiDslf%2F3lasJS4tFVjV HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://billings.7712billings.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:20 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 07 Oct 2024 09:04:20 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49750	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:21 UTC	594	OUT	GET /cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://billings.7712billings.com/en-US/captcha.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:21 UTC	411	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:21 GMT Content-Type: text/css Content-Length: 24051 Connection: close Last-Modified: Tue, 01 Oct 2024 14:49:43 GMT ETag: "66fc0c07-5df3" Server: cloudflare CF-RAY: 8cecb926ce2242d2-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 11:04:21 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-10-07 09:04:21 UTC	958	IN	Data Raw: 23 63 66 2d 77 72 61 70 70 65 72 20 61 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 62 62 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 72 74 69 63 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 73 69 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 69 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 6e 76 61 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 70 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 65 6e 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 69 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 6f 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 64 64 2c 23 63 66 2d 77 72 61 70 70 Data Ascii: #cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapp
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 6d 6d 61 72 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 61 62 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 66 6f 6f 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 65 61 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 6c 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f Data Ascii: e,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;bo
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 31 2e 35 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 34 36 2c 31 33 39 2c 33 31 2c 2e 33 29 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 73 65 63 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 63 74 69 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 65 6d Data Ascii: 1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 74 77 6f 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 32 2e 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 32 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 Data Ascii: ld(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-chi
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 6f 64 64 29 7b 63 6c 65 61 72 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 31 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 Data Ascii: ),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 30 3b 70 61 64 64 69 6e 67 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 7d 23 63 66 2d 77 72 61 70 70 65 Data Ascii: 0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrappe
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 68 32 2b 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 6f 6c 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 35 65 6d 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 3b 63 6f 6c Data Ascii: h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;col
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 3a 23 36 32 61 31 64 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 31 36 33 39 35 39 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 64 32 34 32 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 3a 68 6f 76 65 72 2c 23 Data Ascii: :#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 61 63 65 3a 6e 6f 77 72 61 70 7d 23 63 66 2d 77 72 61 70 70 65 72 20 69 6e 70 75 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 6c 65 63 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 65 78 74 61 72 65 61 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 34 30 34 30 34 30 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 36 36 36 37 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 34 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e Data Ascii: ace:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!importan
2024-10-07 09:04:21 UTC	1369	IN	Data Raw: 3a 23 34 30 34 30 34 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 3a 37 2e 35 70 78 20 31 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 3a 65 6d 70 74 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 20 2e 63 66 2d 63 6c 6f 73 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 2e 37 35 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 70 61 64 64 69 6e Data Ascii: :#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;paddin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49752	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:21 UTC	494	OUT	POST /report/v4?s=uXsTrj4ACoqR%2Bp%2BIyi9Zorx4r1Hgg9fBkhDT1gNXJx25F%2BD4SIuMP4rS5qHvO17TpdrwRfVUNMXG%2FzdxDiHEfGlYy6mEAupRxgdy%2BhohPq9RjElgWpnTgV7tCpOsBqiDslf%2F3lasJS4tFVjV HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 412 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:21 UTC	412	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 32 38 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 69 6c 6c 69 6e 67 73 2e 37 37 31 32 62 69 6c Data Ascii: [{"age":1,"body":{"elapsed_time":1287,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":403,"type":"http.error"},"type":"network-error","url":"https://billings.7712bil
2024-10-07 09:04:21 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 07 Oct 2024 09:04:21 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49751	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 09:04:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=200481 Date: Mon, 07 Oct 2024 09:04:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-07 09:04:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=200416 Date: Mon, 07 Oct 2024 09:04:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-07 09:04:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49754	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:22 UTC	664	OUT	GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://billings.7712billings.com/cdn-cgi/styles/cf.errors.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:22 UTC	409	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:22 GMT Content-Type: image/png Content-Length: 715 Connection: close Last-Modified: Tue, 01 Oct 2024 14:49:43 GMT ETag: "66fc0c07-2cb" Server: cloudflare CF-RAY: 8cecb92d3da87cf3-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 11:04:22 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-10-07 09:04:22 UTC	715	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 c0 00 00 00 35 08 03 00 00 00 b9 bf 72 9e 00 00 00 5d 50 4c 54 45 00 00 00 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 eb eb eb 99 99 99 c4 c4 c4 f1 f1 f1 e1 e1 e1 cc cc cc d2 d2 d2 b5 b5 b5 ad ad ad 9d 9d 9d 9b 9b 9b d8 d8 d8 de de de c1 c1 c1 ba ba ba a8 a8 a8 ea ea ea e4 e4 e4 b1 b1 b1 a3 a3 a3 e7 e7 e7 ee ee ee c9 c9 c9 85 39 57 29 00 00 00 08 74 52 4e 53 00 fa d2 75 09 d7 d6 20 00 ef cb c3 00 00 02 15 49 44 41 54 78 da ec db e9 6e a4 30 10 04 e0 9e 23 89 0b c6 9c c3 cd cc fb 3f e6 66 d7 ac 8d 14 c8 49 c6 42 ae ef 67 a9 ff b6 ba 84 85 88 9c 4f c7 03 88 68 57 0e c7 d3 59 5e bd 3c 83 88 76 e8 f9 45 e4 fc 04 22 da a5 a7 b3 9c 40 44 3b 75 92 23 88 68 a7 8e c2 ef 57 44 bb 75 10 10 Data Ascii: PNGIHDR5r]PLTE9W)tRNSu IDATxn0#?fIBgOhWY^<vE"@D;u#hWDu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49755	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:22 UTC	664	OUT	GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://billings.7712billings.com/cdn-cgi/styles/cf.errors.