Edit tour

Windows Analysis Report
https://my.norton.com/extspa/llonboard/idv/form2

Overview

General Information

Sample URL:	https://my.norton.com/extspa/llonboard/idv/form2
Analysis ID:	1541107
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,4355322394269608029,16993460720195172481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://my.norton.com/extspa/llonboard/idv/form2" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49733 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.51
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /symantec/cp1/Bootstrap.js HTTP/1.1Host: nexus.ensighten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/Bootstrap.js HTTP/1.1Host: nexus.ensighten.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1729765929179 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://my.norton.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/symantec/cp1/code/&publishedOn=Mon%20Jul%2003%2016:37:09%20GMT%202023&ClientID=21&PageID=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2 HTTP/1.1Host: nexus.ensighten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: symantec.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=87432529198126374650360190330118866763
Source: global traffic	HTTP traffic detected: GET /m2/symantec/mbox/json?mbox=sym_global_mbox&mboxSession=eeb7662070774edca038572e87dc71ba&mboxPC=&mboxPage=3e7eff5657134cacaa417b72c58a02fb&mboxRid=95487b1c763d4bf3aaa4b0e06803d432&mboxVersion=1.8.3&mboxCount=1&mboxTime=1729751529194&mboxHost=my.norton.com&mboxURL=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&mboxReferrer=&mboxXDomain=enabled&browserHeight=907&browserWidth=1280&browserTimeOffset=-240&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=ANGLE%20(Google%2C%20Vulkan%201.3.0%20(SwiftShader%20Device%20(Subzero)%20(0x0000C0DE))%2C%20SwiftShader%20driver)&Promocode=&profile.TCG=&vendor_type=&program_type=&site_country=&site_section=&content_title=&site_language=&traffic_source=&ExistingCustomer=&site_sub_section=&profile.promocode=&current_subchannel=&site_content_title=&original_subchannel=&profile.vendor_type=&profile.program_type=&profile.site_country=&site_sub_sub_section=&%20profile.site_section=&profile.site_language=&profile.%20traffic_source=&profile.ExistingCustomer=&profile.%20site_sub_section=&profile.current_subchannel=&profile.site_content_title=&profile.original_subchannel=&mboxMCSDID=39192FC575EFDA9E-79DEBE6A3E839DD8&mboxMCGVID=87272364839168777360339105128304970746&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6 HTTP/1.1Host: symantec.tt.omtrdc.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://my.norton.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1729765929179 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=87432529198126374650360190330118866763
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/symantec/cp1/code/&publishedOn=Mon%20Jul%2003%2016:37:09%20GMT%202023&ClientID=21&PageID=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2 HTTP/1.1Host: nexus.ensighten.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130 HTTP/1.1Host: nexus.ensighten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js HTTP/1.1Host: nexus.ensighten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m2/symantec/mbox/json?mbox=sym_global_mbox&mboxSession=eeb7662070774edca038572e87dc71ba&mboxPC=&mboxPage=3e7eff5657134cacaa417b72c58a02fb&mboxRid=95487b1c763d4bf3aaa4b0e06803d432&mboxVersion=1.8.3&mboxCount=1&mboxTime=1729751529194&mboxHost=my.norton.com&mboxURL=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&mboxReferrer=&mboxXDomain=enabled&browserHeight=907&browserWidth=1280&browserTimeOffset=-240&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=ANGLE%20(Google%2C%20Vulkan%201.3.0%20(SwiftShader%20Device%20(Subzero)%20(0x0000C0DE))%2C%20SwiftShader%20driver)&Promocode=&profile.TCG=&vendor_type=&program_type=&site_country=&site_section=&content_title=&site_language=&traffic_source=&ExistingCustomer=&site_sub_section=&profile.promocode=&current_subchannel=&site_content_title=&original_subchannel=&profile.vendor_type=&profile.program_type=&profile.site_country=&site_sub_sub_section=&%20profile.site_section=&profile.site_language=&profile.%20traffic_source=&profile.ExistingCustomer=&profile.%20site_sub_section=&profile.current_subchannel=&profile.site_content_title=&profile.original_subchannel=&mboxMCSDID=39192FC575EFDA9E-79DEBE6A3E839DD8&mboxMCGVID=87272364839168777360339105128304970746&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6 HTTP/1.1Host: symantec.tt.omtrdc.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: symantec!mboxSession=eeb7662070774edca038572e87dc71ba; symantec!mboxPC=eeb7662070774edca038572e87dc71ba.37_0
Source: global traffic	HTTP traffic detected: GET /error/e.gif?msg=mboxFactoryDefault%20is%20not%20defined&lnn=-1&fn=&cid=21&client=symantec&publishPath=cp1&rid=300053&did=167100&errorName=ReferenceError HTTP/1.1Host: nexus.ensighten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js HTTP/1.1Host: nexus.ensighten.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=ZxoiLQAAAJqQkgNx HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=87432529198126374650360190330118866763
Source: global traffic	HTTP traffic detected: GET /symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130 HTTP/1.1Host: nexus.ensighten.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=ZxoiLQAAAJqQkgNx HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=87432529198126374650360190330118866763; dpm=87432529198126374650360190330118866763
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s36224975530980?AQB=1&ndh=1&pf=1&t=24%2F9%2F2024%206%3A32%3A14%204%20240&sdid=39192FC575EFDA9E-79DEBE6A3E839DD8&mid=87272364839168777360339105128304970746&aamlh=6&ce=UTF-8&pageName=mynorton%3Aus%3Alifelock&g=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&v10=de527324-05e3-46eb-a2a7-43ab29c1aff7&c14=D%3Dv16&v18=mynorton%3Aus%3Alifelock&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v29=not%20signed%20in&c35=D%3DpageName&c41=mynorton&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-10-07&c48=Norton%20-%20My%20Subscription&v48=D%3Dc49&c49=lifelock&v49=D%3Dc48&v57=87272364839168777360339105128304970746&c59=mynorton%3Alifelock&v59=D%3Dc59&v72=mynorton&c75=D%3Dv57&v96=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&v133=na&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: at_check=true; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; mbox=session#eeb7662070774edca038572e87dc71ba#1729767792\|PC#eeb7662070774edca038572e87dc71ba.37_0#1793010732; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C20021%7CMCMID%7C87272364839168777360339105128304970746%7CMCAAMLH-1730370730%7C6%7CMCAAMB-1730370730%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729773130s%7CNONE%7CMCSYNCSOP%7C411-20028%7CvVersion%7C5.5.0; s_nr=1729765934933-New; event69=event69; channelStack=s_eVar72~mynorton; s_tbm=true; s_gpv=mynorton%3Aus%3Alifelock; s_gpv_custom=mynorton%3Alifelock; s_cc=true
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s36224975530980?AQB=1&ndh=1&pf=1&t=24%2F9%2F2024%206%3A32%3A14%204%20240&sdid=39192FC575EFDA9E-79DEBE6A3E839DD8&mid=87272364839168777360339105128304970746&aamlh=6&ce=UTF-8&pageName=mynorton%3Aus%3Alifelock&g=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&v10=de527324-05e3-46eb-a2a7-43ab29c1aff7&c14=D%3Dv16&v18=mynorton%3Aus%3Alifelock&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v29=not%20signed%20in&c35=D%3DpageName&c41=mynorton&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-10-07&c48=Norton%20-%20My%20Subscription&v48=D%3Dc49&c49=lifelock&v49=D%3Dc48&v57=87272364839168777360339105128304970746&c59=mynorton%3Alifelock&v59=D%3Dc59&v72=mynorton&c75=D%3Dv57&v96=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&v133=na&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1Host: oms.norton.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: at_check=true; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; mbox=session#eeb7662070774edca038572e87dc71ba#1729767792\|PC#eeb7662070774edca038572e87dc71ba.37_0#1793010732; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C20021%7CMCMID%7C87272364839168777360339105128304970746%7CMCAAMLH-1730370730%7C6%7CMCAAMB-1730370730%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729773130s%7CNONE%7CMCSYNCSOP%7C411-20028%7CvVersion%7C5.5.0; s_nr=1729765934933-New; event69=event69; channelStack=s_eVar72~mynorton; s_tbm=true; s_gpv=mynorton%3Aus%3Alifelock; s_gpv_custom=mynorton%3Alifelock; s_cc=true
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/5441611.js HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bat.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /action/0?ti=5441611&Ver=2&mid=8c334c8f-32ac-4c88-b600-ee9d8553bcf6&bo=1&sid=40e9d39091f311ef95348b02c946a95b&vid=40ea030091f311ef84760da8773eaf28&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Norton%20-%20My%20Subscription&p=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&r=&lt=8208&evt=pageLoad&sv=1&cdb=AQAQ&rn=227139 HTTP/1.1Host: bat.bing.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://my.norton.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/action/5441611.js HTTP/1.1Host: bat.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: my.norton.com
Source: global traffic	DNS traffic detected: DNS query: webapps.norton.com
Source: global traffic	DNS traffic detected: DNS query: static.nortoncdn.com
Source: global traffic	DNS traffic detected: DNS query: nexus.ensighten.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: www.nortonlifelock.com
Source: global traffic	DNS traffic detected: DNS query: symantec.demdex.net
Source: global traffic	DNS traffic detected: DNS query: symantec.tt.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: oms.norton.com

Source: chromecache_126.2.dr, chromecache_133.2.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN1cc7556280444b10a3c687a73ed01baa.js
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_134.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_134.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_116.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_116.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_124.2.dr, chromecache_111.2.dr	String found in binary or memory: https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/
Source: chromecache_116.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_130.2.dr, chromecache_116.2.dr, chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_130.2.dr, chromecache_116.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__.
Source: chromecache_99.2.dr, chromecache_118.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49733 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/77@46/15

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,4355322394269608029,16993460720195172481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://my.norton.com/extspa/llonboard/idv/form2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,4355322394269608029,16993460720195172481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://developers.google.com/recaptcha/docs/faq#localhost_support	0%	URL Reputation	safe
https://support.google.com/recaptcha#6262736	0%	URL Reputation	safe
https://cloud.google.com/recaptcha-enterprise/billing-information	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
https://support.google.com/recaptcha/?hl=en#6223828	0%	URL Reputation	safe
https://cloud.google.com/contact	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	0%	URL Reputation	safe
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
https://support.google.com/recaptcha	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
adobetarget.data.adobedc.net	66.235.152.225	true	false	unknown
d2pz9khpjpljz2.cloudfront.net	65.9.66.72	true	false	unknown
ax-0001.ax-dc-msedge.net	150.171.29.10	true	false	unknown
norton.com.ssl.sc.omtrdc.net	63.140.62.222	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	52.214.221.135	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
symantec.tt.omtrdc.net	unknown	unknown	false	unknown
oms.norton.com	unknown	unknown	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
www.nortonlifelock.com	unknown	unknown	false	unknown
my.norton.com	unknown	unknown	false	unknown
webapps.norton.com	unknown	unknown	false	unknown
dpm.demdex.net	unknown	unknown	false	unknown
cm.everesttech.net	unknown	unknown	false	unknown
nexus.ensighten.com	unknown	unknown	false	unknown
symantec.demdex.net	unknown	unknown	false	unknown
static.nortoncdn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://my.norton.com/extspa/llonboard/idv/llVerify	false	unknown
https://nexus.ensighten.com/symantec/cp1/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/symantec/cp1/code/&publishedOn=Mon%20Jul%2003%2016:37:09%20GMT%202023&ClientID=21&PageID=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2	false	unknown
https://nexus.ensighten.com/symantec/cp1/Bootstrap.js	false	unknown
https://nexus.ensighten.com/error/e.gif?msg=mboxFactoryDefault%20is%20not%20defined&lnn=-1&fn=&cid=21&client=symantec&publishPath=cp1&rid=300053&did=167100&errorName=ReferenceError	false	unknown
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1729765929179	false	unknown
https://oms.norton.com/b/ss/symanteccom/1/JS-2.22.0-LDQM/s36224975530980?AQB=1&ndh=1&pf=1&t=24%2F9%2F2024%206%3A32%3A14%204%20240&sdid=39192FC575EFDA9E-79DEBE6A3E839DD8&mid=87272364839168777360339105128304970746&aamlh=6&ce=UTF-8&pageName=mynorton%3Aus%3Alifelock&g=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&v10=de527324-05e3-46eb-a2a7-43ab29c1aff7&c14=D%3Dv16&v18=mynorton%3Aus%3Alifelock&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v29=not%20signed%20in&c35=D%3DpageName&c41=mynorton&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-10-07&c48=Norton%20-%20My%20Subscription&v48=D%3Dc49&c49=lifelock&v49=D%3Dc48&v57=87272364839168777360339105128304970746&c59=mynorton%3Alifelock&v59=D%3Dc59&v72=mynorton&c75=D%3Dv57&v96=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&v133=na&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1	false	unknown
https://symantec.demdex.net/dest5.html?d_nsid=0	false	unknown
https://nexus.ensighten.com/symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js	false	unknown
https://my.norton.com/extspa/llonboard/idv/form2	false	unknown
https://nexus.ensighten.com/symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130	false	unknown
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZxoiLQAAAJqQkgNx	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://assets.adobedtm.com/launch-EN1cc7556280444b10a3c687a73ed01baa.js	chromecache_126.2.dr, chromecache_133.2.dr	false		unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/recaptcha#6262736	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://recaptcha.net	chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/	chromecache_124.2.dr, chromecache_111.2.dr	false		unknown
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://cloud.google.com/contact	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_116.2.dr	false		unknown
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://getbootstrap.com)	chromecache_134.2.dr	false		unknown
https://support.google.com/recaptcha/#6175971	chromecache_130.2.dr, chromecache_116.2.dr	false	URL Reputation: safe	unknown
https://www.gstatic.c..?/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__.	chromecache_130.2.dr, chromecache_116.2.dr	false		unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_134.2.dr	false		unknown
https://www.google.com/recaptcha/api2/	chromecache_130.2.dr, chromecache_116.2.dr, chromecache_99.2.dr, chromecache_118.2.dr	false		unknown
https://support.google.com/recaptcha	chromecache_116.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.17.240.122	unknown	United States	16509	AMAZON-02US	false
52.208.241.210	unknown	United States	16509	AMAZON-02US	false
66.235.152.225	adobetarget.data.adobedc.net	United States	15224	OMNITUREUS	false
63.140.62.222	norton.com.ssl.sc.omtrdc.net	United States	15224	OMNITUREUS	false
65.9.66.72	d2pz9khpjpljz2.cloudfront.net	United States	16509	AMAZON-02US	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.9.66.103	unknown	United States	16509	AMAZON-02US	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
63.140.62.17	unknown	United States	15224	OMNITUREUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
150.171.29.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
52.214.221.135	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.8

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541107
Start date and time:	2024-10-24 12:31:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://my.norton.com/extspa/llonboard/idv/form2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/77@46/15

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 108.177.15.84, 172.217.16.206, 142.250.184.227, 137.116.52.99, 34.104.35.123, 184.28.89.29, 184.28.88.36, 52.167.206.54, 2.19.224.118, 52.17.97.65, 52.212.56.148, 54.77.122.229, 142.250.186.35, 4.245.163.56, 88.221.110.91, 2.16.100.168, 192.229.221.95, 216.58.206.35, 20.3.187.198, 52.165.164.15, 142.250.186.131, 93.184.221.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, cn-assets.adobedtm.com.edgekey.net, clientservices.googleapis.com, a767.dspw65.akamai.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, e4117.dsca.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, bat.bing.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, www.gstatic.com, wu-b-net.trafficmanager.net, nmp-portal.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, mue2-webportals-ngp-prod-pip-green.eastus2.cloudapp.azure.com, cm.everesttech.net.akadns.net, wu.ec.azureedge.net, www.nortonlifelock.com.edgekey.net, ctldl.windowsupdate.com, mue2-webportals-nmp-prod-pip-green.eastus2.cloudapp.azure.com, static.nortoncdn.com.edgekey.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://my.norton.com/extspa/llonboard/idv/form2

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://my.norton.com/extspa/llonboard/idv/llVerify Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Please wait while we verify your info", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://my.norton.com/extspa/llonboard/idv/llVerify Model: claude-3-haiku-20240307	```json { "brands": [ "Lifelock" ] }
	```json { "brands": [ "Lifelock" ] }
URL: https://my.norton.com/extspa/llonboard/idv/llVerify Model: gpt-4o	```json{ "legit_domain": "norton.com", "classification": "wellknown", "reasons": [ "The URL 'my.norton.com' is a subdomain of 'norton.com', which is the legitimate domain for Norton, a well-known cybersecurity brand.", "Lifelock is a service provided by Norton, so the brand association is correct.", "There are no suspicious elements in the URL such as misspellings or unusual domain extensions.", "The URL structure is consistent with legitimate subdomains used by large brands for specific services." ], "riskscore": 1}
URL: my.norton.com Brands: Lifelock Input Fields: u, n, k, n, o, w, n

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 09:32:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978012306081313
Encrypted:	false
SSDEEP:	48:8v0dxT5dEHgeidAKZdA1oehwiZUklqehNy+3:8veXHqy
MD5:	AF7220BBAEA7CC28A4E8D3B9CBBFDA2A
SHA1:	08617E31A0E73466628FF197CAA86A2C6BD7AD06
SHA-256:	244BA6BE04149A96E97AE635D5ACCC09624582A075A5B808BCF98B113AC39A52
SHA-512:	D3481472DC38A7A18B9E5FF334AD04407D5B2D31CB1775F79E65A345857FCF36FE200FA24D956A0E93F0F0A7A8FC016965B99A60B33E3B5CF12714FC52FE2821
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....wIU..%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.T...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 09:32:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995092481126425
Encrypted:	false
SSDEEP:	48:8B0dxT5dEHgeidAKZdA1leh/iZUkAQkqehay+2:8BeXt9QDy
MD5:	65D76DD4A033814357BF8ECCED272A9A
SHA1:	ABF6AFA9B5C3868B93622B7824DD99D445D7092A
SHA-256:	987FFF63E7CCD930C4E35DDA9EDE635D8E9D12AEF87C02E8532DED21FD0EE4CE
SHA-512:	FA9A52EB608DCA3FA34738519F23FF67DC9AE9B38DF6CE7BA6AFB85E8D642188572FA14E7E422556527382D448C1B89C24B80A0937BD6DA49C40758B6BACA7A2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......J..%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.T...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004985250938572
Encrypted:	false
SSDEEP:	48:8E0dxT5dbHgeidAKZdA14t5eh7sFiZUkmgqeh7sQy+BX:8EeXAnuy
MD5:	33EA5FAE518483A43BF3F8C0D54BCD07
SHA1:	38B41559B7548F5B09AC5F120428E853E7A37F27
SHA-256:	F91A87D3765742D3B5C157D49092212BEF9E3695D368A170A26789DD0DBDF1E3
SHA-512:	7FB98E8CD61C7C4A95C5EF127103009011B0075EB309459516F833670E8E1390EF6466791A6EE8D85D0F8D46536346AB25AE5815897E2BB97470FADC6D7CEE54
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 09:32:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9917521183035976
Encrypted:	false
SSDEEP:	48:820dxT5dEHgeidAKZdA16ehDiZUkwqehWy+R:82eXeYy
MD5:	F37301253BB85E019A9A58E6A177B9A3
SHA1:	58689344176A0FB76085382AB9D830CBBA50C4DE
SHA-256:	85D519FAD6B7D0D22BCFB8DE11FCCC6EB7FDECD6C52C6E1919F1A02AC911DEF9
SHA-512:	96D44B5E9A792D61C5C003934C3F1AAF0D6BFDD93742EA97E3EC446165F2A1C5A9A776407733C43DF17CF7022E1E2B6F28328189368BD39CBD432D7B8BC183F5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.T...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 09:32:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9820173662816476
Encrypted:	false
SSDEEP:	48:840dxT5dEHgeidAKZdA1UehBiZUk1W1qehky+C:84eXu9Ey
MD5:	99CBCD04A5FFAFD76C53E5F9D95A2594
SHA1:	FDDACE91ED01F83764DC4189851A59B704C8E991
SHA-256:	636BF82D9954FD235163C0D95DE6455D1B43168A90541AF55B5FBAA2360FFF93
SHA-512:	6AD420FEDA93A7B24F7F9722117481E94AEA9F4BF897614B41EDB353EB937B675E579492D9F5DC13BEF4E2398861C26FE943479F1A9E3938C5C8EA3B4A9EFEE1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......O..%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.T...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 09:32:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991304963424808
Encrypted:	false
SSDEEP:	48:8UN0dxT5dEHgeidAKZdA1duTrehOuTbbiZUk5OjqehOuTbuy+yT+:8UNeXvTYTbxWOvTbuy7T
MD5:	4C4A69BFCE5A47522679E928837AD27B
SHA1:	EF2295EEB47F903A41FEC55E91821639F1A9AD94
SHA-256:	30ADC5928D4424EA90EA86CCA6A467D65BFCAA2C0A448A542EB38C8FB8FC0F4E
SHA-512:	896EEA0F3517013FE17401D7F5E486FDA0C966EA51D3F9A021A8C356BC1C46D74A280FFC380D0E4A652E3F73C00D610A9C92EC9A6174C429F0E54A859510DF3E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....+:..%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY.T....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.T....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY.T....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY.T..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.T...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	4.851232690421989
Encrypted:	false
SSDEEP:	48:cIA+fEcrcAxVH7ElbhOzpWDjbEQX9KvRS7bSL5vsa5wZ9GZIfF:k+f9HXHchoWWVeSwH4k
MD5:	AF5814CCEBEF8C3E8FBAB0FA87C26A62
SHA1:	561B29895AE0B70047DE70DCFEFA5B53AE128810
SHA-256:	3AA1951A0D27225ED41318F7A7D077777E198FA6F5DE1951B1A47A784EB2D108
SHA-512:	47110DF9517BE3FAF42AD658704DDDFEAA7452A7CF097AE1E712FEA7D14451BF9ACC3958EACBD3E9F451760B5D52A89EB3DF81F52D8C24A72A2380807B9C0BFD
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 27.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 175 41" width="175" height="41" style="enable-background:new 0 0 175 41;" xml:space="preserve">..<style type="text/css">....st0{fill-rule:evenodd;clip-rule:evenodd;fill:#242424;}....st1{fill-rule:evenodd;clip-rule:evenodd;fill:#FFE01A;}..</style>..<g>...<path class="st0" d="M49.3,31.8V10.5h5.3v2.8h0.8c0.3-0.7,1-1.5,1.9-2.1c0.9-0.7,2.4-1,4.3-1c1.7,0,3.1,0.4,4.3,1.1....c1.2,0.8,2.2,1.8,2.9,3.1c0.7,1.3,1,2.9,1,4.7v12.7h-5.4V19.5c0-1.6-0.4-2.8-1.2-3.6c-0.8-0.8-1.9-1.2-3.4-1.2....c-1.7,0-2.9,0.6-3.9,1.7C55,17.5,54.5,19,54.5,21v10.8H49.3L49.3,31.8z M83.8,27.6c1.7,0,3-0.5,4.1-1.6s1.6-2.6,1.6-4.6V21....c0-2-0.5-3.5-1.6-4.6s-2.4-1.6-4.1-1.6s-3,0.5-4.1,1.6S78.1,19,78.1,21v0.4c0,2,0.5,3.5,1.6,4.6S82.2,27.6,83.8,27.6 M83.8,3

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57234
Entropy (8bit):	5.370033018170049
Encrypted:	false
SSDEEP:	768:mCDIK5JLp3SYRZde3/0mRUP4BTxhN1bgHCmxazbIw7FB+GiTCIc:midzJSuZ4BTxhN1b7mxMxBUc
MD5:	ED8A9BB99B66523597777BC67C269B0C
SHA1:	1CFF127147DE8E0FFC24E5ED23DF58C409DD3CD7
SHA-256:	051B391DC6796E292561D70D3F1ADD113BEBF6CAD27956F6BD774813CAB6CAE3
SHA-512:	6137449C2C6CC4CF23FBB0EE0CB3A767E36730F42149F521A57DE485C499555F2DE69FAAC088247A6D6D4E34F06DFA17141333C003D38AA2E1B204B3DDA986CA
Malicious:	false
Reputation:	low
Preview:	{"LifeLockEnrollments":{"CA":{"IDVCheckApplicable":"False","N360AppStoreUrl":"itms-apps://apps.apple.com/ca/app/lifelock-for-norton-360/id1422875903","N360PlayStoreUrl":"https://play.google.com/store/apps/details?id=com.symantec.lifelock.memberapp&hl={0}"},"US":{"IDVCheckApplicable":"True","N360AppStoreUrl":"itms-apps://itunes.apple.com/us/app/lifelock-for-norton-360/id1422875903?mt=8","N360PlayStoreUrl":"https://play.google.com/store/apps/details?id=com.symantec.lifelock.memberapp"}},"ClientAppSettings":{"AccountConfig":{"EnableAROODChat":"true","EnableClearHistoryInLogin":"false","ShowARRewardsCampaign":"true","ShowEmbeddedNsl":"true","ShowPrivacyOptions":"false","ShowSBTARForRetailDBCS":"true"},"AppUrl":"https://webapps.norton.com","ArConsentConfig":{"US":{"VT":{"DocumentId":"AR_V1","DocumentType":"AR","DocumentVersion":"1.0"}}},"ArRetentionConfig":{"EnableAROODChat":"true","EnableTnT":"true"},"AuthUrl":"https://webapps.norton.com/auth/signin?redirectUri={{redirectUri}}","CCAIChatCo

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (62896)
Category:	downloaded
Size (bytes):	62957
Entropy (8bit):	5.275287439830501
Encrypted:	false
SSDEEP:	768:EwgeKv8dLdVid8fRyuXtJ9g/k8CRyQmN96R5ESR3Z+gW1/85hhsRA/GfuCEjb:xldLPRfYuXtJ9g/kJ7R3YgN9
MD5:	63D17CCAA3F994B3C69C63430571E0E0
SHA1:	75A6C4CB1013AE10604800142DE52472DF739628
SHA-256:	6025F4EC0125F84D3D79527CE2286E2988AF546F55A174DB5DB3EEC14EB7C37D
SHA-512:	238A77BF02BF4DC8FCA2FE044AA2EB8A40783DCC33EA10F1EBB5EC3C0898BC815C22E79A39C9137E75A27EDD50059772DD64321946B36309ADB65694AA0291DC
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/app.js
Preview:	/! For license information please see app.js.LICENSE.txt /.(()=>{var e,t,r={188:(e,t,r)=>{"use strict";function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,o)}return r}function n(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?o(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):o(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function i(e,t,r){return(t=function(e){var t=function(e,t){if("object"!=typeof e\|\|null===e)return e;var r=e[Symbol.toPrimitive];if(void 0!==r){var o=r.call(e,t\|\|"default");if("object"!=typeof o)return o;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string"

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	122311
Entropy (8bit):	5.361527639314529
Encrypted:	false
SSDEEP:	1536:X9WYgy17/xrPw99+8zgd01Wq+Timxfk2awjYuI1t0TwX/LimVF:Xz7/xrPCFF5mxfk2VYuaX9
MD5:	FEDFDE3AE8DE64009FAC92B702BB7A4F
SHA1:	89EAF9D5349C50A530E11C73318136EBD5960DDC
SHA-256:	6D86FA54F7C9D8B51F2F058836AF20178C38447D1B7BA81C358A7847D60BE1A7
SHA-512:	7D6DFB8F9DFB82D7B8AA53536AA65F1C1D1AE2BC494EAC2060782004A67CB6D4228E18EBEA86B245F448971260CB1D4BF1B8114764503325928D6630460683B9
Malicious:	false
Reputation:	low
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[3],{"+auO":function(t,e,n){var r=n("XKFU"),o=n("lvtm");r(r.S,"Math",{cbrt:function(t){return o(t=+t)*Math.pow(Math.abs(t),1/3)}})},"+lvF":function(t,e,n){t.exports=n("VTer")("native-function-to-string",Function.toString)},"+oPb":function(t,e,n){"use strict";n("OGtf")("blink",function(t){return function(){return t(this,"blink","","")}})},"+rLv":function(t,e,n){var r=n("dyZX").document;t.exports=r&&r.documentElement},"/KAi":function(t,e,n){var r=n("XKFU"),o=n("dyZX").isFinite;r(r.S,"Number",{isFinite:function(t){return"number"==typeof t&&o(t)}})},"/SS/":function(t,e,n){var r=n("XKFU");r(r.S,"Object",{setPrototypeOf:n("i5dc").set})},"/e88":function(t,e){t.exports="\t\n\v\f\r \xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029\ufeff"},"0/R4":function(t,e){t.exports=function(t){return"object"==typeof t?null!==t:"function"==typeof t}},"0E+W":function(t,e,n){n("elZq")("Array")},"0

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	28111
Entropy (8bit):	4.010653211084802
Encrypted:	false
SSDEEP:	384:eEbTGvX4Q+DQ1PJvsWudgFa8iHU1gBpdg9dkklXsHRcKCRIo4OI/EAAhYt1cSYnz:dfgXks1JhG+gB3g97xEcK1XxYz
MD5:	7ACEDE7F75DA890B8BB3E6754BC9FB73
SHA1:	DDF3443F64A475D4B8FF5D6AD418ADC2581FF6EB
SHA-256:	35887C3D3787A7AE6B47F346AC95305B59143275ECDA228715A87F8752EA945C
SHA-512:	B3D5F0F8715E366D273B62B810168DE8A0052FB739019A1FFE8CCA39A54473FC638F88A8DC8C595DD42E0B98E13A55043FEFDCC7E0F9F6C77F15501BB366C80B
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/imgs/img-hand-idcard.a58413ebc40ef50f62d7.svg
Preview:	<svg width="264" height="144" viewBox="0 0 264 144" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M86.397 51.84C71.6373 75.2118 95.8675 106.842 125.179 125.353C139.678 134.509 155.884 137.954 170.83 136.556C219.677 131.987 236.389 77.6548 194.703 51.3299C165.392 32.8193 101.157 28.4682 86.397 51.84Z" fill="white"/>..<path d="M186.899 88.5425C182.956 96.2464 179.137 106.095 176.352 113.276C173.674 120.182 185.052 127.36 191.745 130.83C191.745 130.83 201.968 127.055 210.534 115.011C216.338 106.851 217.864 98.7105 218.256 94.533C212.271 91.4794 205.81 89.4046 199.784 86.29C193.813 83.204 187.775 86.8262 186.899 88.5425Z" fill="#FEEB29"/>..<path d="M134.066 90.3316C133.995 89.846 135.119 89.2349 135.111 88.2016C138.896 88.5842 147.962 91.6405 151.742 92.9298C155.522 94.2192 156.947 99.6519 157.187 102.207C153.545 102.739 143.576 101.861 142.003 100.994C140.431 100.126 134.154 90.9387 134.066 90.3316Z" fill="#E3B9A1"/>..<path fill-rule="evenodd" clip-rule="evenodd" d="M133.763 8

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	369
Entropy (8bit):	4.590817929815233
Encrypted:	false
SSDEEP:	6:2LGaUImyCp0GlYM1wBJPyQK5DrIt6xfeGYqX3ofWLGJw47Jsr4z+LAltEJRsVsVt:2ffmyCkMwykgIaoO4nsrqH9yv
MD5:	35DB82FB180E5BCD0BDBE6D93BB22FBF
SHA1:	1177FAC2BF250D1669453585A2151F4186A87AA3
SHA-256:	80057B238A62F569F8361C0C724FC6CA5EF4EC6EEE8C15D1FC3D19932BEE1A7C
SHA-512:	3DFB6E8B1D37F7522DD860C4E1E4F2BC1A9E3164CED13B07C005C6FFD307062213FD577C2C3CCD31E3DDC887F2B8F3D3D7F658823F766D7F401A63D99ECEB9E7
Malicious:	false
Reputation:	low
URL:	https://bat.bing.com/p/action/5441611.js
Preview:	(function(w,d,c,k,a,b,t,e) {.. var cs = d.currentScript;.. if (cs) {.. var uo = cs.getAttribute('data-ueto');.. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {.. w[uo].setUserSignals({'co': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});.. }.. }..})(window, document, 'us', true, true, false, false, false);..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 227180, version 1.0
Category:	downloaded
Size (bytes):	227180
Entropy (8bit):	7.998672302796162
Encrypted:	true
SSDEEP:	6144:ontlH0kriqsEimx44eY23pmX54q880Ocp3AjD11gyHD:GtFriqsu4XP5G9nSFAjxXD
MD5:	66C6E40883646A7AD993108B2CE2DA32
SHA1:	7A2602D2EBB08CE895E33ADDB6FE595F1029431E
SHA-256:	17FE38AB302C7E5DBFB5C3D87801092D79BE958500DB6412ED3BC0F126BD53D3
SHA-512:	8A166F9044346CCE8CA92B00F5DAC0DE6D0FF64AB72FBF390A268049FFFB72BE2BDA1397AE0EE97E37CF33E3C309CC630A638AB9151F944D8D05AD652D6CF261
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/Inter-roman.var.woff2
Preview:	wOF2......wl......84..v...............................D...J?HVAR.i.`?STAT....../l...$..Z..T.0..z.6.$..N. ......-[...el...........LM..>.......\..........A{.u:.,a.P4./$....Y.f.h.+..e. ..............p..[o&...4M..)-..B[.r.. .........a..l($4Q.S..aE<...eC.a))..Y.ZC..h.6.\Q.b%z!Tm.w....Y.z.......".Y..Y#....Z.K.B.I....D5.eJ....gde....~\+C.B#Jk...X.......;j.....U....vUY4l.v...4'.......PY.kH.5.:..u..b...9.BT.Z[!..Q....M..2...E.F..P.fc%....VD/..H!..Z...#.)...0..rzv.qpv..c...f....tH\|I.....ZX.@cu}.....I.f.}c....`.-...k.h.V...i.Ma...R.x.p.{....D.4...b.]...b...."........)....N=$..8.y.2...d.........!K.}$!..x..[..d[..(.Rj.!.Zi.1ZqZx%d&UA..e.....x...i.7E[....+.J....0.+3U.....z...4.Y..a..2W....S..!D.\|QtZ..;_..{....U!..8T.I.....:F..dV.%..dP..1..!r..1"...:..[.1..(.O.jBV..D.A..KB.....].v.u\|.;...^..sz...,y......d..A3+..?......F..=.IwSO...9.eD..-j"cR....0H`..%R........(....~o:.%.. ..h.\...$iw..7.&..1^1....;..X......rR.G...k.a.Z......x......\|.':> ....._...l

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 50x50, 32 bits/pixel
Category:	downloaded
Size (bytes):	10462
Entropy (8bit):	3.0111859978730964
Encrypted:	false
SSDEEP:	48:ViS5iWBYAOKSG3CQTSy6/c0ccc3/xcccccc8QXccccccccKsccccccccccfccccs:Vi8TjdqyJR9YDCQdfZ/
MD5:	703BA659B9435E57DDEB9156DB6FC16A
SHA1:	667937FCF6C9F08936FF0740D03603B8BEB3F6AE
SHA-256:	0A32B2518C4B3512887E88D605868C8CF4234AADC88673A9458F79D3843D3C7E
SHA-512:	FB557D9A83D1088AE559084684E82690C3865D63F7655BB8921E5667269E29B07B8C25BCB40F0F50ABDF4AD57EA961EC5FC169678848FA906689779F6F72DC4A
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/favicon.ico
Preview:	......22.... ..(......(...2...d..... ......'..#...#......................................................................................!...c...........................................h...&...........................................................................................................................................}.......................................................................%...................................................................................................................+...........................................................................................5.......................................................................................................................................................................................................................................................................................................I..............................................................................................

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	274
Entropy (8bit):	5.108871968006181
Encrypted:	false
SSDEEP:	6:tnrwdhC/gKumc4sl7vrERIp3mVCUhuTuNWWDE+49BhaR6ZFmqop:trwdU/gKuJlpm6EpDE+4bha4jwp
MD5:	26B8EB8D1F8DC899CBFE162495182EA9
SHA1:	B4060384B2EB47C52B6080364458AD6D63B92775
SHA-256:	2B71C8CA846D677AD4C917A6C026A20894550B77ED8CF86B01520A22625F869C
SHA-512:	7AFC8D9B901D7A4692CD8491BAFC7B8B2ED677D1491DCF0EFB6AE36F103243A12962BCD2DF042309BE37962C993B30714BAE405FB356F9513EDB2F3DBA2999FC
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/imgs/icon_lock.a78decca4b7857859570.svg
Preview:	<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 11V7C8 4.8 9.8 3 12 3C14.2 3 16 4.8 16 7V11M12 15V17M5 21V11C9.66667 11 14.3333 11 19 11V21H5Z" stroke="#242424" stroke-width="2" stroke-linecap="square"/>..</svg>..