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:22 UTC	410	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:22 GMT Content-Type: image/png Content-Length: 3213 Connection: close Last-Modified: Tue, 01 Oct 2024 14:49:43 GMT ETag: "66fc0c07-c8d" Server: cloudflare CF-RAY: 8cecb92d3bd84398-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 11:04:22 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-10-07 09:04:22 UTC	959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b2 00 00 00 af 08 03 00 00 00 6e 1c 74 1f 00 00 02 d0 50 4c 54 45 00 00 00 ff ff ff ff 80 80 ff 55 55 bf 40 40 cc 33 33 d4 2a 2a db 24 49 bf 40 40 c6 39 39 cc 33 33 d1 2e 2e bf 2a 2a c4 27 27 c8 24 37 cc 33 33 bf 30 30 c3 2d 2d c6 2a 2a c9 28 28 bf 26 26 c2 24 31 c5 2e 2e bc 2c 2c bf 2a 2a c2 29 29 c4 27 27 bd 26 2f bf 24 2e c1 2c 2c c3 2a 2a bd 29 29 bf 28 28 c1 27 27 bf 2a 2a c1 29 29 c3 28 28 be 27 27 bf 26 26 c1 25 2c c2 24 2a be 2a 2a bf 29 29 c1 28 28 bc 27 27 be 26 26 bf 25 2a c1 24 2a bd 29 29 be 28 28 c0 26 26 bd 26 2a be 25 2a bf 24 29 bd 28 28 be 27 27 bf 26 26 c0 26 2a bd 25 29 be 24 28 bf 24 28 bc 27 27 bd 27 27 be 26 26 bc 25 29 bd 24 28 bf 27 27 bd 26 26 be 25 29 bf 25 28 bd 24 28 be Data Ascii: PNGIHDRntPLTEUU@@33$I@@9933..''$73300--((&&$1..,,))''&/$.,,))((''))((''&&%,$**))((''&&%$))((&&&%$)((''&&&%)$($(''''&&%)$(''&&%)%($(
2024-10-07 09:04:22 UTC	1369	IN	Data Raw: ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe 34 dd b2 71 00 00 08 7d 49 44 41 54 78 da ed 9d fb 5f 15 45 18 c6 e7 20 1c f1 88 02 e2 51 10 31 b3 bc e5 35 6f 69 9a a4 26 59 26 9a 5a 26 11 69 a2 e2 a5 d2 cc 22 af 05 6a 9a a2 96 9a 8a 22 9a e2 5d b9 69 89 a9 a0 88 5c 2d 4d 25 c5 6b 2a 06 04 bc ff 42 de 15 98 dd 79 67 76 76 f7 d4 e7 3c 3f cf 3e f3 65 d9 9d 79 e7 9d 77 e7 10 e2 94 53 4e fd cf 54 d7 db f5 bf 80 e9 d6 26 68 dc 9c d8 a4 13 e7 8b e1 81 ae 15 a4 ed 58 3e 7d 54 9f c6 8e 48 5b a7 67 c4 ba cc 52 50 d2 95 a4 e8 91 2d 1c 08 d7 d6 6f 76 5a 19 b0 55 b4 29 cc 21 b0 1b 86 24 fc 0d 78 fd 1e d5 bb 96 a9 bc 9e a1 fb cb 81 57 45 8b 7b 59 4c e2 75 e9 Data Ascii: 4q}IDATx_E Q15oi&Y&Z&i"j"]i\-M%k*Bygvv<?>eywSNT&hX>}TH[gRP-ovZU)!$xWE{YLu
2024-10-07 09:04:22 UTC	885	IN	Data Raw: 8b e8 91 cc 89 ac f0 09 f4 67 5c 26 19 0d 89 06 d9 f6 73 75 56 a9 f0 08 0e e0 31 39 6e 67 54 c5 4f b2 4a 8c f8 73 15 5c 1a 70 94 4d 66 32 88 5d 63 59 79 a4 3a 3c 01 c2 2a 25 17 7c a0 75 92 45 bc 81 67 af 8d ad 31 4a 26 31 58 87 2c c6 e7 b1 6e 1b ee 37 db cc d8 9b c0 7f 51 a1 58 7e 3d 0c 69 70 8a 71 10 8a 75 e3 a3 ac 30 83 19 3b 46 fd a9 58 4e 61 c7 3d cc d9 be 48 62 80 8d 6e ea 2d 37 e0 90 57 2b 5b a0 a2 2c 56 7d 45 95 7b b7 41 bd 04 d9 15 f7 6c 8c 52 76 98 81 b8 9c b5 93 6e 8d af d2 7c bd 3a b3 0f e6 db bc 72 95 97 bd 23 fb f2 42 c6 9e a9 75 73 b5 0b d6 aa 33 63 86 e7 24 35 03 f6 ba 9d 51 b5 46 19 05 54 bf 85 b3 9c 46 20 87 ab f5 c8 ae b4 eb c3 3f 6e fd a0 c2 3c 0e 41 5c d1 4c ad cb 17 45 43 aa 27 bb ed 14 ad 50 64 0e c6 04 bc 89 ea ff 58 e6 c1 01 67 7c Data Ascii: g\&suV19ngTOJs\pMf2]cYy:<*%\|uEg1J&1X,n7QX~=ipqu0;FXNa=Hbn-7W+[,V}E{AlRvn\|:r#Bus3c$5QFTF ?n<A\LEC'PdXg\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49756	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:22 UTC	536	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:22 UTC	685	IN	HTTP/1.1 302 Found Date: Mon, 07 Oct 2024 09:04:22 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EgASzWksU3Hsmtp6%2B7GwbSqfOGBhBIP60z8aCieA9%2BXMUDUnHBsuTKUOSgI%2F2BJks1neGg29F%2B5xqXJ2a38AvdmtkqE1GkPsta5dFOrKe93G8AfwtkECFbB62U%2Bd5gb%2BmlPj8acNqjXRym32"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cecb92def28428f-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49758	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:23 UTC	623	OUT	GET /favicon.ico HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://billings.7712billings.com/en-US/captcha.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:23 UTC	708	IN	HTTP/1.1 403 Forbidden Date: Mon, 07 Oct 2024 09:04:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Mon, 07 Oct 2024 09:04:38 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rFE3bxdJflwufxRvoxeTneulPeOTV5G9fsW9iy2pIZq%2F0djDIkk2wXAHWyLEqA5qfFeM6%2FhSgVX%2BJEFMD%2BY4AWdl7YSYFC3Tmt7vdV7%2BcVTTJwAawPKpYAoZOcDjatuZMQY2Ig9WDSdXL5Ft"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8cecb9316bb64232-EWR
2024-10-07 09:04:23 UTC	661	IN	Data Raw: 31 31 61 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a5<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 Data Ascii: ylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><s
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 73 65 Data Ascii: cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security se
2024-10-07 09:04:23 UTC	1126	IN	Data Raw: 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d Data Ascii: class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span class=
2024-10-07 09:04:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49761	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:23 UTC	554	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:23 UTC	662	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:23 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8027 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PFFAA4kVLX4DW94Lml6mYR%2FOp%2B%2FzrNJyhcOJA6prZAk9c4DnbcC3z4WkiWM5D9X0fkMQl4be0iB3cK%2F1aSOiLJ7JvfB%2Bv74gpZOBacOATuPLvCuRFNvrCVHrX3iQbc1NAPjkwgVJwhXnBEZQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cecb931bcfe0f71-EWR
2024-10-07 09:04:23 UTC	707	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 56 2c 66 2c 67 2c 6c 2c 6d 2c 76 2c 78 2c 7a 29 7b 56 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 55 2c 42 2c 43 29 7b 66 6f 72 28 55 3d 62 2c 42 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 43 3d 70 61 72 73 65 49 6e 74 28 55 28 34 36 39 29 29 2f 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 55 28 34 30 34 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 55 28 33 39 35 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 55 28 34 39 30 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 55 28 34 36 34 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 34 37 30 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 55 28 34 33 36 29 29 2f 37 29 2b 2d 70 61 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(V,f,g,l,m,v,x,z){V=b,function(c,d,U,B,C){for(U=b,B=c();!![];)try{if(C=parseInt(U(469))/1(-parseInt(U(404))/2)+parseInt(U(395))/3+parseInt(U(490))/4(parseInt(U(464))/5)+-parseInt(U(470))/6*(parseInt(U(436))/7)+-pa
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 36 30 29 5d 3f 42 5b 61 34 28 34 31 33 29 5d 5b 61 34 28 34 38 30 29 5d 28 6e 65 77 20 42 5b 28 61 34 28 34 36 30 29 29 5d 28 47 29 29 3a 66 75 6e 63 74 69 6f 6e 28 4d 2c 61 35 2c 4e 29 7b 66 6f 72 28 61 35 3d 61 34 2c 4d 5b 61 35 28 34 36 35 29 5d 28 29 2c 4e 3d 30 3b 4e 3c 4d 5b 61 35 28 34 31 37 29 5d 3b 4d 5b 4e 5d 3d 3d 3d 4d 5b 4e 2b 31 5d 3f 4d 5b 61 35 28 34 35 39 29 5d 28 4e 2b 31 2c 31 29 3a 4e 2b 3d 31 29 3b 72 65 74 75 72 6e 20 4d 7d 28 47 29 2c 48 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 48 3d 48 5b 61 34 28 35 30 31 29 5d 5b 61 34 28 34 34 39 29 5d 28 48 29 2c 49 3d 30 3b 49 3c 47 5b 61 34 28 34 31 37 29 5d 3b 4a 3d 47 5b 49 5d 2c 4b 3d 6f 28 42 2c 43 2c 4a 29 2c 48 28 4b 29 3f 28 4c 3d 27 73 27 3d 3d 3d 4b 26 26 21 Data Ascii: 60)]?B[a4(413)][a4(480)](new B[(a4(460))](G)):function(M,a5,N){for(a5=a4,M[a5(465)](),N=0;N<M[a5(417)];M[N]===M[N+1]?M[a5(459)](N+1,1):N+=1);return M}(G),H='nAsAaAb'.split('A'),H=H[a4(501)][a4(449)](H),I=0;I<G[a4(417)];J=G[I],K=o(B,C,J),H(K)?(L='s'===K&&!