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2316), with no line terminators
Category:	downloaded
Size (bytes):	2316
Entropy (8bit):	5.304072568915984
Encrypted:	false
SSDEEP:	48:iv9MNp+3LhM6gwevE7HXxMecTYVg+PIEpYPemyr2ZZkIElMTTdkG6uUWkDb4dD:oQorgE73aDcVHQE2PNyQ8GpkG6uUWk3Q
MD5:	264E2A36AE7127F27AD92F2452B39B39
SHA1:	213C28827BF957A0EF54F278F8557A167756B944
SHA-256:	0F772E655E44D86A0CFDC6E5826F4E7376A0A8FFC7A7A29F8ECBCFC73574350D
SHA-512:	435C1135AEC7F31F94FAABCD10466A60FA4ACA91667818A8F20CBA97D28108A0EA91C03BCD830F4A479895ACAE2A870ACDDCDB7FAD1813CDD74923E5BA405EC1
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/230.js
Preview:	"use strict";(self.webpackChunkngp_webapp=self.webpackChunkngp_webapp\|\|[]).push([[230],{230:(e,t,n)=>{n.r(t);var a=n(188),o=()=>{var e,t,n,a,o,r,i;e=window,t=document,n="script",e[a="uetq"]=e[a]\|\|[],o=function(){var t={ti:"5441611"};t.q=e[a],e[a]=new UET(t),e[a].push("pageLoad")},(r=t.createElement(n)).src="//bat.bing.com/bat.js",r.async=1,r.onload=r.onreadystatechange=function(){var e=this.readyState;e&&"loaded"!==e&&"complete"!==e\|\|(o(),r.onload=r.onreadystatechange=null)},(i=t.getElementsByTagName(n)[0]).parentNode.insertBefore(r,i);var c=document.getElementById("microsoft-publisher-pixel-container");c&&(c.innerHTML='<noscript><img src="//bat.bing.com/action/0?ti=5441611&Ver=2" height="0" width="0 style="display:none; visibility: hidden;" /></noscript>')};t.default=()=>{(()=>{window.google_conversion_id=1043330685,window.google_custom_params=window.google_tag_params,window.google_remarketing_only=!0;var e=document.getElementById("google-publisher-pixel-container");e&&(e.innerHTML='<

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	57234
Entropy (8bit):	5.370033018170049
Encrypted:	false
SSDEEP:	768:mCDIK5JLp3SYRZde3/0mRUP4BTxhN1bgHCmxazbIw7FB+GiTCIc:midzJSuZ4BTxhN1b7mxMxBUc
MD5:	ED8A9BB99B66523597777BC67C269B0C
SHA1:	1CFF127147DE8E0FFC24E5ED23DF58C409DD3CD7
SHA-256:	051B391DC6796E292561D70D3F1ADD113BEBF6CAD27956F6BD774813CAB6CAE3
SHA-512:	6137449C2C6CC4CF23FBB0EE0CB3A767E36730F42149F521A57DE485C499555F2DE69FAAC088247A6D6D4E34F06DFA17141333C003D38AA2E1B204B3DDA986CA
Malicious:	false
Reputation:	low
URL:	https://webapps.norton.com/config/client/appconfig
Preview:	{"LifeLockEnrollments":{"CA":{"IDVCheckApplicable":"False","N360AppStoreUrl":"itms-apps://apps.apple.com/ca/app/lifelock-for-norton-360/id1422875903","N360PlayStoreUrl":"https://play.google.com/store/apps/details?id=com.symantec.lifelock.memberapp&hl={0}"},"US":{"IDVCheckApplicable":"True","N360AppStoreUrl":"itms-apps://itunes.apple.com/us/app/lifelock-for-norton-360/id1422875903?mt=8","N360PlayStoreUrl":"https://play.google.com/store/apps/details?id=com.symantec.lifelock.memberapp"}},"ClientAppSettings":{"AccountConfig":{"EnableAROODChat":"true","EnableClearHistoryInLogin":"false","ShowARRewardsCampaign":"true","ShowEmbeddedNsl":"true","ShowPrivacyOptions":"false","ShowSBTARForRetailDBCS":"true"},"AppUrl":"https://webapps.norton.com","ArConsentConfig":{"US":{"VT":{"DocumentId":"AR_V1","DocumentType":"AR","DocumentVersion":"1.0"}}},"ArRetentionConfig":{"EnableAROODChat":"true","EnableTnT":"true"},"AuthUrl":"https://webapps.norton.com/auth/signin?redirectUri={{redirectUri}}","CCAIChatCo

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1574), with CRLF line terminators
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	5.193573994452999
Encrypted:	false
SSDEEP:	24:EFoyytfRGmcH7LGrYo7zsQCBm3lBmGa0BTLWwMWiB/azfIvJktQZuga8RZY1Av:EC3RZc8Y8QQuKTLWnBeYktQwZ8R3
MD5:	B76EB561F35911133FE0A4D0E249DDFC
SHA1:	6162A245FA038A9A53BE7483A0236E7D614D6AA0
SHA-256:	34B19F84FC86EE03F9E23873A7F7955A6618545DEC7256BF76B8FD4850D21EF4
SHA-512:	87E239F74BFB39C077816DCA5845ACB7A0B3BC1F69C04A405625CFEEC344061FF444B8D1B80657992A6627C1C5170865F987829B8FB7A462B3D1B4D24B4FEDA4
Malicious:	false
Reputation:	low
Preview:	!function(e){function r(r){for(var n,l,i=r[0],f=r[1],p=r[2],c=0,s=[];c<i.length;c++)l=i[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,p\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,i=1;i<t.length;i++)0!==o[t[i]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3084
Entropy (8bit):	4.851232690421989
Encrypted:	false
SSDEEP:	48:cIA+fEcrcAxVH7ElbhOzpWDjbEQX9KvRS7bSL5vsa5wZ9GZIfF:k+f9HXHchoWWVeSwH4k
MD5:	AF5814CCEBEF8C3E8FBAB0FA87C26A62
SHA1:	561B29895AE0B70047DE70DCFEFA5B53AE128810
SHA-256:	3AA1951A0D27225ED41318F7A7D077777E198FA6F5DE1951B1A47A784EB2D108
SHA-512:	47110DF9517BE3FAF42AD658704DDDFEAA7452A7CF097AE1E712FEA7D14451BF9ACC3958EACBD3E9F451760B5D52A89EB3DF81F52D8C24A72A2380807B9C0BFD
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/imgs/norton-light.b9d5ad401f1cf28abcca.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 27.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 175 41" width="175" height="41" style="enable-background:new 0 0 175 41;" xml:space="preserve">..<style type="text/css">....st0{fill-rule:evenodd;clip-rule:evenodd;fill:#242424;}....st1{fill-rule:evenodd;clip-rule:evenodd;fill:#FFE01A;}..</style>..<g>...<path class="st0" d="M49.3,31.8V10.5h5.3v2.8h0.8c0.3-0.7,1-1.5,1.9-2.1c0.9-0.7,2.4-1,4.3-1c1.7,0,3.1,0.4,4.3,1.1....c1.2,0.8,2.2,1.8,2.9,3.1c0.7,1.3,1,2.9,1,4.7v12.7h-5.4V19.5c0-1.6-0.4-2.8-1.2-3.6c-0.8-0.8-1.9-1.2-3.4-1.2....c-1.7,0-2.9,0.6-3.9,1.7C55,17.5,54.5,19,54.5,21v10.8H49.3L49.3,31.8z M83.8,27.6c1.7,0,3-0.5,4.1-1.6s1.6-2.6,1.6-4.6V21....c0-2-0.5-3.5-1.6-4.6s-2.4-1.6-4.1-1.6s-3,0.5-4.1,1.6S78.1,19,78.1,21v0.4c0,2,0.5,3.5,1.6,4.6S82.2,27.6,83.8,27.6 M83.8,3

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	274
Entropy (8bit):	5.108871968006181
Encrypted:	false
SSDEEP:	6:tnrwdhC/gKumc4sl7vrERIp3mVCUhuTuNWWDE+49BhaR6ZFmqop:trwdU/gKuJlpm6EpDE+4bha4jwp
MD5:	26B8EB8D1F8DC899CBFE162495182EA9
SHA1:	B4060384B2EB47C52B6080364458AD6D63B92775
SHA-256:	2B71C8CA846D677AD4C917A6C026A20894550B77ED8CF86B01520A22625F869C
SHA-512:	7AFC8D9B901D7A4692CD8491BAFC7B8B2ED677D1491DCF0EFB6AE36F103243A12962BCD2DF042309BE37962C993B30714BAE405FB356F9513EDB2F3DBA2999FC
Malicious:	false
Reputation:	low
Preview:	<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8 11V7C8 4.8 9.8 3 12 3C14.2 3 16 4.8 16 7V11M12 15V17M5 21V11C9.66667 11 14.3333 11 19 11V21H5Z" stroke="#242424" stroke-width="2" stroke-linecap="square"/>..</svg>..

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28028
Entropy (8bit):	4.328610230367691
Encrypted:	false
SSDEEP:	384:CDKV5jcMbUzy2n/kG+pWz+z03WCNzcmwMgmvOihOu9v3MVst9egQ2U1DM:yYPS4I39Nz78u9v3Cs9fQ/u
MD5:	71D1CE5E1F81CE4568AC1E889D62FF60
SHA1:	0A1F7DC489DD6FE3766124D21BD61E1045037C11
SHA-256:	6F7A9BFCE9CB32A6D959911B149ACB1BBA1E9125F679924A19A5DDDC5B0968BB
SHA-512:	C1965F05ABDC188EE3234E29713DADEEBB1A5C44844D00F5CF28113C30D0B5B7F499BCC97AC7701B8B6BA547F872FD840643945A64B965031E16B93847CF6663
Malicious:	false
Reputation:	low
Preview:	<svg width="416" height="312" viewBox="0 0 416 312" fill="none" xmlns="http://www.w3.org/2000/svg">..<g clip-path="url(#clip0_1956_60878)">..<g clip-path="url(#clip1_1956_60878)">..<path d="M300.293 73.5566H357.375C361.769 73.5566 365.334 70.5397 365.334 66.8208V19.2925C365.334 15.5736 361.769 12.5566 357.375 12.5566H300.293C295.899 12.5566 292.334 15.5736 292.334 19.2925V66.8266C292.334 70.5455 295.899 73.5566 300.293 73.5566Z" fill="white"/>..<path d="M222.293 73.5566H279.375C283.769 73.5566 287.334 70.5397 287.334 66.8208V19.2925C287.334 15.5736 283.769 12.5566 279.375 12.5566H222.293C217.899 12.5566 214.334 15.5736 214.334 19.2925V66.8266C214.334 70.5455 217.899 73.5566 222.293 73.5566Z" fill="white"/>..<path d="M300.293 138.557H357.375C361.769 138.557 365.334 135.54 365.334 131.821V84.2925C365.334 80.5736 361.769 77.5566 357.375 77.5566H300.293C295.899 77.5566 292.334 80.5736 292.334 84.2925V131.827C292.334 135.546 295.899 138.557 300.293 138.557Z" fill="white"/>..<path d="M222.29

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7804
Entropy (8bit):	4.988343061314785
Encrypted:	false
SSDEEP:	192:r1JagMgsHPjqLSk/n15C+MNuLo8Awy2h8E42pTaA31lRzfY:r1JaOsvGL7E+MN2rbxFlRDY
MD5:	30450A974A9BE61DAF9AE0D55E065579
SHA1:	3721961C2F62D4AB0A1AEA1AA02F0A5E4224993F
SHA-256:	5448B171E2D7792B57DB860B1A58F2EA52F5DCFEA2E1238D60EF62EA1CBEE7C1
SHA-512:	92ED39A01AD098D9C8338769570F6EB46D94F2FBB920F54DE89426E37408740EFD8B93681A4286E2EFC0AC38CCEC54B5EF177823F02A3CEE76493301960D7823
Malicious:	false
Reputation:	low
Preview:	{"VerifyYourIdentity":"Verify Your Identity","VerifyYourIdentityDescription":"To activate your membership, we first need to verify your identity.","DateOfBirth":"Date of Birth","Error_EnterValidDOB":"Enter a valid date of birth","Error_DOBAgeLimit":"Member must be over 18","Error_InvalidEmail":"Enter a valid e-mail","SocialSecurityNumber":"Social Security Number (SSN)","SocialInsuranceNumber":"Social Insurance Number (SIN)","Error_InvalidSSN":"Invalid Social Security Number","UnexpectedErrorMessage":"An unexpected system error occurred and we can.t display your information at this time. Please try again later.","DOB_PlaceHolder":"Birthday (MM/DD/YYYY)","DOB_PlaceHolder_CA":"Birthday (YYYY/MM/DD)","DOBFormatDesc":"Use MM/DD/YYYY format.","DOBFormatDesc_CA":"Use YYYY/MM/DD format.","EMAIL_PlaceHolder":"Email Address","SSN_PlaceHolder":"Social Security Number","SIN_PlaceHolder":"Social Insurance Number","firstName":"First Name","middleName":"Middle Initial","lastName":"Last Name","suf

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (715)
Category:	dropped
Size (bytes):	557225
Entropy (8bit):	5.682542013673887
Encrypted:	false
SSDEEP:	6144:OgpQyxlMBfak0xzcDYXR1iFPlXmN8gQxDtX5ZidRuUWWIlRoPlh5ZVgJP/pFUvR:Ogiy/MyxzPv+PlJ8dYUWllRqa0
MD5:	1D3C12EF7348978206413B2C985D0E37
SHA1:	4C8BF7428BA9FF2C3F9E54C05065604D5C4D6A4C
SHA-256:	5AB8F962752071D61B4C1613F2126EAD5A5969B0157509532CB1CC43D1C0486D
SHA-512:	0B544007426B2F5A7D5EA806CF2DC94E1D7C79DDD67D14E5D0D527CC367DD42BE0300D9AF32592D9BF59683183E7085C502C49D233ACB10F8AFB07A2B5463266
Malicious:	false
Reputation:	low
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2018 Google Inc. SPDX-License-Identifier: Apache-2.0./.var S=function(){return[function(I,w,X,a,c,C,V){if(I>>(((C=[44,"K",27],I)&C[0])==I&&b.call(this,w),1)>=11&&(I^78)<C[2])if(typeof X.dispose=="function")X.dispose();else for(a in X)X[a]=w;return((I^50)>>3==3&&(X[C[1]]=c?U[18](18,w,a,!0):a,X[C[1]]&&(X[C[1]]=X[C[1]].replace(/:$/,"")),V=X),I\|24)==I&&(V=X.firstElementChild!==void 0?X.firstElementChild:k[26](19,1,w,X.firstChild)),V},function(I,w,X,a,c,C,V,z,g,l,d,R,F,Y){return((((I-9&7)>=(Y=["S",4,70],Y[1])&&I-8<20&&!w.K&&(w.K=new Map,w[Y[0]]=0,w.H&&f[49](12,.1,null,0,"&",function(N,Z){w.add(decodeURI

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	7804
Entropy (8bit):	4.988343061314785
Encrypted:	false
SSDEEP:	192:r1JagMgsHPjqLSk/n15C+MNuLo8Awy2h8E42pTaA31lRzfY:r1JaOsvGL7E+MN2rbxFlRDY
MD5:	30450A974A9BE61DAF9AE0D55E065579
SHA1:	3721961C2F62D4AB0A1AEA1AA02F0A5E4224993F
SHA-256:	5448B171E2D7792B57DB860B1A58F2EA52F5DCFEA2E1238D60EF62EA1CBEE7C1
SHA-512:	92ED39A01AD098D9C8338769570F6EB46D94F2FBB920F54DE89426E37408740EFD8B93681A4286E2EFC0AC38CCEC54B5EF177823F02A3CEE76493301960D7823
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/locales/en.json
Preview:	{"VerifyYourIdentity":"Verify Your Identity","VerifyYourIdentityDescription":"To activate your membership, we first need to verify your identity.","DateOfBirth":"Date of Birth","Error_EnterValidDOB":"Enter a valid date of birth","Error_DOBAgeLimit":"Member must be over 18","Error_InvalidEmail":"Enter a valid e-mail","SocialSecurityNumber":"Social Security Number (SSN)","SocialInsuranceNumber":"Social Insurance Number (SIN)","Error_InvalidSSN":"Invalid Social Security Number","UnexpectedErrorMessage":"An unexpected system error occurred and we can.t display your information at this time. Please try again later.","DOB_PlaceHolder":"Birthday (MM/DD/YYYY)","DOB_PlaceHolder_CA":"Birthday (YYYY/MM/DD)","DOBFormatDesc":"Use MM/DD/YYYY format.","DOBFormatDesc_CA":"Use YYYY/MM/DD format.","EMAIL_PlaceHolder":"Email Address","SSN_PlaceHolder":"Social Security Number","SIN_PlaceHolder":"Social Insurance Number","firstName":"First Name","middleName":"Middle Initial","lastName":"Last Name","suf

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1497), with no line terminators
Category:	downloaded
Size (bytes):	1497
Entropy (8bit):	5.754030298959625
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAjZJlj+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtQ1vS1Zc:VKEciyKo7LmvtUjPKtX7+1vQZ/rLrwUG
MD5:	6672483D641E341A4E17D72C0A892F95
SHA1:	0B2257AC38E830708B472F3A0607F4C9BC747658
SHA-256:	CDA8FED4FA8356CEC4E8FE1E0E0858395C2A5BAA23C645023A9CE78033787E21
SHA-512:	1E552DC881AE0775F8810403AAC22A75FE0F23C8BB46BAA8F9A90E3A38AC7E9232A068AB6272D60E917B6964295E1AEE090EAC3FB8CA87C9784337AAE7621CCE
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('explicit');(cfg['onload']=cfg['onload']\|\|[]).push('ng2recaptchaloaded');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (527)
Category:	downloaded
Size (bytes):	11156
Entropy (8bit):	5.099068978602794
Encrypted:	false
SSDEEP:	192:Vn17H/nttPian1lDgU9cjhcAZJqtniMj+8qVk3m8Moj+0Wknu6rouE:r7VtblkhvZJXM6hVEmlMWZ68uE
MD5:	2838622562EA0DFB9F92CC6B6DD0CF0C
SHA1:	FFEAF3B0AFB5F8DA83F643121FCB09054F2E4D33
SHA-256:	6FC5C3F9269C3777EC783AF059224740282FAFB4F415B61FA45CA940EE7EB529
SHA-512:	996947C3EBCF1965C7162BDE0F75A84A8B01751A1F022CD3F56DD9287E6A10CD54FE036F625FCD98508008ED23B2BC6CE8A8B1B9E9438FBC48B514247A24CF1B
Malicious:	false
Reputation:	low
URL:	https://nexus.ensighten.com/symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130
Preview:	Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return window.location.search.replace("?","\x26").split("\x26gclsrc\x3d").pop().split("\x26").shift()},transform:function(val){return val?val:""},load:"instance",trigger:Bootstrapper.data.immediateTrigger,dataDefName:"GA4 - Page - Params - gclsrc",collection:"GA4 - Page - Params",.source:"Manage",priv:"false"},{id:"64943"})},64943)},-1,-1);.Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return document.referrer},transform:function(val){return val?val:""},load:"instance",trigger:Bootstrapper.data.immediateTrigger,dataDefName:"GA4 - Referrer - URL",collection:"GA4 - Referrer",source:"Manage",priv:"fa

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 50x50, 32 bits/pixel
Category:	dropped
Size (bytes):	10462
Entropy (8bit):	3.0111859978730964
Encrypted:	false
SSDEEP:	48:ViS5iWBYAOKSG3CQTSy6/c0ccc3/xcccccc8QXccccccccKsccccccccccfccccs:Vi8TjdqyJR9YDCQdfZ/
MD5:	703BA659B9435E57DDEB9156DB6FC16A
SHA1:	667937FCF6C9F08936FF0740D03603B8BEB3F6AE
SHA-256:	0A32B2518C4B3512887E88D605868C8CF4234AADC88673A9458F79D3843D3C7E
SHA-512:	FB557D9A83D1088AE559084684E82690C3865D63F7655BB8921E5667269E29B07B8C25BCB40F0F50ABDF4AD57EA961EC5FC169678848FA906689779F6F72DC4A
Malicious:	false
Reputation:	low
Preview:	......22.... ..(......(...2...d..... ......'..#...#......................................................................................!...c...........................................h...&...........................................................................................................................................}.......................................................................%...................................................................................................................+...........................................................................................5.......................................................................................................................................................................................................................................................................................................I..............................................................................................

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2316), with no line terminators
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	5.304072568915984
Encrypted:	false
SSDEEP:	48:iv9MNp+3LhM6gwevE7HXxMecTYVg+PIEpYPemyr2ZZkIElMTTdkG6uUWkDb4dD:oQorgE73aDcVHQE2PNyQ8GpkG6uUWk3Q
MD5:	264E2A36AE7127F27AD92F2452B39B39
SHA1:	213C28827BF957A0EF54F278F8557A167756B944
SHA-256:	0F772E655E44D86A0CFDC6E5826F4E7376A0A8FFC7A7A29F8ECBCFC73574350D
SHA-512:	435C1135AEC7F31F94FAABCD10466A60FA4ACA91667818A8F20CBA97D28108A0EA91C03BCD830F4A479895ACAE2A870ACDDCDB7FAD1813CDD74923E5BA405EC1
Malicious:	false
Reputation:	low
Preview:	"use strict";(self.webpackChunkngp_webapp=self.webpackChunkngp_webapp\|\|[]).push([[230],{230:(e,t,n)=>{n.r(t);var a=n(188),o=()=>{var e,t,n,a,o,r,i;e=window,t=document,n="script",e[a="uetq"]=e[a]\|\|[],o=function(){var t={ti:"5441611"};t.q=e[a],e[a]=new UET(t),e[a].push("pageLoad")},(r=t.createElement(n)).src="//bat.bing.com/bat.js",r.async=1,r.onload=r.onreadystatechange=function(){var e=this.readyState;e&&"loaded"!==e&&"complete"!==e\|\|(o(),r.onload=r.onreadystatechange=null)},(i=t.getElementsByTagName(n)[0]).parentNode.insertBefore(r,i);var c=document.getElementById("microsoft-publisher-pixel-container");c&&(c.innerHTML='<noscript><img src="//bat.bing.com/action/0?ti=5441611&Ver=2" height="0" width="0 style="display:none; visibility: hidden;" /></noscript>')};t.default=()=>{(()=>{window.google_conversion_id=1043330685,window.google_custom_params=window.google_tag_params,window.google_remarketing_only=!0;var e=document.getElementById("google-publisher-pixel-container");e&&(e.innerHTML='<

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.590817929815233
Encrypted:	false
SSDEEP:	6:2LGaUImyCp0GlYM1wBJPyQK5DrIt6xfeGYqX3ofWLGJw47Jsr4z+LAltEJRsVsVt:2ffmyCkMwykgIaoO4nsrqH9yv
MD5:	35DB82FB180E5BCD0BDBE6D93BB22FBF
SHA1:	1177FAC2BF250D1669453585A2151F4186A87AA3
SHA-256:	80057B238A62F569F8361C0C724FC6CA5EF4EC6EEE8C15D1FC3D19932BEE1A7C
SHA-512:	3DFB6E8B1D37F7522DD860C4E1E4F2BC1A9E3164CED13B07C005C6FFD307062213FD577C2C3CCD31E3DDC887F2B8F3D3D7F658823F766D7F401A63D99ECEB9E7
Malicious:	false
Reputation:	low
Preview:	(function(w,d,c,k,a,b,t,e) {.. var cs = d.currentScript;.. if (cs) {.. var uo = cs.getAttribute('data-ueto');.. if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') {.. w[uo].setUserSignals({'co': c, 'kc': k, 'at': a, 'bi': b, 'dt': t, 'ec': e});.. }.. }..})(window, document, 'us', true, true, false, false, false);..

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32054)
Category:	downloaded
Size (bytes):	82737
Entropy (8bit):	5.417054529586679
Encrypted:	false
SSDEEP:	1536:CZVMbRJN4CoVUTM2ua1OM7CfzGQxmZQx5UG/Lo+oqbH:CaJMYOMuSZQBLDr
MD5:	6CDA8B6271B502ED1174336D6537D44B
SHA1:	7A5D5256CED6EA8B8C4B88CB08A7EF0CCB13FE62
SHA-256:	7CA9E9328C72EAF9F7CB3E12648AD05411A6140291B284D4785E65BB02FB290B
SHA-512:	7B54A019BAAF08183FA482C73498195B8137C1342818AC57D2DFB4C851C76198FF730125329231CD85BD480DBA3DCD75883E160DBD92169B98F1032E59AB9043
Malicious:	false
Reputation:	low
URL:	https://www.nortonlifelock.com/content/dam/norton-adobe-analytics/prod/s_code_norton_min.js
Preview:	/! Norton - v1.0.2 - 2024-10-07 /function s_doPlugins(a){try{_numeric_.utils.strangeTrafficExclude();var b=localStorage.getItem("strangeTrafficExclude");b&&(a.abort=!0)}catch(c){}var d=a.linkURL;if(void 0!==typeof a.linkType&&"d"==a.linkType&&"string"==typeof d){a.pageName&&a.pageName.match(/avira:(.):downloads:free-products/gi)&&d.match(/(avira_)(._)(sptl1_)(.)(__.\.exe)/gi)&&(a.linkURL=d=d.replace(/(avira_)(._)(sptl1_)(.)(__.*\.exe)/gi,"$1$2$3$5")),a.events="event1";var e=d.split("/"),f=e[e.length-1],g=f.substr(f.lastIndexOf(".")+1).toLowerCase();a.eVar1="D=c33",a.prop33=d,a.prop46=g,a.prop47="download",a.prop48=f,a.eVar49="D=c48",a.linkTrackVars="events,prop2,prop33,prop41,prop46,prop47,prop48,prop49,prop59,eVar1,eVar18,eVar27,eVar41,eVar48,eVar49,eVar59",a.linkTrackEvents="event1"}else void 0!==typeof a.linkType&&"e"==a.linkType&&(a.linkTrackVars="None",a.linkTrackEvents="None");a.eVar47="s_code_norton "+s_code_file_modified_date,a.prop21=a.getQueryParam("inid"),!a.prop21&&

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1574), with CRLF line terminators
Category:	downloaded
Size (bytes):	1576
Entropy (8bit):	5.193573994452999
Encrypted:	false
SSDEEP:	24:EFoyytfRGmcH7LGrYo7zsQCBm3lBmGa0BTLWwMWiB/azfIvJktQZuga8RZY1Av:EC3RZc8Y8QQuKTLWnBeYktQwZ8R3
MD5:	B76EB561F35911133FE0A4D0E249DDFC
SHA1:	6162A245FA038A9A53BE7483A0236E7D614D6AA0
SHA-256:	34B19F84FC86EE03F9E23873A7F7955A6618545DEC7256BF76B8FD4850D21EF4
SHA-512:	87E239F74BFB39C077816DCA5845ACB7A0B3BC1F69C04A405625CFEEC344061FF444B8D1B80657992A6627C1C5170865F987829B8FB7A462B3D1B4D24B4FEDA4
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/runtime.js
Preview:	!function(e){function r(r){for(var n,l,i=r[0],f=r[1],p=r[2],c=0,s=[];c<i.length;c++)l=i[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(a&&a(r);s.length;)s.shift()();return u.push.apply(u,p\|\|[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,i=1;i<t.length;i++)0!==o[t[i]]&&(n=!1);n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={0:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)\|\|Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520)
Category:	dropped
Size (bytes):	1459
Entropy (8bit):	5.3439323669767065
Encrypted:	false
SSDEEP:	24:1cUq6XZXGle5pPBlEzjH7VRWZ/M5Fxv6gpCH61l+mV4SVo00VjQI2KAY6W8n:puCpP/EzjbVw1Wxv60o61lp44ejdAU8
MD5:	693E44CB920A49CD359C9B2A0205281F
SHA1:	FCD3786052B6BAF8AFBEDC240BEE6C70DEA6D3A5
SHA-256:	037AEE8B899729D810F4D25B755A1F59062C841462FF650FFDDE54FD1F9C5F93
SHA-512:	4817F376E563870B3345F376B15DADF84826115E9426256EEE339218041F5870B32EE5BF6481143C4630D58B75AB52AA6636FD32C5E927C41D0FF79390D71755
Malicious:	false
Reputation:	low
Preview:	Bootstrapper.bindDOMParsed(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;window.crossDomains="us.norton.com,buy.norton.com,www.norton.com,";mboxFactoryDefault.addOnLoad(function(){var getMboxSessionID=function(){var s=(new Date).getTime()+"-"+Math.floor(Math.random()*999999);if(typeof mboxFactoryDefault=="object")return mboxFactoryDefault.getSessionId().getId();if(document.cookie.indexOf("mbox\x3d")>-1){var a=document.cookie.indexOf("\|session#")>.-1?document.cookie.split("\|session#")[1]\|\|"":"";a=a!=""?a.split("#")[0]:"";if(a!=""&&a.length>0&&a.length<30&&a.indexOf("-")!=-1)return a;else return s}else return s},a=function(tag){var tags=window.document.getElementsByTagName(tag);for(var i=0;i<tags.length;i++){var t=tag=="form"?tags[i].action\|\|"":tags[i].href\|\|"";if(t!=""&&t.indexOf("://")>-1){var td=t.split("://")[1].split("/")[0];if(t.indexOf("avascript")==-1&&t.indexOf("mboxSession\x3d")==-1&&t.indexOf(location.hostname)==-1&&windo

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32764)
Category:	dropped
Size (bytes):	188091
Entropy (8bit):	5.364603486008455
Encrypted:	false
SSDEEP:	3072:qunipShhNVZud6NYzUZkiPj07OU/LDsnb:qunipShVZudcYzUZN071/+
MD5:	8C370AB1ABE10490ACA72C000FC8B322
SHA1:	ACBFD69BE4464F254B79DEC3395B5DA454986A42
SHA-256:	765BCC5C747A0E4C9BCE94F6132561E4D81CA391BE2BF5D8080C3C04A85CBA08
SHA-512:	01B1ADCBC464760BFBBE604F39EAF5E3048972C2C7BEF80888C468E28C8C3425D94192C6EA41C7540EB630192AA7BA9C564AF038FF155C7DDDE1CD8E38256803
Malicious:	false
Reputation:	low
Preview:	// For license information, see `https://assets.adobedtm.com/launch-EN1cc7556280444b10a3c687a73ed01baa.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-04-09T22:13:06Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"EN1cc7556280444b10a3c687a73ed01baa",stage:"production"},dataElements:{"Traffic Source":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.traffic_source"}},TCG:{defaultValue:"",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.Test_Group"}},"Site Language":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_language"}},"Page Name":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalyt

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (51384), with no line terminators
Category:	dropped
Size (bytes):	51385
Entropy (8bit):	5.293328685395304
Encrypted:	false
SSDEEP:	768:IaOFhhRC5JFhLjfRysgLzQynDw5YyDMFW8KQ:IaOFnR2DRszQKaoWtQ
MD5:	6626C1362840EBFC8F48294E8F023E18
SHA1:	4EC0DFB37C3E536C1B5EC04B68C9846FDBAF9EEF
SHA-256:	AABC88A6DB8B22022F96CA88E4F0A7BE426ABEF2B35169A71515A2D55246402A
SHA-512:	B037A19B52C1047198EC7F19E99066054E454964380E2354239834260D11248E617D6759B944DDF39A25B883C8F430603D8E13097396E2DEDA9BB6905C1CD42A
Malicious:	false
Reputation:	low
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0,enforced:!1};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.uetConfig.cusig={hasLoaded:!1,timeoutId:null,blob:{}};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (527)
Category:	dropped
Size (bytes):	11156
Entropy (8bit):	5.099068978602794
Encrypted:	false
SSDEEP:	192:Vn17H/nttPian1lDgU9cjhcAZJqtniMj+8qVk3m8Moj+0Wknu6rouE:r7VtblkhvZJXM6hVEmlMWZ68uE
MD5:	2838622562EA0DFB9F92CC6B6DD0CF0C
SHA1:	FFEAF3B0AFB5F8DA83F643121FCB09054F2E4D33
SHA-256:	6FC5C3F9269C3777EC783AF059224740282FAFB4F415B61FA45CA940EE7EB529
SHA-512:	996947C3EBCF1965C7162BDE0F75A84A8B01751A1F022CD3F56DD9287E6A10CD54FE036F625FCD98508008ED23B2BC6CE8A8B1B9E9438FBC48B514247A24CF1B
Malicious:	false
Reputation:	low
Preview:	Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return window.location.search.replace("?","\x26").split("\x26gclsrc\x3d").pop().split("\x26").shift()},transform:function(val){return val?val:""},load:"instance",trigger:Bootstrapper.data.immediateTrigger,dataDefName:"GA4 - Page - Params - gclsrc",collection:"GA4 - Page - Params",.source:"Manage",priv:"false"},{id:"64943"})},64943)},-1,-1);.Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return document.referrer},transform:function(val){return val?val:""},load:"instance",trigger:Bootstrapper.data.immediateTrigger,dataDefName:"GA4 - Referrer - URL",collection:"GA4 - Referrer",source:"Manage",priv:"fa

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	28028
Entropy (8bit):	4.328610230367691
Encrypted:	false
SSDEEP:	384:CDKV5jcMbUzy2n/kG+pWz+z03WCNzcmwMgmvOihOu9v3MVst9egQ2U1DM:yYPS4I39Nz78u9v3Cs9fQ/u
MD5:	71D1CE5E1F81CE4568AC1E889D62FF60
SHA1:	0A1F7DC489DD6FE3766124D21BD61E1045037C11
SHA-256:	6F7A9BFCE9CB32A6D959911B149ACB1BBA1E9125F679924A19A5DDDC5B0968BB
SHA-512:	C1965F05ABDC188EE3234E29713DADEEBB1A5C44844D00F5CF28113C30D0B5B7F499BCC97AC7701B8B6BA547F872FD840643945A64B965031E16B93847CF6663
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/imgs/verify-image.22309ab77b473b7f151e.svg
Preview:	<svg width="416" height="312" viewBox="0 0 416 312" fill="none" xmlns="http://www.w3.org/2000/svg">..<g clip-path="url(#clip0_1956_60878)">..<g clip-path="url(#clip1_1956_60878)">..<path d="M300.293 73.5566H357.375C361.769 73.5566 365.334 70.5397 365.334 66.8208V19.2925C365.334 15.5736 361.769 12.5566 357.375 12.5566H300.293C295.899 12.5566 292.334 15.5736 292.334 19.2925V66.8266C292.334 70.5455 295.899 73.5566 300.293 73.5566Z" fill="white"/>..<path d="M222.293 73.5566H279.375C283.769 73.5566 287.334 70.5397 287.334 66.8208V19.2925C287.334 15.5736 283.769 12.5566 279.375 12.5566H222.293C217.899 12.5566 214.334 15.5736 214.334 19.2925V66.8266C214.334 70.5455 217.899 73.5566 222.293 73.5566Z" fill="white"/>..<path d="M300.293 138.557H357.375C361.769 138.557 365.334 135.54 365.334 131.821V84.2925C365.334 80.5736 361.769 77.5566 357.375 77.5566H300.293C295.899 77.5566 292.334 80.5736 292.334 84.2925V131.827C292.334 135.546 295.899 138.557 300.293 138.557Z" fill="white"/>..<path d="M222.29

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (715)
Category:	downloaded
Size (bytes):	557225
Entropy (8bit):	5.682542013673887
Encrypted:	false
SSDEEP:	6144:OgpQyxlMBfak0xzcDYXR1iFPlXmN8gQxDtX5ZidRuUWWIlRoPlh5ZVgJP/pFUvR:Ogiy/MyxzPv+PlJ8dYUWllRqa0
MD5:	1D3C12EF7348978206413B2C985D0E37
SHA1:	4C8BF7428BA9FF2C3F9E54C05065604D5C4D6A4C
SHA-256:	5AB8F962752071D61B4C1613F2126EAD5A5969B0157509532CB1CC43D1C0486D
SHA-512:	0B544007426B2F5A7D5EA806CF2DC94E1D7C79DDD67D14E5D0D527CC367DD42BE0300D9AF32592D9BF59683183E7085C502C49D233ACB10F8AFB07A2B5463266
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2018 Google Inc. SPDX-License-Identifier: Apache-2.0./.var S=function(){return[function(I,w,X,a,c,C,V){if(I>>(((C=[44,"K",27],I)&C[0])==I&&b.call(this,w),1)>=11&&(I^78)<C[2])if(typeof X.dispose=="function")X.dispose();else for(a in X)X[a]=w;return((I^50)>>3==3&&(X[C[1]]=c?U[18](18,w,a,!0):a,X[C[1]]&&(X[C[1]]=X[C[1]].replace(/:$/,"")),V=X),I\|24)==I&&(V=X.firstElementChild!==void 0?X.firstElementChild:k[26](19,1,w,X.firstChild)),V},function(I,w,X,a,c,C,V,z,g,l,d,R,F,Y){return((((I-9&7)>=(Y=["S",4,70],Y[1])&&I-8<20&&!w.K&&(w.K=new Map,w[Y[0]]=0,w.H&&f[49](12,.1,null,0,"&",function(N,Z){w.add(decodeURI

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (51384), with no line terminators
Category:	downloaded
Size (bytes):	51385
Entropy (8bit):	5.293328685395304
Encrypted:	false
SSDEEP:	768:IaOFhhRC5JFhLjfRysgLzQynDw5YyDMFW8KQ:IaOFnR2DRszQKaoWtQ
MD5:	6626C1362840EBFC8F48294E8F023E18
SHA1:	4EC0DFB37C3E536C1B5EC04B68C9846FDBAF9EEF
SHA-256:	AABC88A6DB8B22022F96CA88E4F0A7BE426ABEF2B35169A71515A2D55246402A
SHA-512:	B037A19B52C1047198EC7F19E99066054E454964380E2354239834260D11248E617D6759B944DDF39A25B883C8F430603D8E13097396E2DEDA9BB6905C1CD42A
Malicious:	false
Reputation:	low
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0,enforced:!1};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.uetConfig.cusig={hasLoaded:!1,timeoutId:null,blob:{}};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520)
Category:	downloaded
Size (bytes):	1459
Entropy (8bit):	5.3439323669767065
Encrypted:	false
SSDEEP:	24:1cUq6XZXGle5pPBlEzjH7VRWZ/M5Fxv6gpCH61l+mV4SVo00VjQI2KAY6W8n:puCpP/EzjbVw1Wxv60o61lp44ejdAU8
MD5:	693E44CB920A49CD359C9B2A0205281F
SHA1:	FCD3786052B6BAF8AFBEDC240BEE6C70DEA6D3A5
SHA-256:	037AEE8B899729D810F4D25B755A1F59062C841462FF650FFDDE54FD1F9C5F93
SHA-512:	4817F376E563870B3345F376B15DADF84826115E9426256EEE339218041F5870B32EE5BF6481143C4630D58B75AB52AA6636FD32C5E927C41D0FF79390D71755
Malicious:	false
Reputation:	low
URL:	https://nexus.ensighten.com/symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js
Preview:	Bootstrapper.bindDOMParsed(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;window.crossDomains="us.norton.com,buy.norton.com,www.norton.com,";mboxFactoryDefault.addOnLoad(function(){var getMboxSessionID=function(){var s=(new Date).getTime()+"-"+Math.floor(Math.random()*999999);if(typeof mboxFactoryDefault=="object")return mboxFactoryDefault.getSessionId().getId();if(document.cookie.indexOf("mbox\x3d")>-1){var a=document.cookie.indexOf("\|session#")>.-1?document.cookie.split("\|session#")[1]\|\|"":"";a=a!=""?a.split("#")[0]:"";if(a!=""&&a.length>0&&a.length<30&&a.indexOf("-")!=-1)return a;else return s}else return s},a=function(tag){var tags=window.document.getElementsByTagName(tag);for(var i=0;i<tags.length;i++){var t=tag=="form"?tags[i].action\|\|"":tags[i].href\|\|"";if(t!=""&&t.indexOf("://")>-1){var td=t.split("://")[1].split("/")[0];if(t.indexOf("avascript")==-1&&t.indexOf("mboxSession\x3d")==-1&&t.indexOf(location.hostname)==-1&&windo

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32764)
Category:	downloaded
Size (bytes):	188091
Entropy (8bit):	5.364603486008455
Encrypted:	false
SSDEEP:	3072:qunipShhNVZud6NYzUZkiPj07OU/LDsnb:qunipShVZudcYzUZN071/+
MD5:	8C370AB1ABE10490ACA72C000FC8B322
SHA1:	ACBFD69BE4464F254B79DEC3395B5DA454986A42
SHA-256:	765BCC5C747A0E4C9BCE94F6132561E4D81CA391BE2BF5D8080C3C04A85CBA08
SHA-512:	01B1ADCBC464760BFBBE604F39EAF5E3048972C2C7BEF80888C468E28C8C3425D94192C6EA41C7540EB630192AA7BA9C564AF038FF155C7DDDE1CD8E38256803
Malicious:	false
Reputation:	low
URL:	https://assets.adobedtm.com/launch-EN1cc7556280444b10a3c687a73ed01baa.min.js
Preview:	// For license information, see `https://assets.adobedtm.com/launch-EN1cc7556280444b10a3c687a73ed01baa.js`..window._satellite=window._satellite\|\|{},window._satellite.container={buildInfo:{minified:!0,buildDate:"2024-04-09T22:13:06Z",turbineBuildDate:"2023-02-22T20:37:26Z",turbineVersion:"27.5.0"},environment:{id:"EN1cc7556280444b10a3c687a73ed01baa",stage:"production"},dataElements:{"Traffic Source":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.traffic_source"}},TCG:{defaultValue:"",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.Test_Group"}},"Site Language":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalytics.site_language"}},"Page Name":{defaultValue:"",storageDuration:"pageview",modulePath:"core/src/lib/dataElements/javascriptVariable.js",settings:{path:"nortonAnalyt

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20467), with CRLF line terminators
Category:	downloaded
Size (bytes):	21482
Entropy (8bit):	5.004386923331283
Encrypted:	false
SSDEEP:	192:yNuVXqX6l0u9XQgwXXFN088IF9Zxfg5HXB:kC6X9mI1acjyR
MD5:	9613A705E99A8B4FF94D62E73C045CAB
SHA1:	B7A7E4DAEF4CE8226D85A2BD6ACCC717A4BF36E7
SHA-256:	FA99D528B20ABBC2E0A2AB207E898E88CCAA899740C68C214F09C2BDDF87731F
SHA-512:	D80D9309788F901168149741582C22E030F6A8099BF61B85176E168D2CFCEB22402BC8BCECE90A0F1623AAF48B76027CDC848726139F6AC981E8C3C1FDEF9E04
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/nmp-ui-style.css
Preview:	a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}:focus{outline:0}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}table{border-collapse:collapse;border-spacing:0}../!.. Bootstrap Grid v4.0.0 (https://getbootstrap.com).. * Copyright 2011-2018 The Bootstrap Authors.. * Copyright 2011-2018 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/mast

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	122311
Entropy (8bit):	5.361527639314529
Encrypted:	false
SSDEEP:	1536:X9WYgy17/xrPw99+8zgd01Wq+Timxfk2awjYuI1t0TwX/LimVF:Xz7/xrPCFF5mxfk2VYuaX9
MD5:	FEDFDE3AE8DE64009FAC92B702BB7A4F
SHA1:	89EAF9D5349C50A530E11C73318136EBD5960DDC
SHA-256:	6D86FA54F7C9D8B51F2F058836AF20178C38447D1B7BA81C358A7847D60BE1A7
SHA-512:	7D6DFB8F9DFB82D7B8AA53536AA65F1C1D1AE2BC494EAC2060782004A67CB6D4228E18EBEA86B245F448971260CB1D4BF1B8114764503325928D6630460683B9
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/polyfills.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[3],{"+auO":function(t,e,n){var r=n("XKFU"),o=n("lvtm");r(r.S,"Math",{cbrt:function(t){return o(t=+t)*Math.pow(Math.abs(t),1/3)}})},"+lvF":function(t,e,n){t.exports=n("VTer")("native-function-to-string",Function.toString)},"+oPb":function(t,e,n){"use strict";n("OGtf")("blink",function(t){return function(){return t(this,"blink","","")}})},"+rLv":function(t,e,n){var r=n("dyZX").document;t.exports=r&&r.documentElement},"/KAi":function(t,e,n){var r=n("XKFU"),o=n("dyZX").isFinite;r(r.S,"Number",{isFinite:function(t){return"number"==typeof t&&o(t)}})},"/SS/":function(t,e,n){var r=n("XKFU");r(r.S,"Object",{setPrototypeOf:n("i5dc").set})},"/e88":function(t,e){t.exports="\t\n\v\f\r \xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029\ufeff"},"0/R4":function(t,e){t.exports=function(t){return"object"==typeof t?null!==t:"function"==typeof t}},"0E+W":function(t,e,n){n("elZq")("Array")},"0

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	847149
Entropy (8bit):	5.3686539146947725
Encrypted:	false
SSDEEP:	12288:bqq/M4gKKwGPvVdkb1lgpCPuJZGKhGTNhwOPA7:bqiMBKwvVdkb1l8GTNhjA7
MD5:	105C987B812E43F3437D145C4C06120B
SHA1:	060551C9024628CAF4CE01FA28BB8A8F3F540FDB
SHA-256:	408F7272E063EB36014973B8BED5385ACCEE0514270362141B5CF840A6C3C827
SHA-512:	79C88E1ECC0EA3087A84FE62518A827990A1468EC0DD14B2EC4271DBE81DFA9AFCD7F812FB9777D7A218490C11795FB45C11DEC096B77D2B59A436EF301DC957
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/nmpcdn/static/nmp2024.3.20.989/dist/llonboard/norton/main.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+u5z":function(e,t,n){var r,i,o;i=[n("qZCD")],void 0===(o="function"==typeof(r=function(e){var t=e.dependencyLib,n={d:["[1-9]\|[12][0-9]\|3[01]",Date.prototype.setDate,"day",Date.prototype.getDate],dd:["0[1-9]\|[12][0-9]\|3[01]",Date.prototype.setDate,"day",function(){return a(Date.prototype.getDate.call(this),2)}],ddd:[""],dddd:[""],m:["[1-9]\|1[012]",Date.prototype.setMonth,"month",function(){return Date.prototype.getMonth.call(this)+1}],mm:["0[1-9]\|1[012]",Date.prototype.setMonth,"month",function(){return a(Date.prototype.getMonth.call(this)+1,2)}],mmm:[""],mmmm:[""],yy:["[0-9]{2}",Date.prototype.setFullYear,"year",function(){return a(Date.prototype.getFullYear.call(this),2)}],yyyy:["[0-9]{4}",Date.prototype.setFullYear,"year",function(){return a(Date.prototype.getFullYear.call(this),4)}],h:["[1-9]\|1[0-2]",Date.prototype.setHours,"hours",Date.prototype.getHours],hh:["0[1-9]\|1[0-2]",Date.prototype.setHours,"hours",function(){return

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (62896)
Category:	dropped
Size (bytes):	62957
Entropy (8bit):	5.275287439830501
Encrypted:	false
SSDEEP:	768:EwgeKv8dLdVid8fRyuXtJ9g/k8CRyQmN96R5ESR3Z+gW1/85hhsRA/GfuCEjb:xldLPRfYuXtJ9g/kJ7R3YgN9
MD5:	63D17CCAA3F994B3C69C63430571E0E0
SHA1:	75A6C4CB1013AE10604800142DE52472DF739628
SHA-256:	6025F4EC0125F84D3D79527CE2286E2988AF546F55A174DB5DB3EEC14EB7C37D
SHA-512:	238A77BF02BF4DC8FCA2FE044AA2EB8A40783DCC33EA10F1EBB5EC3C0898BC815C22E79A39C9137E75A27EDD50059772DD64321946B36309ADB65694AA0291DC
Malicious:	false
Reputation:	low
Preview:	/! For license information please see app.js.LICENSE.txt /.(()=>{var e,t,r={188:(e,t,r)=>{"use strict";function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,o)}return r}function n(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?o(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):o(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function i(e,t,r){return(t=function(e){var t=function(e,t){if("object"!=typeof e\|\|null===e)return e;var r=e[Symbol.toPrimitive];if(void 0!==r){var o=r.call(e,t\|\|"default");if("object"!=typeof o)return o;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string"

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 227180, version 1.0
Category:	downloaded
Size (bytes):	227180
Entropy (8bit):	7.998672302796162
Encrypted:	true
SSDEEP:	6144:ontlH0kriqsEimx44eY23pmX54q880Ocp3AjD11gyHD:GtFriqsu4XP5G9nSFAjxXD
MD5:	66C6E40883646A7AD993108B2CE2DA32
SHA1:	7A2602D2EBB08CE895E33ADDB6FE595F1029431E
SHA-256:	17FE38AB302C7E5DBFB5C3D87801092D79BE958500DB6412ED3BC0F126BD53D3
SHA-512:	8A166F9044346CCE8CA92B00F5DAC0DE6D0FF64AB72FBF390A268049FFFB72BE2BDA1397AE0EE97E37CF33E3C309CC630A638AB9151F944D8D05AD652D6CF261
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/fonts/Inter-roman.var.woff2
Preview:	wOF2......wl......84..v...............................D...J?HVAR.i.`?STAT....../l...$..Z..T.0..z.6.$..N. ......-[...el...........LM..>.......\..........A{.u:.,a.P4./$....Y.f.h.+..e. ..............p..[o&...4M..)-..B[.r.. .........a..l($4Q.S..aE<...eC.a))..Y.ZC..h.6.\Q.b%z!Tm.w....Y.z.......".Y..Y#....Z.K.B.I....D5.eJ....gde....~\+C.B#Jk...X.......;j.....U....vUY4l.v...4'.......PY.kH.5.:..u..b...9.BT.Z[!..Q....M..2...E.F..P.fc%....VD/..H!..Z...#.)...0..rzv.qpv..c...f....tH\|I.....ZX.@cu}.....I.f.}c....`.-...k.h.V...i.Ma...R.x.p.{....D.4...b.]...b...."........)....N=$..8.y.2...d.........!K.}$!..x..[..d[..(.Rj.!.Zi.1ZqZx%d&UA..e.....x...i.7E[....+.J....0.+3U.....z...4.Y..a..2W....S..!D.\|QtZ..;_..{....U!..8T.I.....:F..dV.%..dP..1..!r..1"...:..[.1..(.O.jBV..D.A..KB.....].v.u\|.;...^..sz...,y......d..A3+..?......F..=.IwSO...9.eD..-j"cR....0H`..%R........(....~o:.%.. ..h.\...$iw..7.&..1^1....;..X......rR.G...k.a.Z......x......\|.':> ....._...l

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	847149
Entropy (8bit):	5.3686539146947725
Encrypted:	false
SSDEEP:	12288:bqq/M4gKKwGPvVdkb1lgpCPuJZGKhGTNhwOPA7:bqiMBKwvVdkb1l8GTNhjA7
MD5:	105C987B812E43F3437D145C4C06120B
SHA1:	060551C9024628CAF4CE01FA28BB8A8F3F540FDB
SHA-256:	408F7272E063EB36014973B8BED5385ACCEE0514270362141B5CF840A6C3C827
SHA-512:	79C88E1ECC0EA3087A84FE62518A827990A1468EC0DD14B2EC4271DBE81DFA9AFCD7F812FB9777D7A218490C11795FB45C11DEC096B77D2B59A436EF301DC957
Malicious:	false
Reputation:	low
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[1],{"+u5z":function(e,t,n){var r,i,o;i=[n("qZCD")],void 0===(o="function"==typeof(r=function(e){var t=e.dependencyLib,n={d:["[1-9]\|[12][0-9]\|3[01]",Date.prototype.setDate,"day",Date.prototype.getDate],dd:["0[1-9]\|[12][0-9]\|3[01]",Date.prototype.setDate,"day",function(){return a(Date.prototype.getDate.call(this),2)}],ddd:[""],dddd:[""],m:["[1-9]\|1[012]",Date.prototype.setMonth,"month",function(){return Date.prototype.getMonth.call(this)+1}],mm:["0[1-9]\|1[012]",Date.prototype.setMonth,"month",function(){return a(Date.prototype.getMonth.call(this)+1,2)}],mmm:[""],mmmm:[""],yy:["[0-9]{2}",Date.prototype.setFullYear,"year",function(){return a(Date.prototype.getFullYear.call(this),2)}],yyyy:["[0-9]{4}",Date.prototype.setFullYear,"year",function(){return a(Date.prototype.getFullYear.call(this),4)}],h:["[1-9]\|1[0-2]",Date.prototype.setHours,"hours",Date.prototype.getHours],hh:["0[1-9]\|1[0-2]",Date.prototype.setHours,"hours",function(){return

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10139)
Category:	downloaded
Size (bytes):	11765
Entropy (8bit):	5.197257369127996
Encrypted:	false
SSDEEP:	192:AbVvdDKPOSfflSuYTbcie/1XHq8UqqZpqijKWIpVk:yEWcflSuYTbciqxqxrqqKW0C
MD5:	42750DF7BDD32AA34C65B67B6F55C15E
SHA1:	B063923A5E425469D6878B4A11F58196A630C50F
SHA-256:	F5EB40674C362404C76DBB4A4A26FE0205CDA04093EC29018D18C87AEB5DDC70
SHA-512:	F6FAE88E2CEEA41E06B293E0CB53B2C976781F9CB130B81AD85908E5AB8AEA99FA6CB8BE30A4DBB2CEA0BAC2CEC81871C216456A7BE2E866376242B8CE4EFC04