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 28 4f 29 29 2c 4f 3d 30 29 3a 50 2b 2b 2c 54 3e 3e 3d 31 2c 47 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 54 3d 31 2c 47 3d 30 3b 47 3c 4d 3b 4f 3d 54 7c 4f 3c 3c 31 2c 50 3d 3d 45 2d 31 3f 28 50 3d 30 2c 4e 5b 61 61 28 34 39 38 29 5d 28 46 28 4f 29 29 2c 4f 3d 30 29 3a 50 2b 2b 2c 54 3d 30 2c 47 2b 2b 29 3b 66 6f 72 28 54 3d 4a 5b 61 61 28 34 30 32 29 5d 28 30 29 2c 47 3d 30 3b 31 36 3e 47 3b 4f 3d 4f 3c 3c 31 7c 54 26 31 2e 35 36 2c 50 3d 3d 45 2d 31 3f 28 50 3d 30 2c 4e 5b 61 61 28 34 39 38 29 5d 28 46 28 4f 29 29 2c 4f 3d 30 29 3a 50 2b 2b 2c 54 3e 3e 3d 31 2c 47 2b 2b 29 3b 7d 4b 2d 2d 2c 4b 3d 3d 30 26 26 28 4b 3d 4d 61 74 68 5b 61 61 28 33 39 32 29 5d 28 32 2c 4d 29 2c 4d 2b 2b 29 2c 64 65 6c 65 74 65 20 49 5b 4a 5d 7d 65 6c 73 65 20 66 6f 72 28 54 Data Ascii: (O)),O=0):P++,T>>=1,G++);}else{for(T=1,G=0;G<M;O=T\|O<<1,P==E-1?(P=0,N[aa(498)](F(O)),O=0):P++,T=0,G++);for(T=J[aa(402)](0),G=0;16>G;O=O<<1\|T&1.56,P==E-1?(P=0,N[aa(498)](F(O)),O=0):P++,T>>=1,G++);}K--,K==0&&(K=Math[aa(392)](2,M),M++),delete I[J]}else for(T
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 2c 4d 3d 31 3b 52 21 3d 4d 3b 53 3d 4e 26 4f 2c 4f 3e 3e 3d 31 2c 30 3d 3d 4f 26 26 28 4f 3d 45 2c 4e 3d 46 28 50 2b 2b 29 29 2c 51 7c 3d 4d 2a 28 30 3c 53 3f 31 3a 30 29 2c 4d 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 51 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 51 3d 30 2c 52 3d 4d 61 74 68 5b 61 64 28 33 39 32 29 5d 28 32 2c 38 29 2c 4d 3d 31 3b 52 21 3d 4d 3b 53 3d 4e 26 4f 2c 4f 3e 3e 3d 31 2c 30 3d 3d 4f 26 26 28 4f 3d 45 2c 4e 3d 46 28 50 2b 2b 29 29 2c 51 7c 3d 28 30 3c 53 3f 31 3a 30 29 2a 4d 2c 4d 3c 3c 3d 31 29 3b 54 3d 64 28 51 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 66 6f 72 28 51 3d 30 2c 52 3d 4d 61 74 68 5b 61 64 28 33 39 32 29 5d 28 32 2c 31 36 29 2c 4d 3d 31 3b 4d 21 3d 52 3b 53 3d 4f 26 4e 2c 4f 3e 3e 3d 31 2c 30 3d 3d 4f 26 26 28 4f 3d Data Ascii: ,M=1;R!=M;S=N&O,O>>=1,0==O&&(O=E,N=F(P++)),Q\|=M(0<S?1:0),M<<=1);switch(Q){case 0:for(Q=0,R=Math[ad(392)](2,8),M=1;R!=M;S=N&O,O>>=1,0==O&&(O=E,N=F(P++)),Q\|=(0<S?1:0)M,M<<=1);T=d(Q);break;case 1:for(Q=0,R=Math[ad(392)](2,16),M=1;M!=R;S=O&N,O>>=1,0==O&&(O=
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 6f 7a 72 6a 4f 2c 69 6e 64 65 78 4f 66 2c 4f 62 6a 65 63 74 2c 2f 6a 73 64 2f 72 2f 2c 74 6f 53 74 72 69 6e 67 2c 48 76 6d 72 33 2c 2f 62 65 61 63 6f 6e 2f 6f 76 2c 41 72 72 61 79 2c 63 68 6c 41 70 69 52 75 6d 57 69 64 67 65 74 41 67 65 4d 73 2c 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 2c 6f 70 65 6e 2c 6c 65 6e 67 74 68 2c 74 69 6d 65 6f 75 74 2c 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 2c 2f 30 2e 39 35 32 36 35 36 37 34 36 35 31 38 32 35 38 38 3a 31 37 32 38 32 38 39 35 38 34 3a 55 2d 72 6b 58 5f 6a 63 59 32 6a 31 65 65 62 59 4c 48 74 4b 63 62 69 4e 5f 33 70 5f 6e 68 6a 78 53 7a 49 6e 31 67 6d 38 69 68 6b 2f 2c 37 39 35 36 39 32 30 78 44 53 64 4d 4f 2c 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 2c 63 6f 6e 63 61 74 2c 63 61 74 63 68 2c 6e 75 Data Ascii: ozrjO,indexOf,Object,/jsd/r/,toString,Hvmr3,/beacon/ov,Array,chlApiRumWidgetAgeMs,contentDocument,open,length,timeout,XMLHttpRequest,/0.9526567465182588:1728289584:U-rkX_jcY2j1eebYLHtKcbiN_3p_nhjxSzIn1gm8ihk/,7956920xDSdMO,DOMContentLoaded,concat,catch,nu
2024-10-07 09:04:23 UTC	1369	IN	Data Raw: 33 39 38 29 5d 5b 5a 28 34 31 34 29 5d 2c 4a 3d 49 2c 47 5b 5a 28 34 31 36 29 5d 28 48 2c 46 2c 21 21 5b 5d 29 2c 47 5b 5a 28 34 31 38 29 5d 3d 32 35 30 30 2c 47 5b 5a 28 34 33 32 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 47 5b 5a 28 34 35 38 29 5d 28 5a 28 34 39 35 29 2c 5a 28 34 38 39 29 29 2c 4b 3d 7b 7d 2c 4b 5b 5a 28 34 36 33 29 5d 3d 44 2c 4b 5b 5a 28 34 35 30 29 5d 3d 4a 2c 4b 5b 5a 28 34 33 34 29 5d 3d 5a 28 34 34 30 29 2c 4c 3d 7a 5b 5a 28 34 32 37 29 5d 28 4a 53 4f 4e 5b 5a 28 34 37 33 29 5d 28 4b 29 29 5b 5a 28 34 37 39 29 5d 28 27 2b 27 2c 5a 28 34 34 34 29 29 2c 47 5b 5a 28 34 36 31 29 5d 28 27 76 5f 27 2b 45 2e 72 2b 27 3d 27 2b 4c 29 7d 63 61 74 63 68 28 4d 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 28 61 65 2c 63 2c 64 2c 42 2c 43 29 Data Ascii: 398)][Z(414)],J=I,G[Z(416)](H,F,!![]),G[Z(418)]=2500,G[Z(432)]=function(){},G[Z(458)](Z(495),Z(489)),K={},K[Z(463)]=D,K[Z(450)]=J,K[Z(434)]=Z(440),L=z[Z(427)](JSON[Z(473)](K))[Z(479)]('+',Z(444)),G[Z(461)]('v_'+E.r+'='+L)}catch(M){}}function A(ae,c,d,B,C)