Malicious:	false
Reputation:	low
URL:	https://static.nortoncdn.com/static/ngpcdn/static/ngp2024.3.20.196/dist/norton/app.css
Preview:	@font-face{font-named-instance:"Regular";font-display:fallback;font-family:Inter;font-stretch:normal;font-style:normal;font-weight:100 900;src:url(fonts/Inter-roman.var.woff2) format("woff2")}@font-face{font-named-instance:"Italic";font-display:fallback;font-family:Inter;font-stretch:normal;font-style:italic;font-weight:100 900;src:url(fonts/Inter-italic.var.woff2) format("woff2")}a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{border:0;font-size:100%;font:inherit;margin:0;padding:0;vertical-align:initial}:focus{outline:0}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28111
Entropy (8bit):	4.010653211084802
Encrypted:	false
SSDEEP:	384:eEbTGvX4Q+DQ1PJvsWudgFa8iHU1gBpdg9dkklXsHRcKCRIo4OI/EAAhYt1cSYnz:dfgXks1JhG+gB3g97xEcK1XxYz
MD5:	7ACEDE7F75DA890B8BB3E6754BC9FB73
SHA1:	DDF3443F64A475D4B8FF5D6AD418ADC2581FF6EB
SHA-256:	35887C3D3787A7AE6B47F346AC95305B59143275ECDA228715A87F8752EA945C
SHA-512:	B3D5F0F8715E366D273B62B810168DE8A0052FB739019A1FFE8CCA39A54473FC638F88A8DC8C595DD42E0B98E13A55043FEFDCC7E0F9F6C77F15501BB366C80B
Malicious:	false
Reputation:	low
Preview:	<svg width="264" height="144" viewBox="0 0 264 144" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M86.397 51.84C71.6373 75.2118 95.8675 106.842 125.179 125.353C139.678 134.509 155.884 137.954 170.83 136.556C219.677 131.987 236.389 77.6548 194.703 51.3299C165.392 32.8193 101.157 28.4682 86.397 51.84Z" fill="white"/>..<path d="M186.899 88.5425C182.956 96.2464 179.137 106.095 176.352 113.276C173.674 120.182 185.052 127.36 191.745 130.83C191.745 130.83 201.968 127.055 210.534 115.011C216.338 106.851 217.864 98.7105 218.256 94.533C212.271 91.4794 205.81 89.4046 199.784 86.29C193.813 83.204 187.775 86.8262 186.899 88.5425Z" fill="#FEEB29"/>..<path d="M134.066 90.3316C133.995 89.846 135.119 89.2349 135.111 88.2016C138.896 88.5842 147.962 91.6405 151.742 92.9298C155.522 94.2192 156.947 99.6519 157.187 102.207C153.545 102.739 143.576 101.861 142.003 100.994C140.431 100.126 134.154 90.9387 134.066 90.3316Z" fill="#E3B9A1"/>..<path fill-rule="evenodd" clip-rule="evenodd" d="M133.763 8

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (579)
Category:	dropped
Size (bytes):	68344
Entropy (8bit):	5.349217670747394
Encrypted:	false
SSDEEP:	1536:x5TGO7Gk+o1egm8sRIuiClrcsX5QrF0hVHOQdbnoejMxg:B0kegm8KHGsHp
MD5:	3DEF7D8F54C898338EBA38E2520C1731
SHA1:	2ED66F9167FD795C56F584532FC5E4AEEED5E2BC
SHA-256:	84F3D9F8505420CAD451290F392B2C14EC6AEDE0820F509C84B1B3BA7BFB9B78
SHA-512:	D444ED609FF9BE5FEB93A9B595A904CA48534F7D44F7A38A8F9B409ED10088EFA00BBB13ECDFE0B435A88D020BEE2CDB52DE1113A0ABFFAF2A2BF3B662356327
Malicious:	false
Reputation:	low
Preview:	(function ensightenInit(){var ensightenOptions = {client: "symantec", clientId: 21, publishPath: "cp1", isPublic:0, serverComponentLocation: "nexus.ensighten.com/symantec/cp1/serverComponent.php", staticJavascriptPath: "nexus.ensighten.com/symantec/cp1/code/", ns: 'Bootstrapper', nexus:"nexus.ensighten.com", scUseCacheBuster: "true", enableTagAuditBeacon : "true", enablePagePerfBeacon : "true", registryNs : "ensBootstraps", generatedOn : "Mon Jul 03 16:37:09 GMT 2023", beaconSamplingSeedValue: 11};.if ( !window[ensightenOptions.ns] ) {.window[ensightenOptions.registryNs]\|\|(window[ensightenOptions.registryNs]={});.window[ensightenOptions.registryNs][ensightenOptions.ns]=window[ensightenOptions.ns]=function(l){function m(a){this.name="DependencyNotAvailableException";this.message="Dependency with id "+a+"is missing"}function n(a){this.name="BeaconException";this.message="There was an error durring beacon initialization";a=a\|\|{};this.lineNumber=a.lineNumber\|\|a.line;this.fileName=a.fileNam

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (579)
Category:	downloaded
Size (bytes):	68344
Entropy (8bit):	5.349217670747394
Encrypted:	false
SSDEEP:	1536:x5TGO7Gk+o1egm8sRIuiClrcsX5QrF0hVHOQdbnoejMxg:B0kegm8KHGsHp
MD5:	3DEF7D8F54C898338EBA38E2520C1731
SHA1:	2ED66F9167FD795C56F584532FC5E4AEEED5E2BC
SHA-256:	84F3D9F8505420CAD451290F392B2C14EC6AEDE0820F509C84B1B3BA7BFB9B78
SHA-512:	D444ED609FF9BE5FEB93A9B595A904CA48534F7D44F7A38A8F9B409ED10088EFA00BBB13ECDFE0B435A88D020BEE2CDB52DE1113A0ABFFAF2A2BF3B662356327
Malicious:	false
Reputation:	low
URL:	https://nexus.ensighten.com/symantec/cp1/Bootstrap.js
Preview:	(function ensightenInit(){var ensightenOptions = {client: "symantec", clientId: 21, publishPath: "cp1", isPublic:0, serverComponentLocation: "nexus.ensighten.com/symantec/cp1/serverComponent.php", staticJavascriptPath: "nexus.ensighten.com/symantec/cp1/code/", ns: 'Bootstrapper', nexus:"nexus.ensighten.com", scUseCacheBuster: "true", enableTagAuditBeacon : "true", enablePagePerfBeacon : "true", registryNs : "ensBootstraps", generatedOn : "Mon Jul 03 16:37:09 GMT 2023", beaconSamplingSeedValue: 11};.if ( !window[ensightenOptions.ns] ) {.window[ensightenOptions.registryNs]\|\|(window[ensightenOptions.registryNs]={});.window[ensightenOptions.registryNs][ensightenOptions.ns]=window[ensightenOptions.ns]=function(l){function m(a){this.name="DependencyNotAvailableException";this.message="Dependency with id "+a+"is missing"}function n(a){this.name="BeaconException";this.message="There was an error durring beacon initialization";a=a\|\|{};this.lineNumber=a.lineNumber\|\|a.line;this.fileName=a.fileNam

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32054)
Category:	dropped
Size (bytes):	82737
Entropy (8bit):	5.417054529586679
Encrypted:	false
SSDEEP:	1536:CZVMbRJN4CoVUTM2ua1OM7CfzGQxmZQx5UG/Lo+oqbH:CaJMYOMuSZQBLDr
MD5:	6CDA8B6271B502ED1174336D6537D44B
SHA1:	7A5D5256CED6EA8B8C4B88CB08A7EF0CCB13FE62
SHA-256:	7CA9E9328C72EAF9F7CB3E12648AD05411A6140291B284D4785E65BB02FB290B
SHA-512:	7B54A019BAAF08183FA482C73498195B8137C1342818AC57D2DFB4C851C76198FF730125329231CD85BD480DBA3DCD75883E160DBD92169B98F1032E59AB9043
Malicious:	false
Reputation:	low
Preview:	/! Norton - v1.0.2 - 2024-10-07 /function s_doPlugins(a){try{_numeric_.utils.strangeTrafficExclude();var b=localStorage.getItem("strangeTrafficExclude");b&&(a.abort=!0)}catch(c){}var d=a.linkURL;if(void 0!==typeof a.linkType&&"d"==a.linkType&&"string"==typeof d){a.pageName&&a.pageName.match(/avira:(.):downloads:free-products/gi)&&d.match(/(avira_)(._)(sptl1_)(.)(__.\.exe)/gi)&&(a.linkURL=d=d.replace(/(avira_)(._)(sptl1_)(.)(__.*\.exe)/gi,"$1$2$3$5")),a.events="event1";var e=d.split("/"),f=e[e.length-1],g=f.substr(f.lastIndexOf(".")+1).toLowerCase();a.eVar1="D=c33",a.prop33=d,a.prop46=g,a.prop47="download",a.prop48=f,a.eVar49="D=c48",a.linkTrackVars="events,prop2,prop33,prop41,prop46,prop47,prop48,prop49,prop59,eVar1,eVar18,eVar27,eVar41,eVar48,eVar49,eVar59",a.linkTrackEvents="event1"}else void 0!==typeof a.linkType&&"e"==a.linkType&&(a.linkTrackVars="None",a.linkTrackEvents="None");a.eVar47="s_code_norton "+s_code_file_modified_date,a.prop21=a.getQueryParam("inid"),!a.prop21&&

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1497), with no line terminators
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	5.754030298959625
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAjZJlj+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtQ1vS1Zc:VKEciyKo7LmvtUjPKtX7+1vQZ/rLrwUG
MD5:	6672483D641E341A4E17D72C0A892F95
SHA1:	0B2257AC38E830708B472F3A0607F4C9BC747658
SHA-256:	CDA8FED4FA8356CEC4E8FE1E0E0858395C2A5BAA23C645023A9CE78033787E21
SHA-512:	1E552DC881AE0775F8810403AAC22A75FE0F23C8BB46BAA8F9A90E3A38AC7E9232A068AB6272D60E917B6964295E1AEE090EAC3FB8CA87C9784337AAE7621CCE
Malicious:	false
Reputation:	low
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('explicit');(cfg['onload']=cfg['onload']\|\|[]).push('ng2recaptchaloaded');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 12:31:56.855611086 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.855611086 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.856566906 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.856853008 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.857933044 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.860959053 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.861304998 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.861891985 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.862222910 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.863346100 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.944745064 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 24, 2024 12:31:56.991620064 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.992189884 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.992202044 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.992444038 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.992476940 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.992568016 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.993099928 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.993716002 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:56.993791103 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.997715950 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.997715950 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.999118090 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:56.999118090 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.000442982 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.003410101 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.003463030 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.004384041 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.004484892 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.005877018 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.133177996 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.133193016 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.133215904 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.133333921 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.133779049 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.133796930 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.134010077 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.134131908 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.134213924 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.134330988 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.135298967 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.135310888 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.135382891 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.135420084 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.135435104 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.138374090 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.138374090 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.139125109 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.139502048 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.139745951 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.143851995 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.144423008 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.144776106 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.145183086 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.274295092 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.274317026 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.274389029 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.274446011 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.275089025 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.275250912 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.275713921 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.275826931 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.275886059 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.280749083 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.281100035 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.282023907 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.283081055 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.286047935 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.286403894 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.287295103 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.288376093 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.416419983 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.416433096 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.416554928 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.416801929 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.417130947 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.417454004 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.418221951 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:31:57.460410118 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:31:57.866611004 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 24, 2024 12:31:58.116628885 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 24, 2024 12:32:04.984324932 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 24, 2024 12:32:07.471344948 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 24, 2024 12:32:07.498339891 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:07.498349905 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:07.498420954 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:07.500407934 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:07.500423908 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:07.643569946 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 24, 2024 12:32:07.797802925 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 24, 2024 12:32:08.368951082 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.369267941 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.369280100 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.371017933 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.371181965 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.372044086 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.372132063 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.372293949 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.415378094 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.422485113 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.422494888 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.469448090 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.618427992 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.668461084 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.739574909 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739592075 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739614010 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739628077 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739638090 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739767075 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.739768028 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.739787102 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.739799976 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.740459919 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.859611988 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.859626055 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.859647989 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.859658003 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.859677076 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.859704018 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.859729052 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.859739065 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.919517040 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:08.919560909 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:08.919622898 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:08.919931889 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:08.919949055 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:08.979752064 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.979775906 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.979856014 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:08.979865074 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:08.979902029 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.099539042 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.099608898 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.099615097 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.099663019 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.099677086 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.102885962 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.102948904 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.102956057 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.102967978 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.102988958 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.103013039 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.103261948 CEST	49721	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:09.103275061 CEST	443	49721	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:09.118211985 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.118232965 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.118298054 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.118551970 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.118561983 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.562279940 CEST	443	49704	23.206.229.226	192.168.2.8
Oct 24, 2024 12:32:09.562630892 CEST	49704	443	192.168.2.8	23.206.229.226
Oct 24, 2024 12:32:09.668766975 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:09.668790102 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:09.668901920 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:09.671053886 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:09.671062946 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:09.768058062 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:09.768529892 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:09.768548012 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:09.769956112 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:09.770015001 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:09.771677017 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:09.771755934 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:09.813119888 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:09.813127995 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:09.821064949 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:09.821096897 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:09.821229935 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:09.821420908 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:09.821440935 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:09.858105898 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:09.967706919 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.967947960 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.967969894 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.969415903 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.969490051 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.969872952 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.969949007 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:09.970283031 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:09.970290899 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.015821934 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.217025995 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.266542912 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.336029053 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336045027 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336064100 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336078882 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336085081 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.336090088 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336112022 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336165905 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.336172104 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.336253881 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.454734087 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.454750061 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.454775095 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.454814911 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.454827070 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.454874039 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.454874039 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.457498074 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.457596064 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.530133963 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.530213118 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.539264917 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.539273024 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.539599895 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.575956106 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.575984955 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.576020002 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.576024055 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.576056004 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.576081991 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.579137087 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.590863943 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.631320953 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.676413059 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.676758051 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.676774025 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.677783966 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.677850962 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.682296038 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.682358980 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.682756901 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.682766914 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.694334030 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.694372892 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.694407940 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.694413900 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.694436073 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.694468021 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.694472075 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.694483042 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.694547892 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.694694996 CEST	49727	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:10.694706917 CEST	443	49727	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:10.735220909 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.836219072 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.836402893 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.836412907 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.836529970 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.836998940 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.837089062 CEST	443	49729	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.837132931 CEST	49729	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.896686077 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.896719933 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.896794081 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.897169113 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:10.897193909 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:10.929534912 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.929596901 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.929856062 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.930502892 CEST	49731	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:10.930521965 CEST	443	49731	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:10.942209959 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:10.942235947 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:10.942409992 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:10.945987940 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:10.946007013 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:10.969095945 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:10.969113111 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:10.969261885 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:10.969449043 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:10.969469070 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:10.971976995 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:10.971988916 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:10.972045898 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:10.972441912 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:10.972453117 