2024-10-07 09:04:23 UTC	475	IN	Data Raw: 4d 61 74 68 5b 57 28 34 33 35 29 5d 28 29 3c 63 7d 66 75 6e 63 74 69 6f 6e 20 69 28 58 2c 63 2c 64 2c 42 2c 43 29 7b 69 66 28 28 58 3d 56 2c 63 3d 66 5b 58 28 34 37 31 29 5d 2c 64 3d 33 36 30 30 2c 63 2e 74 29 26 26 28 42 3d 4d 61 74 68 5b 58 28 34 34 31 29 5d 28 2b 61 74 6f 62 28 63 2e 74 29 29 2c 43 3d 4d 61 74 68 5b 58 28 34 34 31 29 5d 28 44 61 74 65 5b 58 28 34 39 33 29 5d 28 29 2f 31 65 33 29 2c 43 2d 42 3e 64 29 29 72 65 74 75 72 6e 21 5b 5d 3b 72 65 74 75 72 6e 21 21 5b 5d 7d 66 75 6e 63 74 69 6f 6e 20 79 28 61 37 2c 42 2c 43 2c 44 2c 45 2c 46 29 7b 61 37 3d 56 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 3d 67 5b 61 37 28 34 32 38 29 5d 28 61 37 28 34 38 31 29 29 2c 42 5b 61 37 28 34 33 37 29 5d 3d 61 37 28 34 34 38 29 2c 42 5b 61 37 28 35 30 30 29 5d Data Ascii: Math[W(435)]()<c}function i(X,c,d,B,C){if((X=V,c=f[X(471)],d=3600,c.t)&&(B=Math[X(441)](+atob(c.t)),C=Math[X(441)](Date[X(493)]()/1e3),C-B>d))return![];return!![]}function y(a7,B,C,D,E,F){a7=V;try{return B=g[a7(428)](a7(481)),B[a7(437)]=a7(448),B[a7(500)]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49763	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:24 UTC	390	OUT	GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:24 UTC	410	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:24 GMT Content-Type: image/png Content-Length: 3213 Connection: close Last-Modified: Tue, 01 Oct 2024 14:49:43 GMT ETag: "66fc0c07-c8d" Server: cloudflare CF-RAY: 8cecb936fb9cc3f5-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 11:04:24 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-10-07 09:04:24 UTC	959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b2 00 00 00 af 08 03 00 00 00 6e 1c 74 1f 00 00 02 d0 50 4c 54 45 00 00 00 ff ff ff ff 80 80 ff 55 55 bf 40 40 cc 33 33 d4 2a 2a db 24 49 bf 40 40 c6 39 39 cc 33 33 d1 2e 2e bf 2a 2a c4 27 27 c8 24 37 cc 33 33 bf 30 30 c3 2d 2d c6 2a 2a c9 28 28 bf 26 26 c2 24 31 c5 2e 2e bc 2c 2c bf 2a 2a c2 29 29 c4 27 27 bd 26 2f bf 24 2e c1 2c 2c c3 2a 2a bd 29 29 bf 28 28 c1 27 27 bf 2a 2a c1 29 29 c3 28 28 be 27 27 bf 26 26 c1 25 2c c2 24 2a be 2a 2a bf 29 29 c1 28 28 bc 27 27 be 26 26 bf 25 2a c1 24 2a bd 29 29 be 28 28 c0 26 26 bd 26 2a be 25 2a bf 24 29 bd 28 28 be 27 27 bf 26 26 c0 26 2a bd 25 29 be 24 28 bf 24 28 bc 27 27 bd 27 27 be 26 26 bc 25 29 bd 24 28 bf 27 27 bd 26 26 be 25 29 bf 25 28 bd 24 28 be Data Ascii: PNGIHDRntPLTEUU@@33$I@@9933..''$73300--((&&$1..,,))''&/$.,,))((''))((''&&%,$**))((''&&%$))((&&&%$)((''&&&%)$($(''''&&%)$(''&&%)%($(
2024-10-07 09:04:24 UTC	1369	IN	Data Raw: ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe 34 dd b2 71 00 00 08 7d 49 44 41 54 78 da ed 9d fb 5f 15 45 18 c6 e7 20 1c f1 88 02 e2 51 10 31 b3 bc e5 35 6f 69 9a a4 26 59 26 9a 5a 26 11 69 a2 e2 a5 d2 cc 22 af 05 6a 9a a2 96 9a 8a 22 9a e2 5d b9 69 89 a9 a0 88 5c 2d 4d 25 c5 6b 2a 06 04 bc ff 42 de 15 98 dd 79 67 76 76 f7 d4 e7 3c 3f cf 3e f3 65 d9 9d 79 e7 9d 77 e7 10 e2 94 53 4e fd cf 54 d7 db f5 bf 80 e9 d6 26 68 dc 9c d8 a4 13 e7 8b e1 81 ae 15 a4 ed 58 3e 7d 54 9f c6 8e 48 5b a7 67 c4 ba cc 52 50 d2 95 a4 e8 91 2d 1c 08 d7 d6 6f 76 5a 19 b0 55 b4 29 cc 21 b0 1b 86 24 fc 0d 78 fd 1e d5 bb 96 a9 bc 9e a1 fb cb 81 57 45 8b 7b 59 4c e2 75 e9 Data Ascii: 4q}IDATx_E Q15oi&Y&Z&i"j"]i\-M%k*Bygvv<?>eywSNT&hX>}TH[gRP-ovZU)!$xWE{YLu
2024-10-07 09:04:24 UTC	885	IN	Data Raw: 8b e8 91 cc 89 ac f0 09 f4 67 5c 26 19 0d 89 06 d9 f6 73 75 56 a9 f0 08 0e e0 31 39 6e 67 54 c5 4f b2 4a 8c f8 73 15 5c 1a 70 94 4d 66 32 88 5d 63 59 79 a4 3a 3c 01 c2 2a 25 17 7c a0 75 92 45 bc 81 67 af 8d ad 31 4a 26 31 58 87 2c c6 e7 b1 6e 1b ee 37 db cc d8 9b c0 7f 51 a1 58 7e 3d 0c 69 70 8a 71 10 8a 75 e3 a3 ac 30 83 19 3b 46 fd a9 58 4e 61 c7 3d cc d9 be 48 62 80 8d 6e ea 2d 37 e0 90 57 2b 5b a0 a2 2c 56 7d 45 95 7b b7 41 bd 04 d9 15 f7 6c 8c 52 76 98 81 b8 9c b5 93 6e 8d af d2 7c bd 3a b3 0f e6 db bc 72 95 97 bd 23 fb f2 42 c6 9e a9 75 73 b5 0b d6 aa 33 63 86 e7 24 35 03 f6 ba 9d 51 b5 46 19 05 54 bf 85 b3 9c 46 20 87 ab f5 c8 ae b4 eb c3 3f 6e fd a0 c2 3c 0e 41 5c d1 4c ad cb 17 45 43 aa 27 bb ed 14 ad 50 64 0e c6 04 bc 89 ea ff 58 e6 c1 01 67 7c Data Ascii: g\&suV19ngTOJs\pMf2]cYy:<*%\|uEg1J&1X,n7QX~=ipqu0;FXNa=Hbn-7W+[,V}E{AlRvn\|:r#Bus3c$5QFTF ?n<A\LEC'PdXg\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49762	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:24 UTC	390	OUT	GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:24 UTC	409	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:24 GMT Content-Type: image/png Content-Length: 715 Connection: close Last-Modified: Tue, 01 Oct 2024 14:49:43 GMT ETag: "66fc0c07-2cb" Server: cloudflare CF-RAY: 8cecb936fab27ce8-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 07 Oct 2024 11:04:24 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-10-07 09:04:24 UTC	715	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 c0 00 00 00 35 08 03 00 00 00 b9 bf 72 9e 00 00 00 5d 50 4c 54 45 00 00 00 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 eb eb eb 99 99 99 c4 c4 c4 f1 f1 f1 e1 e1 e1 cc cc cc d2 d2 d2 b5 b5 b5 ad ad ad 9d 9d 9d 9b 9b 9b d8 d8 d8 de de de c1 c1 c1 ba ba ba a8 a8 a8 ea ea ea e4 e4 e4 b1 b1 b1 a3 a3 a3 e7 e7 e7 ee ee ee c9 c9 c9 85 39 57 29 00 00 00 08 74 52 4e 53 00 fa d2 75 09 d7 d6 20 00 ef cb c3 00 00 02 15 49 44 41 54 78 da ec db e9 6e a4 30 10 04 e0 9e 23 89 0b c6 9c c3 cd cc fb 3f e6 66 d7 ac 8d 14 c8 49 c6 42 ae ef 67 a9 ff b6 ba 84 85 88 9c 4f c7 03 88 68 57 0e c7 d3 59 5e bd 3c 83 88 76 e8 f9 45 e4 fc 04 22 da a5 a7 b3 9c 40 44 3b 75 92 23 88 68 a7 8e c2 ef 57 44 bb 75 10 10 Data Ascii: PNGIHDR5r]PLTE9W)tRNSu IDATxn0#?fIBgOhWY^<vE"@D;u#hWDu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49764	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:24 UTC	638	OUT	POST /cdn-cgi/challenge-platform/h/g/jsd/r/8cecb91e1be5186d HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive Content-Length: 15824 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://billings.7712billings.