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:10.981065989 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:10.981074095 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:10.981209993 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:10.981389046 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:10.981399059 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.742429972 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.742531061 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.743721008 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.743741035 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.744227886 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.745443106 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.787218094 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:11.787333012 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.787564993 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:11.787575006 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:11.787859917 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:11.788249969 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:11.788300991 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:11.788312912 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:11.801335096 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:11.801575899 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.801584005 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:11.802448034 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:11.802510023 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.803515911 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.803580999 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:11.803663969 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.811721087 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.812773943 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.812781096 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.814404011 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.814496040 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.815458059 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.815541029 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.815617085 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.815632105 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.817239046 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.817539930 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:11.817553997 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.818425894 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.818483114 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:11.818768024 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:11.818818092 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.818896055 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:11.818903923 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:11.828270912 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:11.828279972 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:11.843663931 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.843672991 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:11.858769894 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.858779907 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:11.861584902 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:11.889965057 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:11.905364990 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:11.986479998 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.986651897 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.986836910 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.987327099 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.987374067 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:11.987409115 CEST	49733	443	192.168.2.8	184.28.90.27
Oct 24, 2024 12:32:11.987426043 CEST	443	49733	184.28.90.27	192.168.2.8
Oct 24, 2024 12:32:12.043768883 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.043824911 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.043864012 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.044459105 CEST	49734	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.044471025 CEST	443	49734	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.048125029 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:12.048150063 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:12.048156977 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:12.048204899 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:12.048228979 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:12.048265934 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:12.048569918 CEST	49737	443	192.168.2.8	52.17.240.122
Oct 24, 2024 12:32:12.048577070 CEST	443	49737	52.17.240.122	192.168.2.8
Oct 24, 2024 12:32:12.060210943 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.060281992 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.060364962 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.060548067 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.060585022 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.070540905 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:12.070595026 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:12.070718050 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:12.070755005 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.070813894 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.070949078 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.070950031 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.071118116 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.071770906 CEST	49738	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:12.071775913 CEST	443	49738	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:12.072388887 CEST	49735	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.072398901 CEST	443	49735	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.085181952 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.085196018 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.085274935 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.085448980 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.085464001 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.085918903 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.085935116 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.085984945 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.086220026 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.086231947 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.163300037 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.163319111 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.163377047 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.163618088 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:12.163624048 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:12.907085896 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.907591105 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.907655001 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.908771038 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.909622908 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.909760952 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.909775972 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.909809113 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:12.931452036 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.931698084 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.931706905 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.931926012 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.932185888 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.932231903 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.932892084 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.933228016 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.933481932 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.933547020 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.933886051 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.933986902 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.934089899 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.934140921 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:12.952409983 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:12.975337982 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:12.975347996 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.002451897 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.002733946 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.002744913 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.004201889 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.004261971 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.004637003 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.004714012 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.004822969 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.004849911 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.044986010 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.044994116 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.091810942 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.160830975 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.160912991 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.162167072 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.162302017 CEST	49739	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.162318945 CEST	443	49739	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.180716991 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.180839062 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.180970907 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.181060076 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.181583881 CEST	49741	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.181602955 CEST	443	49741	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.185599089 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.185626030 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.185698986 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.185930014 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.185941935 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.187860966 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.187896013 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.188203096 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.188386917 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.188405037 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.258198023 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.258291960 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.258398056 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.259715080 CEST	49744	443	192.168.2.8	66.235.152.225
Oct 24, 2024 12:32:13.259722948 CEST	443	49744	66.235.152.225	192.168.2.8
Oct 24, 2024 12:32:13.401087999 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:13.401108027 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:13.401170015 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:13.401998043 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:13.402005911 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:13.581429005 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.588119984 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.588200092 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.588202000 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.588242054 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.588260889 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.590774059 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.590840101 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.604918957 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.604935884 CEST	443	49742	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:13.604954958 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.604976892 CEST	49742	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:13.617249966 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.617288113 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:13.617404938 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.617575884 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:13.617590904 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.025119066 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.028527021 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.028543949 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.028841019 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.029649973 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.029702902 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.030246973 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.038209915 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.038625002 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.038644075 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.039020061 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.039760113 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.039834976 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.039973021 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.071355104 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.087332964 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.246452093 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.246797085 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:14.246829987 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.247329950 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.247838974 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:14.247925043 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.248285055 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:14.273457050 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.273647070 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.273694038 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.274267912 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.274285078 CEST	443	49749	65.9.66.72	192.168.2.8
Oct 24, 2024 12:32:14.274296045 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.274333954 CEST	49749	443	192.168.2.8	65.9.66.72
Oct 24, 2024 12:32:14.288201094 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.288379908 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.288429976 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.288461924 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.288526058 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.288575888 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.289612055 CEST	49750	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.289625883 CEST	443	49750	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.295329094 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.477454901 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.477807999 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.477819920 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.478935957 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.479537010 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.479710102 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.480022907 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.497606039 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.497719049 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.497766972 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:14.510132074 CEST	49751	443	192.168.2.8	52.214.221.135
Oct 24, 2024 12:32:14.510152102 CEST	443	49751	52.214.221.135	192.168.2.8
Oct 24, 2024 12:32:14.527327061 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.553219080 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:14.553248882 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:14.553303957 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:14.554100037 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:14.554112911 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:14.740787029 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.740859032 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.740907907 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.740933895 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.740943909 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.740961075 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.741023064 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:14.741137028 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.742676020 CEST	49752	443	192.168.2.8	65.9.66.103
Oct 24, 2024 12:32:14.742690086 CEST	443	49752	65.9.66.103	192.168.2.8
Oct 24, 2024 12:32:15.382862091 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.430627108 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.544294119 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.544303894 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.545387983 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.551172972 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.551285982 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.554233074 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.595335960 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.604446888 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:15.604466915 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:15.604593039 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:15.605354071 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:15.605372906 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:15.609865904 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:15.609884977 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:15.609946966 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:15.610280991 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:15.610292912 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:15.796334028 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.796469927 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:15.796530008 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.817625999 CEST	49756	443	192.168.2.8	52.208.241.210
Oct 24, 2024 12:32:15.817652941 CEST	443	49756	52.208.241.210	192.168.2.8
Oct 24, 2024 12:32:16.442148924 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.442512989 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.442522049 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.443934917 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.444001913 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.445914984 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.446176052 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.446711063 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.446718931 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.449736118 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.450016975 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.450032949 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.453450918 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.453520060 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.453968048 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.453968048 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.453974962 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.454077005 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.499571085 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.499806881 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.499814034 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.546446085 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.685174942 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.685348034 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.685399055 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.686405897 CEST	49761	443	192.168.2.8	63.140.62.222
Oct 24, 2024 12:32:16.686414957 CEST	443	49761	63.140.62.222	192.168.2.8
Oct 24, 2024 12:32:16.719145060 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.719208956 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.719322920 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.719331026 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.722745895 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:16.722795963 CEST	443	49760	142.250.186.36	192.168.2.8
Oct 24, 2024 12:32:16.722860098 CEST	49760	443	192.168.2.8	142.250.186.36
Oct 24, 2024 12:32:18.873003960 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:18.873028040 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:18.873087883 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:18.873261929 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:18.873275042 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:18.873925924 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:18.873980999 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:18.874042988 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:18.874334097 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:18.874366045 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.700026989 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.700288057 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.700339079 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.701442003 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.701508045 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.702511072 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.702609062 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.702711105 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.702744007 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.726874113 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.727106094 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.727130890 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.730777025 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.730844975 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.731215000 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.731441975 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.731538057 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.731544971 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.748994112 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.749022007 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.780221939 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.783643007 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:19.783833981 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:19.783900976 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:19.795881033 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.860418081 CEST	49725	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:32:19.860441923 CEST	443	49725	142.250.185.132	192.168.2.8
Oct 24, 2024 12:32:19.950474977 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.950557947 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.950644970 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.951075077 CEST	49772	443	192.168.2.8	63.140.62.17
Oct 24, 2024 12:32:19.951112032 CEST	443	49772	63.140.62.17	192.168.2.8
Oct 24, 2024 12:32:19.986581087 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.986646891 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.986711979 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.986721039 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.997708082 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:19.997765064 CEST	443	49771	142.250.186.164	192.168.2.8
Oct 24, 2024 12:32:19.997931957 CEST	49771	443	192.168.2.8	142.250.186.164