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:24 UTC	15824	OUT	Data Raw: 7b 22 77 70 22 3a 22 78 62 69 46 74 6f 47 59 74 50 69 74 70 5a 6c 47 55 47 6b 61 34 46 6f 66 61 33 2d 61 79 7a 79 4b 4b 6f 59 47 4c 32 61 31 37 66 6e 37 35 69 61 48 31 24 67 6c 37 50 47 45 61 70 55 69 56 63 62 62 61 33 4a 4b 61 6a 61 4b 66 4b 69 47 61 41 4b 47 75 6c 4f 46 4a 50 62 64 30 44 46 31 37 51 62 2d 33 36 45 6b 5a 56 54 46 75 51 74 72 2d 76 47 36 32 31 4a 79 61 74 69 69 42 79 48 6f 64 63 61 39 56 63 35 4e 64 61 4e 46 5a 48 61 6f 72 69 61 79 46 6f 6f 46 51 70 46 79 61 47 37 61 34 50 77 61 47 76 64 61 68 2b 59 33 56 62 24 47 33 4a 63 69 61 6f 2b 64 61 6f 6c 67 34 61 67 6f 61 47 64 41 35 49 69 44 45 2d 66 6f 56 6f 47 4e 75 2d 62 32 74 51 58 38 4e 31 61 7a 46 6f 79 73 6d 62 61 59 77 62 37 5a 35 31 57 41 56 61 67 38 4e 4a 51 7a 33 46 61 49 4a 7a 35 79 Data Ascii: {"wp":"xbiFtoGYtPitpZlGUGka4Fofa3-ayzyKKoYGL2a17fn75iaH1$gl7PGEapUiVcbba3JKajaKfKiGaAKGulOFJPbd0DF17Qb-36EkZVTFuQtr-vG621JyatiiByHodca9Vc5NdaNFZHaoriayFooFQpFyaG7a4PwaGvdah+Y3Vb$G3Jciao+daolg4agoaGdA5IiDE-foVoGNu-b2tQX8N1azFoysmbaYwb7Z51WAVag8NJQz3FaIJz5y
2024-10-07 09:04:25 UTC	1256	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:24 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.7712billings.com; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=pLOQbtxw34iihfFOWNo82TohbEwddjfAmnxquANSQVE-1728291864-1.2.1.1-hMAYXcjPw1lkLv_yXmOPmWIlSdOrmSs6Gv14gRa9KjJ9h4PgMuZYgK.dKuErFXUuRkulp1xE4I6hKIQr6XY401MrdHQ3UlZwZGA6OYqKh6T4J6DifAXR9esO5j_0yh7mbe4Qkxrjl6FmG.xKdUhmFkIjZC82JWNOfqlM7qvVO8JeiH5D6q7D3_O4wC4rNEcaQe8B0PZR60Z1K_z.12BwcG_ofbWAXFjxZzfgU3p_QqJEfd9YOFMfBncgYkA2QrDlcWoDa3uZoscxBcqqSqQR.0.VG3m18HRUEkHZfVJGeyeal5Dab1pJ_G4szDHOeBtxsWsZXniLjKlkY1lkv0c0oR6bRmvmFu5ryP93n5oEthJ17An4CB97Tr.bWLtUeWyd; Path=/; Expires=Tue, 07-Oct-25 09:04:24 GMT; Domain=.7712billings.com; HttpOnly; Secure; SameSite=None; Partitioned Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dBb%2BJjBpSBAJNrfMhPd%2BrfDmDuKdrj6iPRf%2FObgUSH2hFr6OqMTuIKNmT%2Fem6bSdvaeA%2BiVj%2B%2Bms%2FmFIOYkQeDWnqFtT9QFmbxaESpKBv%2Fk3%2BpHUaEH21Xlc0Okz0q9VptjZuh3wBJx3Z5CN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cecb93a0822de9a-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49766	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:26 UTC	413	OUT	GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:26 UTC	658	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:04:26 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 8028 Connection: close cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ha31vpf%2Fi%2Fhn8m0JkFR5rX2isXJwbjtp9VwI0mbz8RumM4vyZssMK4PU0xlt6l87QAXKQ6n1iTsjDwhJkNhfDng9XYHmYJ8E4IlPRahJEg7GmewFeHBGDxg4kW%2FZYVbobRSE0rEafsIJjTs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cecb9458a890f39-EWR
2024-10-07 09:04:26 UTC	711	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 3d 7b 63 46 50 57 76 3a 27 67 27 7d 3b 7e 66 75 6e 63 74 69 6f 6e 28 56 2c 67 2c 68 2c 69 2c 6a 2c 6e 2c 6f 2c 76 29 7b 56 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 55 2c 66 2c 43 29 7b 66 6f 72 28 55 3d 62 2c 66 3d 64 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 43 3d 70 61 72 73 65 49 6e 74 28 55 28 34 38 34 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 55 28 35 31 32 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 55 28 35 30 39 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 34 33 33 29 29 2f 34 2b 70 61 72 73 65 49 6e 74 28 55 28 35 32 32 29 29 2f 35 2b 70 61 72 73 65 49 6e 74 28 55 28 34 36 37 29 29 2f 36 2b 2d 70 61 72 73 65 49 6e 74 28 55 28 34 34 35 29 29 2f 37 2a 28 2d 70 61 72 73 65 Data Ascii: window._cf_chl_opt={cFPWv:'g'};~function(V,g,h,i,j,n,o,v){V=b,function(d,e,U,f,C){for(U=b,f=d();!![];)try{if(C=parseInt(U(484))/1(parseInt(U(512))/2)+parseInt(U(509))/3+-parseInt(U(433))/4+parseInt(U(522))/5+parseInt(U(467))/6+-parseInt(U(445))/7(-parse
2024-10-07 09:04:26 UTC	1369	IN	Data Raw: 65 77 20 43 5b 28 61 30 28 34 35 37 29 29 5d 28 48 29 29 3a 66 75 6e 63 74 69 6f 6e 28 4e 2c 61 31 2c 4f 29 7b 66 6f 72 28 61 31 3d 61 30 2c 4e 5b 61 31 28 35 32 37 29 5d 28 29 2c 4f 3d 30 3b 4f 3c 4e 5b 61 31 28 34 34 34 29 5d 3b 4e 5b 4f 2b 31 5d 3d 3d 3d 4e 5b 4f 5d 3f 4e 5b 61 31 28 34 33 37 29 5d 28 4f 2b 31 2c 31 29 3a 4f 2b 3d 31 29 3b 72 65 74 75 72 6e 20 4e 7d 28 48 29 2c 49 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 49 3d 49 5b 61 30 28 34 38 31 29 5d 5b 61 30 28 34 37 31 29 5d 28 49 29 2c 4a 3d 30 3b 4a 3c 48 5b 61 30 28 34 34 34 29 5d 3b 4b 3d 48 5b 4a 5d 2c 4c 3d 6c 28 43 2c 44 2c 4b 29 2c 49 28 4c 29 3f 28 4d 3d 4c 3d 3d 3d 27 73 27 26 26 21 43 5b 61 30 28 35 31 37 29 5d 28 44 5b 4b 5d 29 2c 61 30 28 35 33 37 29 3d 3d Data Ascii: ew C[(a0(457))](H)):function(N,a1,O){for(a1=a0,N[a1(527)](),O=0;O<N[a1(444)];N[O+1]===N[O]?N[a1(437)](O+1,1):O+=1);return N}(H),I='nAsAaAb'.split('A'),I=I[a0(481)][a0(471)](I),J=0;J<H[a0(444)];K=H[J],L=l(C,D,K),I(L)?(M=L==='s'&&!C[a0(517)](D[K]),a0(537)==
2024-10-07 09:04:26 UTC	1369	IN	Data Raw: 65 7b 66 6f 72 28 54 3d 31 2c 47 3d 30 3b 47 3c 4d 3b 4f 3d 4f 3c 3c 31 7c 54 2c 50 3d 3d 45 2d 31 3f 28 50 3d 30 2c 4e 5b 61 36 28 34 36 30 29 5d 28 46 28 4f 29 29 2c 4f 3d 30 29 3a 50 2b 2b 2c 54 3d 30 2c 47 2b 2b 29 3b 66 6f 72 28 54 3d 4a 5b 61 36 28 34 39 34 29 5d 28 30 29 2c 47 3d 30 3b 31 36 3e 47 3b 4f 3d 4f 3c 3c 31 7c 54 26 31 2e 33 39 2c 45 2d 31 3d 3d 50 3f 28 50 3d 30 2c 4e 5b 61 36 28 34 36 30 29 5d 28 46 28 4f 29 29 2c 4f 3d 30 29 3a 50 2b 2b 2c 54 3e 3e 3d 31 2c 47 2b 2b 29 3b 7d 4b 2d 2d 2c 4b 3d 3d 30 26 26 28 4b 3d 4d 61 74 68 5b 61 36 28 34 37 30 29 5d 28 32 2c 4d 29 2c 4d 2b 2b 29 2c 64 65 6c 65 74 65 20 49 5b 4a 5d 7d 65 6c 73 65 20 66 6f 72 28 54 3d 48 5b 4a 5d 2c 47 3d 30 3b 47 3c 4d 3b 4f 3d 54 26 31 2e 37 34 7c 4f 3c 3c 31 2c 50 Data Ascii: e{for(T=1,G=0;G<M;O=O<<1\|T,P==E-1?(P=0,N[a6(460)](F(O)),O=0):P++,T=0,G++);for(T=J[a6(494)](0),G=0;16>G;O=O<<1\|T&1.39,E-1==P?(P=0,N[a6(460)](F(O)),O=0):P++,T>>=1,G++);}K--,K==0&&(K=Math[a6(470)](2,M),M++),delete I[J]}else for(T=H[J],G=0;G<M;O=T&1.74\|O<<1,P
2024-10-07 09:04:26 UTC	1369	IN	Data Raw: 3d 46 28 50 2b 2b 29 29 2c 51 7c 3d 28 30 3c 53 3f 31 3a 30 29 2a 4d 2c 4d 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 51 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 51 3d 30 2c 52 3d 4d 61 74 68 5b 61 39 28 34 37 30 29 5d 28 32 2c 38 29 2c 4d 3d 31 3b 4d 21 3d 52 3b 53 3d 4e 26 4f 2c 4f 3e 3e 3d 31 2c 4f 3d 3d 30 26 26 28 4f 3d 45 2c 4e 3d 46 28 50 2b 2b 29 29 2c 51 7c 3d 28 30 3c 53 3f 31 3a 30 29 2a 4d 2c 4d 3c 3c 3d 31 29 3b 54 3d 65 28 51 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 66 6f 72 28 51 3d 30 2c 52 3d 4d 61 74 68 5b 61 39 28 34 37 30 29 5d 28 32 2c 31 36 29 2c 4d 3d 31 3b 52 21 3d 4d 3b 53 3d 4f 26 4e 2c 4f 3e 3e 3d 31 2c 4f 3d 3d 30 26 26 28 4f 3d 45 2c 4e 3d 46 28 50 2b 2b 29 29 2c 51 7c 3d 4d 2a 28 30 3c 53 3f 31 3a 30 29 2c 4d 3c 3c 3d 31 29 3b Data Ascii: =F(P++)),Q\|=(0<S?1:0)M,M<<=1);switch(Q){case 0:for(Q=0,R=Math[a9(470)](2,8),M=1;M!=R;S=N&O,O>>=1,O==0&&(O=E,N=F(P++)),Q\|=(0<S?1:0)M,M<<=1);T=e(Q);break;case 1:for(Q=0,R=Math[a9(470)](2,16),M=1;R!=M;S=O&N,O>>=1,O==0&&(O=E,N=F(P++)),Q\|=M*(0<S?1:0),M<<=1);
2024-10-07 09:04:26 UTC	1369	IN	Data Raw: 2c 6b 65 79 73 2c 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 2c 41 72 72 61 79 2c 73 74 79 6c 65 2c 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 2c 31 34 36 30 34 35 37 42 5a 66 49 6e 4c 2c 6a 6f 69 6e 2c 66 72 6f 6d 2c 32 79 67 54 53 6c 49 2c 63 61 74 63 68 2c 25 32 62 2c 73 65 6e 64 2c 63 68 61 72 41 74 2c 69 73 4e 61 4e 2c 6f 6e 74 69 6d 65 6f 75 74 2c 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 2c 73 70 6c 69 74 2c 2f 30 2e 36 30 30 36 37 39 30 35 37 35 37 36 36 32 37 37 3a 31 37 32 38 32 38 39 35 38 32 3a 46 51 4b 76 6d 70 50 71 79 36 6d 6c 75 38 46 38 56 37 42 55 39 79 58 76 79 30 41 57 77 2d 54 54 31 51 36 47 73 34 75 37 38 48 30 2f 2c 31 39 36 31 37 33 35 6d 5a 4e 74 4f 6e 2c 6e 75 6d 62 65 72 Data Ascii: ,keys,getPrototypeOf,DOMContentLoaded,Array,style,setRequestHeader,1460457BZfInL,join,from,2ygTSlI,catch,%2b,send,charAt,isNaN,ontimeout,contentDocument,split,/0.6006790575766277:1728289582:FQKvmpPqy6mlu8F8V7BU9yXvy0AWw-TT1Q6Gs4u78H0/,1961735mZNtOn,number
2024-10-07 09:04:26 UTC	1369	IN	Data Raw: 28 34 33 39 29 5d 28 61 33 28 34 39 31 29 29 2c 43 5b 61 33 28 35 30 37 29 5d 3d 61 33 28 34 39 35 29 2c 43 5b 61 33 28 34 33 31 29 5d 3d 27 2d 31 27 2c 68 5b 61 33 28 35 32 35 29 5d 5b 61 33 28 34 36 34 29 5d 28 43 29 2c 44 3d 43 5b 61 33 28 35 32 36 29 5d 2c 45 3d 7b 7d 2c 45 3d 56 67 75 79 36 28 44 2c 44 2c 27 27 2c 45 29 2c 45 3d 56 67 75 79 36 28 44 2c 44 5b 61 33 28 34 37 39 29 5d 7c 7c 44 5b 61 33 28 34 39 37 29 5d 2c 27 6e 2e 27 2c 45 29 2c 45 3d 56 67 75 79 36 28 44 2c 43 5b 61 33 28 35 31 39 29 5d 2c 27 64 2e 27 2c 45 29 2c 68 5b 61 33 28 35 32 35 29 5d 5b 61 33 28 34 34 33 29 5d 28 43 29 2c 46 3d 7b 7d 2c 46 2e 72 3d 45 2c 46 2e 65 3d 6e 75 6c 6c 2c 46 7d 63 61 74 63 68 28 48 29 7b 72 65 74 75 72 6e 20 47 3d 7b 7d 2c 47 2e 72 3d 7b 7d 2c 47 2e Data Ascii: (439)](a3(491)),C[a3(507)]=a3(495),C[a3(431)]='-1',h[a3(525)][a3(464)](C),D=C[a3(526)],E={},E=Vguy6(D,D,'',E),E=Vguy6(D,D[a3(479)]\|\|D[a3(497)],'n.',E),E=Vguy6(D,C[a3(519)],'d.',E),h[a3(525)][a3(443)](C),F={},F.r=E,F.e=null,F}catch(H){return G={},G.r={},G.