Oct 24, 2024 12:32:20.958993912 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:20.959005117 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:20.959053993 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:20.959450960 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:20.959466934 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.706933022 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.707334995 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.707402945 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.707849979 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.707916975 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.708551884 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.708615065 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.709914923 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.710028887 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.710171938 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.710190058 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.764683008 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.865602970 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.866445065 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.866453886 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.866487026 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.866641045 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.866641045 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.866724014 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.866800070 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.984585047 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.984679937 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.984963894 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.985028982 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.985060930 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.985122919 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.987075090 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:21.987138987 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:21.987154007 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.030412912 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.103396893 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103406906 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103584051 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103595018 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103600979 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.103646994 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103668928 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103672981 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.103718042 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.103728056 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.103780031 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.104197025 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.104260921 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.104306936 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.104476929 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.104507923 CEST	443	49779	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.104562998 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.104563951 CEST	49779	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.109606981 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.109656096 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.109723091 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.110011101 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.110028982 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.121016026 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.121059895 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.121112108 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.121371031 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.121387005 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.861682892 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.862004995 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.862023115 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.863261938 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.864012957 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.864093065 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:22.864197016 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.881304026 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.883846045 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.883862972 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.884363890 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.884418011 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.885365963 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.885417938 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.885683060 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.885762930 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.885842085 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:22.885848999 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:22.904861927 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:22.904881954 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.017504930 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.018208027 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.018265009 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:23.018454075 CEST	49783	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:23.018466949 CEST	443	49783	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.023072958 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.023088932 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.023277044 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.024008036 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.024018049 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.028795958 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:23.028831959 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.029109001 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:23.029546022 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:23.029563904 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:23.043520927 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.045411110 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.045434952 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.045521021 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.045530081 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.045700073 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.046215057 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.046225071 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.046258926 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.046272993 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.046322107 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.162672997 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.162692070 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.162744045 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.162784100 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.163686037 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.163693905 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.163753986 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.163760900 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.164544106 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.164556026 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.164606094 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.164612055 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.233020067 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.280844927 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.280884027 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.280908108 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.280919075 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.280940056 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.280961990 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.280968904 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281424999 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281445026 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281476974 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.281476974 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281490088 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281500101 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.281522989 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.281745911 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.281804085 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.281809092 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.282069921 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:23.282121897 CEST	443	49784	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:23.282175064 CEST	49784	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.012763977 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.013084888 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.013097048 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.013518095 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.013977051 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.014029026 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.014056921 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.014435053 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.014727116 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.014740944 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.015247107 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.015574932 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.015652895 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.015687943 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.055329084 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.061121941 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.061144114 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.168838024 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.169478893 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.169545889 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.169617891 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.169631004 CEST	443	49786	150.171.28.10	192.168.2.8
Oct 24, 2024 12:32:24.169652939 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.169702053 CEST	49786	443	192.168.2.8	150.171.28.10
Oct 24, 2024 12:32:24.280993938 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.289247036 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:32:24.289310932 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.289797068 CEST	49785	443	192.168.2.8	150.171.29.10
Oct 24, 2024 12:32:24.289804935 CEST	443	49785	150.171.29.10	192.168.2.8
Oct 24, 2024 12:33:08.961412907 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:08.961504936 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:08.961586952 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:08.961834908 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:08.961853981 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:09.815126896 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:09.815567970 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:09.815603018 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:09.815931082 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:09.816807985 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:09.816868067 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:09.860032082 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:19.804852962 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:19.805042028 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:19.805111885 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:21.399370909 CEST	49791	443	192.168.2.8	142.250.185.132
Oct 24, 2024 12:33:21.399436951 CEST	443	49791	142.250.185.132	192.168.2.8
Oct 24, 2024 12:33:27.418175936 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:33:27.419320107 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:33:27.422522068 CEST	443	49703	13.107.253.51	192.168.2.8
Oct 24, 2024 12:33:27.422648907 CEST	49703	443	192.168.2.8	13.107.253.51
Oct 24, 2024 12:33:27.424871922 CEST	443	49703	13.107.253.51	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 12:32:05.147463083 CEST	53	59568	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:05.189511061 CEST	53	51433	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:06.339987040 CEST	51022	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:06.340225935 CEST	62337	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:06.564363956 CEST	53	62391	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:07.480331898 CEST	49360	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.480398893 CEST	62809	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.484270096 CEST	50353	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.484487057 CEST	51789	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.484987020 CEST	65228	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.485138893 CEST	50837	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.485605001 CEST	59691	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.485707998 CEST	64261	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:07.493158102 CEST	53	65228	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:07.495285988 CEST	53	50837	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:08.800092936 CEST	62287	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:08.800239086 CEST	61244	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:08.911303043 CEST	58012	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:08.911530972 CEST	62722	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:08.918504000 CEST	53	58012	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:08.918592930 CEST	53	62722	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:09.109203100 CEST	64614	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.109498024 CEST	52343	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.116566896 CEST	53	64614	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:09.117824078 CEST	53	52343	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:09.778378963 CEST	54640	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.778548002 CEST	62157	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.813043118 CEST	52345	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.813219070 CEST	63983	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:09.820435047 CEST	53	52345	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:09.820496082 CEST	53	63983	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.956948996 CEST	60215	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.957283974 CEST	64809	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.957747936 CEST	49196	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.957885027 CEST	62402	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.958729982 CEST	56495	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.958884001 CEST	59223	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.965557098 CEST	53	49196	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.966344118 CEST	53	56495	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.968491077 CEST	53	59223	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.973165035 CEST	54606	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.973315001 CEST	57739	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:10.978530884 CEST	53	62402	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.980479002 CEST	53	54606	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:10.980626106 CEST	53	57739	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:12.074780941 CEST	60298	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:12.075022936 CEST	51952	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:12.083342075 CEST	53	51952	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:12.151913881 CEST	63669	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:12.152146101 CEST	57361	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:12.162075996 CEST	53	63669	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:12.162808895 CEST	53	57361	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:12.682429075 CEST	63607	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:12.682574034 CEST	59202	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:14.119662046 CEST	58595	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:14.119889975 CEST	63121	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:15.593455076 CEST	59595	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:15.594935894 CEST	53228	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:15.598694086 CEST	52471	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:15.599215984 CEST	55377	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:15.600809097 CEST	53	59595	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:15.602231026 CEST	53	53228	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:15.607352018 CEST	53	52471	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:15.608870029 CEST	53	55377	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:16.327135086 CEST	64138	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:16.328228951 CEST	60246	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:18.863739014 CEST	58980	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:18.864037037 CEST	62346	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:18.865127087 CEST	54524	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:18.865322113 CEST	60831	53	192.168.2.8	1.1.1.1
Oct 24, 2024 12:32:18.872504950 CEST	53	54524	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:18.872550011 CEST	53	60831	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:18.873235941 CEST	53	58980	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:18.873522043 CEST	53	62346	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:24.013497114 CEST	53	61930	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:42.586853027 CEST	53	57577	1.1.1.1	192.168.2.8
Oct 24, 2024 12:32:45.771722078 CEST	138	138	192.168.2.8	192.168.2.255
Oct 24, 2024 12:33:04.563798904 CEST	53	60492	1.1.1.1	192.168.2.8
Oct 24, 2024 12:33:05.083069086 CEST	53	52700	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 24, 2024 12:32:07.547301054 CEST	192.168.2.8	1.1.1.1	c2a5	(Port unreachable)	Destination Unreachable
Oct 24, 2024 12:32:10.975929976 CEST	192.168.2.8	1.1.1.1	c281	(Port unreachable)	Destination Unreachable
Oct 24, 2024 12:32:14.168376923 CEST	192.168.2.8	1.1.1.1	c2a5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 12:32:06.339987040 CEST	192.168.2.8	1.1.1.1	0xf1fa	Standard query (0)	my.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:06.340225935 CEST	192.168.2.8	1.1.1.1	0xe373	Standard query (0)	my.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:07.480331898 CEST	192.168.2.8	1.1.1.1	0x283d	Standard query (0)	webapps.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.480398893 CEST	192.168.2.8	1.1.1.1	0x347	Standard query (0)	webapps.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:07.484270096 CEST	192.168.2.8	1.1.1.1	0xa894	Standard query (0)	static.nortoncdn.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.484487057 CEST	192.168.2.8	1.1.1.1	0x91c5	Standard query (0)	static.nortoncdn.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:07.484987020 CEST	192.168.2.8	1.1.1.1	0x298a	Standard query (0)	nexus.ensighten.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.485138893 CEST	192.168.2.8	1.1.1.1	0xb56e	Standard query (0)	nexus.ensighten.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:07.485605001 CEST	192.168.2.8	1.1.1.1	0x9769	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.485707998 CEST	192.168.2.8	1.1.1.1	0x2adf	Standard query (0)	assets.adobedtm.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:08.800092936 CEST	192.168.2.8	1.1.1.1	0x28d8	Standard query (0)	static.nortoncdn.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:08.800239086 CEST	192.168.2.8	1.1.1.1	0x6165	Standard query (0)	static.nortoncdn.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:08.911303043 CEST	192.168.2.8	1.1.1.1	0x1710	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:08.911530972 CEST	192.168.2.8	1.1.1.1	0x87d2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:09.109203100 CEST	192.168.2.8	1.1.1.1	0x5d5d	Standard query (0)	nexus.ensighten.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.109498024 CEST	192.168.2.8	1.1.1.1	0x86ef	Standard query (0)	nexus.ensighten.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:09.778378963 CEST	192.168.2.8	1.1.1.1	0xd915	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.778548002 CEST	192.168.2.8	1.1.1.1	0xde2a	Standard query (0)	assets.adobedtm.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:09.813043118 CEST	192.168.2.8	1.1.1.1	0x5d1e	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.813219070 CEST	192.168.2.8	1.1.1.1	0xef17	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:10.956948996 CEST	192.168.2.8	1.1.1.1	0x43d7	Standard query (0)	www.nortonlifelock.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.957283974 CEST	192.168.2.8	1.1.1.1	0x8747	Standard query (0)	www.nortonlifelock.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:10.957747936 CEST	192.168.2.8	1.1.1.1	0x304b	Standard query (0)	symantec.demdex.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.957885027 CEST	192.168.2.8	1.1.1.1	0xe98	Standard query (0)	symantec.demdex.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:10.958729982 CEST	192.168.2.8	1.1.1.1	0xb70c	Standard query (0)	symantec.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.958884001 CEST	192.168.2.8	1.1.1.1	0xba11	Standard query (0)	symantec.tt.omtrdc.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:10.973165035 CEST	192.168.2.8	1.1.1.1	0xa2bf	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.973315001 CEST	192.168.2.8	1.1.1.1	0xc02c	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:12.074780941 CEST	192.168.2.8	1.1.1.1	0x6de7	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.075022936 CEST	192.168.2.8	1.1.1.1	0xe286	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:12.151913881 CEST	192.168.2.8	1.1.1.1	0x947a	Standard query (0)	symantec.tt.omtrdc.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.152146101 CEST	192.168.2.8	1.1.1.1	0x774d	Standard query (0)	symantec.tt.omtrdc.net	65	IN (0x0001)	false
Oct 24, 2024 12:32:12.682429075 CEST	192.168.2.8	1.1.1.1	0xf635	Standard query (0)	www.nortonlifelock.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.682574034 CEST	192.168.2.8	1.1.1.1	0xe34d	Standard query (0)	www.nortonlifelock.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:14.119662046 CEST	192.168.2.8	1.1.1.1	0xcf6f	Standard query (0)	webapps.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:14.119889975 CEST	192.168.2.8	1.1.1.1	0x26b3	Standard query (0)	webapps.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:15.593455076 CEST	192.168.2.8	1.1.1.1	0xac35	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.594935894 CEST	192.168.2.8	1.1.1.1	0x3579	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:15.598694086 CEST	192.168.2.8	1.1.1.1	0x2b22	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.599215984 CEST	192.168.2.8	1.1.1.1	0x996a	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:16.327135086 CEST	192.168.2.8	1.1.1.1	0x3fc8	Standard query (0)	my.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:16.328228951 CEST	192.168.2.8	1.1.1.1	0xa2b5	Standard query (0)	my.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:18.863739014 CEST	192.168.2.8	1.1.1.1	0x52da	Standard query (0)	oms.norton.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.864037037 CEST	192.168.2.8	1.1.1.1	0x7203	Standard query (0)	oms.norton.com	65	IN (0x0001)	false