2024-10-07 09:04:26 UTC	472	IN	Data Raw: 31 29 2b 46 2e 72 2b 61 64 28 35 33 31 29 2c 48 3d 6e 65 77 20 67 5b 28 61 64 28 35 33 32 29 29 5d 28 29 2c 21 48 29 72 65 74 75 72 6e 3b 49 3d 61 64 28 35 33 39 29 2c 4a 3d 7b 7d 2c 4a 5b 61 64 28 35 32 34 29 5d 3d 67 5b 61 64 28 34 38 32 29 5d 5b 61 64 28 35 32 34 29 5d 2c 4a 5b 61 64 28 34 39 39 29 5d 3d 67 5b 61 64 28 34 38 32 29 5d 5b 61 64 28 34 39 39 29 5d 2c 4a 5b 61 64 28 35 33 30 29 5d 3d 67 5b 61 64 28 34 38 32 29 5d 5b 61 64 28 35 33 30 29 5d 2c 4b 3d 4a 2c 48 5b 61 64 28 34 36 35 29 5d 28 49 2c 47 2c 21 21 5b 5d 29 2c 48 5b 61 64 28 34 34 38 29 5d 3d 32 35 30 30 2c 48 5b 61 64 28 35 31 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 48 5b 61 64 28 35 30 38 29 5d 28 61 64 28 34 35 35 29 2c 61 64 28 34 37 37 29 29 2c 4c 3d 7b 7d 2c 4c 5b 61 Data Ascii: 1)+F.r+ad(531),H=new g[(ad(532))](),!H)return;I=ad(539),J={},J[ad(524)]=g[ad(482)][ad(524)],J[ad(499)]=g[ad(482)][ad(499)],J[ad(530)]=g[ad(482)][ad(530)],K=J,H[ad(465)](I,G,!![]),H[ad(448)]=2500,H[ad(518)]=function(){},H[ad(508)](ad(455),ad(477)),L={},L[a

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49768	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 71 46 71 57 6d 45 39 6b 45 75 30 58 38 30 33 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 34 64 39 35 31 36 30 35 33 34 32 37 62 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hqFqWmE9kEu0X803.1Context: 874d9516053427b2
2024-10-07 09:04:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 71 46 71 57 6d 45 39 6b 45 75 30 58 38 30 33 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 34 64 39 35 31 36 30 35 33 34 32 37 62 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hqFqWmE9kEu0X803.2Context: 874d9516053427b2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:04:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 71 46 71 57 6d 45 39 6b 45 75 30 58 38 30 33 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 34 64 39 35 31 36 30 35 33 34 32 37 62 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hqFqWmE9kEu0X803.3Context: 874d9516053427b2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 09:04:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 6d 50 50 6c 4b 42 31 64 45 61 74 32 6c 74 59 78 38 37 70 38 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KmPPlKB1dEat2ltYx87p8g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49770	188.114.96.3	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:26 UTC	402	OUT	GET /cdn-cgi/challenge-platform/h/g/jsd/r/8cecb91e1be5186d HTTP/1.1 Host: billings.7712billings.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:04:26 UTC	514	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 07 Oct 2024 09:04:26 GMT Content-Length: 0 Connection: close allow: POST Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ElvW0h27qdbclzgVfxwdFf4lZirXo11vd%2Bcx7pkd%2BGoaFF2uU%2BdlNtysDGD6VxlhRWmD7W1LUJ2vwCuMBCv%2BVLaJI%2FTrSlpqcXPeDmi4P50jeaoHTtyw39CZn7A0DvXSW04%2BJZ3uV0HiyPvB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cecb94849235e62-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49773	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 78 31 72 64 54 53 4e 33 45 53 75 48 75 52 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 64 64 36 66 63 63 64 37 64 31 32 39 32 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wx1rdTSN3ESuHuRc.1Context: 42dd6fccd7d12928
2024-10-07 09:04:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 77 78 31 72 64 54 53 4e 33 45 53 75 48 75 52 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 64 64 36 66 63 63 64 37 64 31 32 39 32 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: wx1rdTSN3ESuHuRc.2Context: 42dd6fccd7d12928<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:04:39 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 77 78 31 72 64 54 53 4e 33 45 53 75 48 75 52 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 64 64 36 66 63 63 64 37 64 31 32 39 32 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: wx1rdTSN3ESuHuRc.3Context: 42dd6fccd7d12928
2024-10-07 09:04:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 4d 67 79 2f 33 74 43 78 55 47 75 39 59 75 71 52 58 34 38 2b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QMgy/3tCxUGu9YuqRX48+Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49774	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:04:43 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6d 37 65 78 44 4a 64 61 53 30 36 36 72 69 37 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 34 62 62 30 61 35 63 35 63 32 30 65 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: m7exDJdaS066ri7Y.1Context: e74bb0a5c5c20ee
2024-10-07 09:04:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:04:43 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 6d 37 65 78 44 4a 64 61 53 30 36 36 72 69 37 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 34 62 62 30 61 35 63 35 63 32 30 65 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 4b Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: m7exDJdaS066ri7Y.2Context: e74bb0a5c5c20ee<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawEK
2024-10-07 09:04:43 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 6d 37 65 78 44 4a 64 61 53 30 36 36 72 69 37 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 34 62 62 30 61 35 63 35 63 32 30 65 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: m7exDJdaS066ri7Y.3Context: e74bb0a5c5c20ee<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 09:04:44 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:04:44 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 76 4e 51 79 6b 71 76 41 6b 79 37 47 74 4c 79 69 79 6e 34 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: PvNQykqvAky7GtLyiyn4aw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49775	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 69 39 47 45 39 69 52 68 55 30 4b 65 48 61 45 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 31 39 38 32 36 39 34 36 66 38 34 31 66 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: i9GE9iRhU0KeHaEj.1Context: 9519826946f841f7
2024-10-07 09:05:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:05:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 69 39 47 45 39 69 52 68 55 30 4b 65 48 61 45 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 31 39 38 32 36 39 34 36 66 38 34 31 66 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: i9GE9iRhU0KeHaEj.2Context: 9519826946f841f7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:05:00 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 69 39 47 45 39 69 52 68 55 30 4b 65 48 61 45 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 35 31 39 38 32 36 39 34 36 66 38 34 31 66 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: i9GE9iRhU0KeHaEj.3Context: 9519826946f841f7
2024-10-07 09:05:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:05:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 48 4e 77 76 51 35 5a 5a 6b 36 70 54 37 4f 61 51 51 34 54 78 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0HNwvQ5ZZk6pT7OaQQ4Txw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49777	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 58 4e 76 42 53 70 70 6a 55 32 59 2b 57 56 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 35 38 63 62 33 35 65 34 33 65 36 61 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: qXNvBSppjU2Y+WVA.1Context: e9c58cb35e43e6a1
2024-10-07 09:05:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:05:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 71 58 4e 76 42 53 70 70 6a 55 32 59 2b 57 56 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 35 38 63 62 33 35 65 34 33 65 36 61 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: qXNvBSppjU2Y+WVA.2Context: e9c58cb35e43e6a1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:05:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 58 4e 76 42 53 70 70 6a 55 32 59 2b 57 56 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 35 38 63 62 33 35 65 34 33 65 36 61 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: qXNvBSppjU2Y+WVA.3Context: e9c58cb35e43e6a1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 09:05:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:05:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 57 66 67 32 51 32 36 55 30 32 69 4f 4b 74 4b 6f 6b 59 58 66 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pWfg2Q26U02iOKtKokYXfw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49781	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:21 UTC	570	OUT	OPTIONS /report/v4?s=dBb%2BJjBpSBAJNrfMhPd%2BrfDmDuKdrj6iPRf%2FObgUSH2hFr6OqMTuIKNmT%2Fem6bSdvaeA%2BiVj%2B%2Bms%2FmFIOYkQeDWnqFtT9QFmbxaESpKBv%2Fk3%2BpHUaEH21Xlc0Okz0q9VptjZuh3wBJx3Z5CN HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://billings.7712billings.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:05:21 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 07 Oct 2024 09:05:20 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49782	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:21 UTC	562	OUT	OPTIONS /report/v4?s=ElvW0h27qdbclzgVfxwdFf4lZirXo11vd%2Bcx7pkd%2BGoaFF2uU%2BdlNtysDGD6VxlhRWmD7W1LUJ2vwCuMBCv%2BVLaJI%2FTrSlpqcXPeDmi4P50jeaoHTtyw39CZn7A0DvXSW04%2BJZ3uV0HiyPvB HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://billings.7712billings.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:05:21 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 07 Oct 2024 09:05:20 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49784	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:21 UTC	502	OUT	POST /report/v4?s=dBb%2BJjBpSBAJNrfMhPd%2BrfDmDuKdrj6iPRf%2FObgUSH2hFr6OqMTuIKNmT%2Fem6bSdvaeA%2BiVj%2B%2Bms%2FmFIOYkQeDWnqFtT9QFmbxaESpKBv%2Fk3%2BpHUaEH21Xlc0Okz0q9VptjZuh3wBJx3Z5CN HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 460 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:05:21 UTC	460	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 36 39 31 35 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 32 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 62 69 6c 6c 69 6e 67 73 2e 37 37 31 32 62 69 6c 6c 69 6e 67 73 2e 63 6f 6d 2f 65 6e 2d 55 53 2f 63 61 70 74 63 68 61 2e 70 68 70 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c Data Ascii: [{"age":56915,"body":{"elapsed_time":627,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://billings.7712billings.com/en-US/captcha.php","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":403,"type":"http.error"},
2024-10-07 09:05:22 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 07 Oct 2024 09:05:21 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49783	35.190.80.1	443	2412	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:21 UTC	494	OUT	POST /report/v4?s=ElvW0h27qdbclzgVfxwdFf4lZirXo11vd%2Bcx7pkd%2BGoaFF2uU%2BdlNtysDGD6VxlhRWmD7W1LUJ2vwCuMBCv%2BVLaJI%2FTrSlpqcXPeDmi4P50jeaoHTtyw39CZn7A0DvXSW04%2BJZ3uV0HiyPvB HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 452 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:05:21 UTC	452	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 33 32 36 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 32 33 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 35 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 69 6c 6c 69 6e 67 73 2e 37 37 31 Data Ascii: [{"age":53263,"body":{"elapsed_time":1231,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":405,"type":"http.error"},"type":"network-error","url":"https://billings.771
2024-10-07 09:05:22 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 07 Oct 2024 09:05:21 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49785	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 6a 64 48 37 35 2b 62 62 30 57 65 46 6a 63 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 34 31 34 61 35 63 63 34 63 31 33 36 63 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: yjdH75+bb0WeFjcY.1Context: 21414a5cc4c136ca
2024-10-07 09:05:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:05:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 6a 64 48 37 35 2b 62 62 30 57 65 46 6a 63 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 34 31 34 61 35 63 63 34 63 31 33 36 63 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: yjdH75+bb0WeFjcY.2Context: 21414a5cc4c136ca<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:05:24 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 79 6a 64 48 37 35 2b 62 62 30 57 65 46 6a 63 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 31 34 31 34 61 35 63 63 34 63 31 33 36 63 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: yjdH75+bb0WeFjcY.3Context: 21414a5cc4c136ca
2024-10-07 09:05:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:05:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 62 62 72 50 6c 78 46 4a 55 75 79 39 31 62 35 37 4e 43 30 43 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ebbrPlxFJUuy91b57NC0CA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49786	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:05:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 48 57 32 43 6b 38 41 6b 45 61 2f 63 54 58 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 34 64 31 63 62 34 38 62 38 39 64 33 30 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mHW2Ck8AkEa/cTXb.1Context: 584d1cb48b89d30f
2024-10-07 09:05:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-07 09:05:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 48 57 32 43 6b 38 41 6b 45 61 2f 63 54 58 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 34 64 31 63 62 34 38 62 38 39 64 33 30 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 55 39 6e 79 36 65 51 4e 32 72 4c 42 39 56 4b 30 79 62 65 54 65 42 51 75 6e 76 59 62 50 47 6a 6d 61 54 37 36 73 6d 6f 75 2b 77 58 70 2f 45 6e 54 4b 59 70 41 50 41 57 30 4a 52 38 5a 6e 4a 31 45 2f 58 34 68 72 61 58 54 43 49 68 6c 52 6d 69 73 44 73 55 63 62 6e 50 69 65 67 56 39 4a 42 35 70 39 33 5a 79 39 74 4a 65 73 73 61 77 45 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mHW2Ck8AkEa/cTXb.2Context: 584d1cb48b89d30f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAU9ny6eQN2rLB9VK0ybeTeBQunvYbPGjmaT76smou+wXp/EnTKYpAPAW0JR8ZnJ1E/X4hraXTCIhlRmisDsUcbnPiegV9JB5p93Zy9tJessawE
2024-10-07 09:05:35 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 48 57 32 43 6b 38 41 6b 45 61 2f 63 54 58 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 34 64 31 63 62 34 38 62 38 39 64 33 30 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mHW2Ck8AkEa/cTXb.3Context: 584d1cb48b89d30f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-07 09:05:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-07 09:05:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 48 4a 50 50 31 65 79 63 30 69 74 7a 42 4d 75 48 47 56 52 56 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QHJPP1eyc0itzBMuHGVRVQ.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3656, Parent PID: 6188

General

Target ID:	0
Start time:	05:04:08
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2412, Parent PID: 3656

General

Target ID:	2
Start time:	05:04:13
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2216,i,2912820162522885628,7329998329596348689,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7064, Parent PID: 6188

General

Target ID:	4
Start time:	05:04:16
Start date:	07/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://stammeszeit.ch/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.23
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: stammeszeit.chConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en-US/captcha.php HTTP/1.1Host: billings.7712billings.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://billings.7712billings.com/en-US/captcha.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://billings.7712billings.com/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://billings.7712billings.com/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://billings.7712billings.com/en-US/captcha.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1Host: billings.7712billings.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1Host: billings.7712billings.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1Host: billings.7712billings.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/ec4b873d446c/main.js? HTTP/1.1Host: billings.7712billings.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8cecb91e1be5186d HTTP/1.1Host: billings.7712billings.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: stammeszeit.ch
Source: global traffic	DNS traffic detected: DNS query: billings.7712billings.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://stammeszeit.ch/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
https://stammeszeit.ch/