Oct 24, 2024 12:32:18.865127087 CEST	192.168.2.8	1.1.1.1	0x564f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.865322113 CEST	192.168.2.8	1.1.1.1	0x56ed	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 12:32:06.377367973 CEST	1.1.1.1	192.168.2.8	0xf1fa	No error (0)	my.norton.com	ngp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:06.385622025 CEST	1.1.1.1	192.168.2.8	0xe373	No error (0)	my.norton.com	ngp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.492620945 CEST	1.1.1.1	192.168.2.8	0x91c5	No error (0)	static.nortoncdn.com	static.nortoncdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493098974 CEST	1.1.1.1	192.168.2.8	0x2adf	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493158102 CEST	1.1.1.1	192.168.2.8	0x298a	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493158102 CEST	1.1.1.1	192.168.2.8	0x298a	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.72	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493158102 CEST	1.1.1.1	192.168.2.8	0x298a	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.24	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493158102 CEST	1.1.1.1	192.168.2.8	0x298a	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.34	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.493158102 CEST	1.1.1.1	192.168.2.8	0x298a	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.103	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:07.495091915 CEST	1.1.1.1	192.168.2.8	0x9769	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.495285988 CEST	1.1.1.1	192.168.2.8	0xb56e	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.495939016 CEST	1.1.1.1	192.168.2.8	0xa894	No error (0)	static.nortoncdn.com	static.nortoncdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.530962944 CEST	1.1.1.1	192.168.2.8	0x283d	No error (0)	webapps.norton.com	nmp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:07.547223091 CEST	1.1.1.1	192.168.2.8	0x347	No error (0)	webapps.norton.com	nmp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:08.808898926 CEST	1.1.1.1	192.168.2.8	0x6165	No error (0)	static.nortoncdn.com	static.nortoncdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:08.809501886 CEST	1.1.1.1	192.168.2.8	0x28d8	No error (0)	static.nortoncdn.com	static.nortoncdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:08.918504000 CEST	1.1.1.1	192.168.2.8	0x1710	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:08.918592930 CEST	1.1.1.1	192.168.2.8	0x87d2	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 24, 2024 12:32:09.116566896 CEST	1.1.1.1	192.168.2.8	0x5d5d	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.116566896 CEST	1.1.1.1	192.168.2.8	0x5d5d	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.103	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.116566896 CEST	1.1.1.1	192.168.2.8	0x5d5d	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.72	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.116566896 CEST	1.1.1.1	192.168.2.8	0x5d5d	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.34	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.116566896 CEST	1.1.1.1	192.168.2.8	0x5d5d	No error (0)	d2pz9khpjpljz2.cloudfront.net		65.9.66.24	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.117824078 CEST	1.1.1.1	192.168.2.8	0x86ef	No error (0)	nexus.ensighten.com	d2pz9khpjpljz2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.785973072 CEST	1.1.1.1	192.168.2.8	0xde2a	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.786722898 CEST	1.1.1.1	192.168.2.8	0xd915	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.214.221.135	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.213.88.80	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		63.35.71.243	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.142.7	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.17.240.122	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.17.200.40	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.73.19.51	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820435047 CEST	1.1.1.1	192.168.2.8	0x5d1e	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.203.166.1	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820496082 CEST	1.1.1.1	192.168.2.8	0xef17	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820496082 CEST	1.1.1.1	192.168.2.8	0xef17	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:09.820496082 CEST	1.1.1.1	192.168.2.8	0xef17	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965365887 CEST	1.1.1.1	192.168.2.8	0x43d7	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.17.240.122	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.142.7	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		18.203.166.1	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.251.121	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.208.129.42	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.76.121.43	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.154.229.188	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.965557098 CEST	1.1.1.1	192.168.2.8	0x304b	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.250.93.70	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.966344118 CEST	1.1.1.1	192.168.2.8	0xb70c	No error (0)	symantec.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.966344118 CEST	1.1.1.1	192.168.2.8	0xb70c	No error (0)	adobetarget.data.adobedc.net		66.235.152.225	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.966344118 CEST	1.1.1.1	192.168.2.8	0xb70c	No error (0)	adobetarget.data.adobedc.net		66.235.152.156	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.966344118 CEST	1.1.1.1	192.168.2.8	0xb70c	No error (0)	adobetarget.data.adobedc.net		66.235.152.221	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.968491077 CEST	1.1.1.1	192.168.2.8	0xba11	No error (0)	symantec.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.975878000 CEST	1.1.1.1	192.168.2.8	0x8747	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.978530884 CEST	1.1.1.1	192.168.2.8	0xe98	No error (0)	symantec.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.978530884 CEST	1.1.1.1	192.168.2.8	0xe98	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.978530884 CEST	1.1.1.1	192.168.2.8	0xe98	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.208.241.210	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.154.229.188	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.251.121	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.17.200.40	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.72.42.29	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.142.7	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.214.221.135	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980479002 CEST	1.1.1.1	192.168.2.8	0xa2bf	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.254.132.151	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980626106 CEST	1.1.1.1	192.168.2.8	0xc02c	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980626106 CEST	1.1.1.1	192.168.2.8	0xc02c	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:10.980626106 CEST	1.1.1.1	192.168.2.8	0xc02c	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.081959009 CEST	1.1.1.1	192.168.2.8	0x6de7	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.083342075 CEST	1.1.1.1	192.168.2.8	0xe286	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.162075996 CEST	1.1.1.1	192.168.2.8	0x947a	No error (0)	symantec.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.162075996 CEST	1.1.1.1	192.168.2.8	0x947a	No error (0)	adobetarget.data.adobedc.net		66.235.152.225	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.162075996 CEST	1.1.1.1	192.168.2.8	0x947a	No error (0)	adobetarget.data.adobedc.net		66.235.152.221	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.162075996 CEST	1.1.1.1	192.168.2.8	0x947a	No error (0)	adobetarget.data.adobedc.net		66.235.152.156	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:12.162808895 CEST	1.1.1.1	192.168.2.8	0x774d	No error (0)	symantec.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.691169024 CEST	1.1.1.1	192.168.2.8	0xf635	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:12.694611073 CEST	1.1.1.1	192.168.2.8	0xe34d	No error (0)	www.nortonlifelock.com	www.nortonlifelock.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:14.148474932 CEST	1.1.1.1	192.168.2.8	0xcf6f	No error (0)	webapps.norton.com	nmp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:14.168301105 CEST	1.1.1.1	192.168.2.8	0x26b3	No error (0)	webapps.norton.com	nmp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:15.600809097 CEST	1.1.1.1	192.168.2.8	0xac35	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.602231026 CEST	1.1.1.1	192.168.2.8	0x3579	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 24, 2024 12:32:15.607352018 CEST	1.1.1.1	192.168.2.8	0x2b22	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:15.607352018 CEST	1.1.1.1	192.168.2.8	0x2b22	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.607352018 CEST	1.1.1.1	192.168.2.8	0x2b22	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.607352018 CEST	1.1.1.1	192.168.2.8	0x2b22	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:15.608870029 CEST	1.1.1.1	192.168.2.8	0x996a	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:16.358828068 CEST	1.1.1.1	192.168.2.8	0x3fc8	No error (0)	my.norton.com	ngp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:16.376529932 CEST	1.1.1.1	192.168.2.8	0xa2b5	No error (0)	my.norton.com	ngp-portal.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:18.872504950 CEST	1.1.1.1	192.168.2.8	0x564f	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.872550011 CEST	1.1.1.1	192.168.2.8	0x56ed	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 24, 2024 12:32:18.873235941 CEST	1.1.1.1	192.168.2.8	0x52da	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:18.873235941 CEST	1.1.1.1	192.168.2.8	0x52da	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.873235941 CEST	1.1.1.1	192.168.2.8	0x52da	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.873235941 CEST	1.1.1.1	192.168.2.8	0x52da	No error (0)	norton.com.ssl.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:18.873522043 CEST	1.1.1.1	192.168.2.8	0x7203	No error (0)	oms.norton.com	norton.com.ssl.sc.omtrdc.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:20.664792061 CEST	1.1.1.1	192.168.2.8	0x403	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:20.664792061 CEST	1.1.1.1	192.168.2.8	0x403	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:20.958055019 CEST	1.1.1.1	192.168.2.8	0x7303	No error (0)	bat-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:20.958055019 CEST	1.1.1.1	192.168.2.8	0x7303	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:20.958055019 CEST	1.1.1.1	192.168.2.8	0x7303	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:22.120170116 CEST	1.1.1.1	192.168.2.8	0x2678	No error (0)	bat-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-dc-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:22.120170116 CEST	1.1.1.1	192.168.2.8	0x2678	No error (0)	ax-0001.ax-dc-msedge.net		150.171.29.10	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:22.120170116 CEST	1.1.1.1	192.168.2.8	0x2678	No error (0)	ax-0001.ax-dc-msedge.net		150.171.30.10	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:34.307317972 CEST	1.1.1.1	192.168.2.8	0x7219	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:34.307317972 CEST	1.1.1.1	192.168.2.8	0x7219	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:32:57.725244045 CEST	1.1.1.1	192.168.2.8	0x7e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:32:57.725244045 CEST	1.1.1.1	192.168.2.8	0x7e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 24, 2024 12:33:18.102196932 CEST	1.1.1.1	192.168.2.8	0xd40b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 12:33:18.102196932 CEST	1.1.1.1	192.168.2.8	0xd40b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

nexus.ensighten.com

dpm.demdex.net

symantec.demdex.net

symantec.tt.omtrdc.net

oms.norton.com

www.google.com

bat.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49721	65.9.66.72	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:08 UTC	541	OUT	GET /symantec/cp1/Bootstrap.js HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:08 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 68344 Connection: close Date: Wed, 02 Oct 2024 00:50:42 GMT x-amz-replication-status: COMPLETED Last-Modified: Mon, 03 Jul 2023 16:37:12 GMT ETag: "3def7d8f54c898338eba38e2520c1731" x-amz-server-side-encryption: AES256 Cache-Control: max-age=300 x-amz-version-id: f5ykaBFpTjYlk3jVWXO_.0ExuohYQ1cV Accept-Ranges: bytes Server: CloudFront X-Cache: Hit from cloudfront Via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: YsT1jhsXaILoGEIl5zDC7RLlc4xj0YbnNCBxN73R2MjNIa2-UMggRg== Age: 1935687
2024-10-24 10:32:08 UTC	16384	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 65 6e 73 69 67 68 74 65 6e 49 6e 69 74 28 29 7b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 20 3d 20 7b 63 6c 69 65 6e 74 3a 20 22 73 79 6d 61 6e 74 65 63 22 2c 20 63 6c 69 65 6e 74 49 64 3a 20 32 31 2c 20 70 75 62 6c 69 73 68 50 61 74 68 3a 20 22 63 70 31 22 2c 20 69 73 50 75 62 6c 69 63 3a 30 2c 20 73 65 72 76 65 72 43 6f 6d 70 6f 6e 65 6e 74 4c 6f 63 61 74 69 6f 6e 3a 20 22 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 73 65 72 76 65 72 43 6f 6d 70 6f 6e 65 6e 74 2e 70 68 70 22 2c 20 73 74 61 74 69 63 4a 61 76 61 73 63 72 69 70 74 50 61 74 68 3a 20 22 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 63 6f Data Ascii: (function ensightenInit(){var ensightenOptions = {client: "symantec", clientId: 21, publishPath: "cp1", isPublic:0, serverComponentLocation: "nexus.ensighten.com/symantec/cp1/serverComponent.php", staticJavascriptPath: "nexus.ensighten.com/symantec/cp1/co
2024-10-24 10:32:08 UTC	16384	IN	Data Raw: 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 5b 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 2e 6e 73 5d 2e 63 61 6c 6c 4f 6e 44 4f 4d 4c 6f 61 64 65 64 28 29 7d 29 29 3b 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 26 26 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 26 26 28 63 2e 65 78 65 63 75 74 69 6f 6e 53 74 61 74 65 2e 44 4f 4d 50 61 72 73 65 64 3d 21 30 2c 63 2e 65 78 65 63 75 74 69 6f 6e 53 74 61 74 65 2e 44 4f 4d 4c 6f 61 64 65 64 3d 21 30 29 3b 22 74 72 75 65 22 3d 3d 3d 65 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 54 61 67 41 75 64 69 74 42 65 61 63 6f 6e 26 26 63 2e 73 61 6d 70 6c 65 42 65 61 63 6f Data Ascii: ow.attachEvent("onload",function(){window[ensightenOptions.ns].callOnDOMLoaded()}));document.readyState&&"complete"===document.readyState&&(c.executionState.DOMParsed=!0,c.executionState.DOMLoaded=!0);"true"===e.options.enableTagAuditBeacon&&c.sampleBeaco
2024-10-24 10:32:08 UTC	16384	IN	Data Raw: 70 61 72 61 74 6f 72 3f 61 2e 63 75 73 74 6f 6d 43 6f 6d 70 61 72 61 74 6f 72 5b 64 5d 3f 61 2e 63 75 73 74 6f 6d 43 6f 6d 70 61 72 61 74 6f 72 5b 64 5d 3a 62 5b 61 2e 63 6f 6d 70 61 72 61 74 6f 72 73 5b 64 5d 5d 3a 62 5b 61 2e 63 6f 6d 70 61 72 61 74 6f 72 73 5b 64 5d 5d 29 28 61 2e 76 61 6c 75 65 73 5b 64 5d 2c 61 2e 63 6f 6d 70 61 72 65 54 6f 5b 64 5d 2c 61 2e 63 61 73 65 49 6e 73 65 6e 73 69 74 69 76 65 3f 61 2e 63 61 73 65 49 6e 73 65 6e 73 69 74 69 76 65 5b 64 5d 7c 7c 21 31 3a 21 31 29 3b 61 2e 6e 6f 74 5b 64 5d 26 26 28 68 3d 21 68 29 3b 69 66 28 21 68 29 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 3b 65 2e 74 72 69 67 67 65 72 50 72 6f 6d 69 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 64 2c 62 29 7b 62 3d 62 7c 7c 35 45 33 3b 76 61 72 20 Data Ascii: parator?a.customComparator[d]?a.customComparator[d]:b[a.comparators[d]]:b[a.comparators[d]])(a.values[d],a.compareTo[d],a.caseInsensitive?a.caseInsensitive[d]\|\|!1:!1);a.not[d]&&(h=!h);if(!h)return!1}return!0};e.triggerPromise=function(a,d,b){b=b\|\|5E3;var
2024-10-24 10:32:09 UTC	14808	IN	Data Raw: 69 66 28 39 3d 3d 3d 64 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 4f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 63 28 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 29 29 3b 6b 28 66 3d 61 2e 73 70 6c 69 74 28 22 2c 22 29 2c 79 28 64 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 64 29 7b 62 3d 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 64 29 3b 31 3d 3d 62 2e 6c 65 6e 67 74 68 3f 65 5b 65 2e 6c 65 6e 67 74 68 5d 3d 62 2e 69 74 65 6d 28 30 29 3a 62 2e 6c 65 6e 67 74 68 26 26 28 65 3d 65 2e 63 6f 6e 63 61 74 28 63 28 62 29 29 29 7d 29 29 3b 0a 72 65 74 75 72 6e 20 31 3c 66 2e 6c 65 6e 67 74 68 26 26 31 3c 65 2e 6c 65 6e 67 74 68 3f 68 28 65 29 3a 65 7d 63 61 74 63 68 28 62 61 29 7b 7d 72 65 74 75 72 6e 20 47 28 61 2c 64 29 7d 2c 47 3d 66 75 Data Ascii: if(9===d.nodeType\|\|!O.test(a))return c(d.querySelectorAll(a));k(f=a.split(","),y(d,function(a,d){b=a.querySelectorAll(d);1==b.length?e[e.length]=b.item(0):b.length&&(e=e.concat(c(b)))}));return 1<f.length&&1<e.length?h(e):e}catch(ba){}return G(a,d)},G=fu
2024-10-24 10:32:09 UTC	4384	IN	Data Raw: 61 74 63 68 28 65 29 7b 69 66 28 66 29 72 65 74 75 72 6e 20 66 28 29 3b 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 31 7d 2c 63 6f 76 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 6c 6f 67 28 22 2a 2a 2a 20 43 6c 6f 61 6b 3a 43 6f 76 65 72 22 29 3b 74 68 69 73 2e 69 6e 76 69 73 69 62 69 6c 69 74 79 43 6c 6f 61 6b 3d 74 68 69 73 2e 69 6e 6a 65 63 74 43 53 53 28 22 62 6f 64 79 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6f 70 61 63 69 74 79 3a 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 69 6c 74 65 72 3a 61 6c 70 68 61 28 6f 70 61 63 69 74 79 5c 78 33 64 30 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 22 29 3b 0a 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 62 69 6e 64 50 Data Ascii: atch(e){if(f)return f();return!1}return!1},cover:function(){_log("*** Cloak:Cover");this.invisibilityCloak=this.injectCSS("body{position:relative; opacity:0 !important;filter:alpha(opacity\x3d0) !important;background:none !important}");Bootstrapper.bindP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49727	65.9.66.103	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:09 UTC	368	OUT	GET /symantec/cp1/Bootstrap.js HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:10 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 68344 Connection: close Date: Wed, 02 Oct 2024 00:50:42 GMT x-amz-replication-status: COMPLETED Last-Modified: Mon, 03 Jul 2023 16:37:12 GMT ETag: "3def7d8f54c898338eba38e2520c1731" x-amz-server-side-encryption: AES256 Cache-Control: max-age=300 x-amz-version-id: f5ykaBFpTjYlk3jVWXO_.0ExuohYQ1cV Accept-Ranges: bytes Server: CloudFront X-Cache: Hit from cloudfront Via: 1.1 e39402e2cf62b31f7774452c905f38f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: rOcRTnnoC2CTXfSjCwNbWMGjyV1R78idNSs4hFXhqInUbfL0uvQlYQ== Age: 1935689
2024-10-24 10:32:10 UTC	16384	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 20 65 6e 73 69 67 68 74 65 6e 49 6e 69 74 28 29 7b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 20 3d 20 7b 63 6c 69 65 6e 74 3a 20 22 73 79 6d 61 6e 74 65 63 22 2c 20 63 6c 69 65 6e 74 49 64 3a 20 32 31 2c 20 70 75 62 6c 69 73 68 50 61 74 68 3a 20 22 63 70 31 22 2c 20 69 73 50 75 62 6c 69 63 3a 30 2c 20 73 65 72 76 65 72 43 6f 6d 70 6f 6e 65 6e 74 4c 6f 63 61 74 69 6f 6e 3a 20 22 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 73 65 72 76 65 72 43 6f 6d 70 6f 6e 65 6e 74 2e 70 68 70 22 2c 20 73 74 61 74 69 63 4a 61 76 61 73 63 72 69 70 74 50 61 74 68 3a 20 22 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 63 6f Data Ascii: (function ensightenInit(){var ensightenOptions = {client: "symantec", clientId: 21, publishPath: "cp1", isPublic:0, serverComponentLocation: "nexus.ensighten.com/symantec/cp1/serverComponent.php", staticJavascriptPath: "nexus.ensighten.com/symantec/cp1/co
2024-10-24 10:32:10 UTC	16384	IN	Data Raw: 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 5b 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 2e 6e 73 5d 2e 63 61 6c 6c 4f 6e 44 4f 4d 4c 6f 61 64 65 64 28 29 7d 29 29 3b 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 26 26 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 26 26 28 63 2e 65 78 65 63 75 74 69 6f 6e 53 74 61 74 65 2e 44 4f 4d 50 61 72 73 65 64 3d 21 30 2c 63 2e 65 78 65 63 75 74 69 6f 6e 53 74 61 74 65 2e 44 4f 4d 4c 6f 61 64 65 64 3d 21 30 29 3b 22 74 72 75 65 22 3d 3d 3d 65 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 54 61 67 41 75 64 69 74 42 65 61 63 6f 6e 26 26 63 2e 73 61 6d 70 6c 65 42 65 61 63 6f Data Ascii: ow.attachEvent("onload",function(){window[ensightenOptions.ns].callOnDOMLoaded()}));document.readyState&&"complete"===document.readyState&&(c.executionState.DOMParsed=!0,c.executionState.DOMLoaded=!0);"true"===e.options.enableTagAuditBeacon&&c.sampleBeaco
2024-10-24 10:32:10 UTC	2410	IN	Data Raw: 70 61 72 61 74 6f 72 3f 61 2e 63 75 73 74 6f 6d 43 6f 6d 70 61 72 61 74 6f 72 5b 64 5d 3f 61 2e 63 75 73 74 6f 6d 43 6f 6d 70 61 72 61 74 6f 72 5b 64 5d 3a 62 5b 61 2e 63 6f 6d 70 61 72 61 74 6f 72 73 5b 64 5d 5d 3a 62 5b 61 2e 63 6f 6d 70 61 72 61 74 6f 72 73 5b 64 5d 5d 29 28 61 2e 76 61 6c 75 65 73 5b 64 5d 2c 61 2e 63 6f 6d 70 61 72 65 54 6f 5b 64 5d 2c 61 2e 63 61 73 65 49 6e 73 65 6e 73 69 74 69 76 65 3f 61 2e 63 61 73 65 49 6e 73 65 6e 73 69 74 69 76 65 5b 64 5d 7c 7c 21 31 3a 21 31 29 3b 61 2e 6e 6f 74 5b 64 5d 26 26 28 68 3d 21 68 29 3b 69 66 28 21 68 29 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 3b 65 2e 74 72 69 67 67 65 72 50 72 6f 6d 69 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 64 2c 62 29 7b 62 3d 62 7c 7c 35 45 33 3b 76 61 72 20 Data Ascii: parator?a.customComparator[d]?a.customComparator[d]:b[a.comparators[d]]:b[a.comparators[d]])(a.values[d],a.compareTo[d],a.caseInsensitive?a.caseInsensitive[d]\|\|!1:!1);a.not[d]&&(h=!h);if(!h)return!1}return!0};e.triggerPromise=function(a,d,b){b=b\|\|5E3;var
2024-10-24 10:32:10 UTC	16384	IN	Data Raw: 74 72 79 7b 64 2e 61 70 70 6c 79 28 62 2c 65 29 7d 63 61 74 63 68 28 72 29 7b 66 5b 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 2e 6e 73 5d 2e 72 65 70 6f 72 74 45 78 63 65 70 74 69 6f 6e 28 6e 65 77 20 63 2e 44 61 74 61 44 65 66 69 6e 69 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 28 61 2c 22 45 72 72 6f 72 20 72 65 73 6f 6c 76 69 6e 67 20 64 61 74 61 20 64 65 66 69 6e 69 74 69 6f 6e 73 3a 20 22 2b 0a 20 20 20 20 61 2b 22 2e 20 44 65 74 61 69 6c 73 3a 20 22 2b 72 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 5b 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 2e 6e 73 5d 2e 72 65 70 6f 72 74 45 78 63 65 70 74 69 6f 6e 28 6e 65 77 20 63 2e 44 61 74 61 44 65 66 69 6e 69 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 28 61 2c 22 45 72 72 6f 72 20 72 65 73 6f Data Ascii: try{d.apply(b,e)}catch(r){f[ensightenOptions.ns].reportException(new c.DataDefinitionException(a,"Error resolving data definitions: "+ a+". Details: "+r))}},function(b){f[ensightenOptions.ns].reportException(new c.DataDefinitionException(a,"Error reso
2024-10-24 10:32:10 UTC	16384	IN	Data Raw: 6e 63 65 6f 66 20 67 29 29 7b 66 6f 72 28 76 61 72 20 66 20 69 6e 20 74 29 69 66 28 74 5b 66 5d 2e 65 6c 65 6d 65 6e 74 3d 3d 3d 62 29 72 65 74 75 72 6e 20 74 5b 66 5d 3b 78 2b 2b 3b 74 5b 78 5d 3d 6e 65 77 20 67 28 62 2c 78 29 3b 74 5b 78 5d 2e 5f 6f 6e 3d 74 5b 78 5d 2e 6f 6e 3b 74 5b 78 5d 2e 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 66 2c 67 29 7b 76 61 72 20 68 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 3f 63 3a 66 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 3f 66 3a 67 29 62 3d 5b 62 5d 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 62 2e 70 75 73 68 28 63 29 2c 62 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 63 29 7b 63 2e Data Ascii: nceof g)){for(var f in t)if(t[f].element===b)return t[f];x++;t[x]=new g(b,x);t[x]._on=t[x].on;t[x].on=function(b,c,f,g){var h="function"==typeof c?c:f;if("function"==typeof c?f:g)b=[b],"string"==typeof c&&b.push(c),b.push(function(b){return function(c){c.
2024-10-24 10:32:10 UTC	398	IN	Data Raw: 5b 69 5d 2e 73 72 63 3b 6c 2e 74 79 70 65 3d 73 5b 69 5d 2e 74 79 70 65 3b 73 5b 69 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 64 2c 73 5b 69 5d 29 7d 65 6c 73 65 20 46 75 6e 63 74 69 6f 6e 28 22 74 72 79 7b 22 2b 73 5b 69 5d 2e 74 65 78 74 2b 22 7d 63 61 74 63 68 28 65 29 7b 7d 22 29 28 29 7d 63 61 74 63 68 28 65 29 7b 7d 5f 6c 6f 67 28 22 2a 2a 2a 20 4d 56 54 3a 63 6f 6d 70 6c 65 74 65 22 29 3b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 4d 56 54 2e 73 68 6f 77 28 61 2c 62 29 7d 7d 29 3b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 56 54 63 6f 6e 66 69 67 3d 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 56 54 63 6f 6e 66 69 67 7c 7c 7b 7d 3b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 56 54 63 6f 6e 66 69 67 5b 22 4d 56 54 22 5d 3d 74 68 69 Data Ascii: [i].src;l.type=s[i].type;s[i].parentNode.replaceChild(d,s[i])}else Function("try{"+s[i].text+"}catch(e){}")()}catch(e){}_log("*** MVT:complete");Bootstrapper.MVT.show(a,b)}});Bootstrapper.VTconfig=Bootstrapper.VTconfig\|\|{};Bootstrapper.VTconfig["MVT"]=thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 10:32:10 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=22467 Date: Thu, 24 Oct 2024 10:32:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49731	52.214.221.135	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:10 UTC	713	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1729765929179 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://my.norton.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:10 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:32:10 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: ZvIGkN9oRX0= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://my.norton.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-irl1-1-v067-0c902d8a1.edge-irl1.demdex.com 3 ms set-cookie: demdex=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:10 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-10-24 10:32:10 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 37 32 37 32 33 36 34 38 33 39 31 36 38 37 37 37 33 36 30 33 33 39 31 30 35 31 32 38 33 30 34 39 37 30 37 34 36 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"87272364839168777360339105128304970746","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49733	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 10:32:11 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25939 Date: Thu, 24 Oct 2024 10:32:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-24 10:32:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49734	65.9.66.72	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:11 UTC	756	OUT	GET /symantec/cp1/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/symantec/cp1/code/&publishedOn=Mon%20Jul%2003%2016:37:09%20GMT%202023&ClientID=21&PageID=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2 HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:12 UTC	464	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 489 Connection: close Server: CloudFront Date: Thu, 24 Oct 2024 10:32:11 GMT Expires: Thu, 24 Oct 2024 10:32:10 GMT Cache-Control: no-cache Cache-Control: no-store X-Cache: Miss from cloudfront Via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 1H4sIqot-LICjPdXmhq9D3V68V9tbbL1ybBKwDxOcTRrNJv77t8cDg==
2024-10-24 10:32:12 UTC	489	IN	Data Raw: 0a 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 5f 73 65 72 76 65 72 54 69 6d 65 20 3d 20 27 32 30 32 34 2d 31 30 2d 32 34 20 31 30 3a 33 32 3a 31 31 27 3b 20 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 5f 63 6c 69 65 6e 74 49 50 20 3d 20 27 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 27 3b 20 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 69 6e 73 65 72 74 50 61 67 65 46 69 6c 65 73 28 5b 27 68 74 74 70 73 3a 2f 2f 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 63 6f 64 65 2f 35 35 65 64 30 39 30 61 31 34 66 34 30 65 36 62 37 62 30 32 61 31 62 62 66 63 37 32 61 31 61 39 2e 6a 73 3f 63 6f 6e 64 69 74 69 6f 6e 49 64 30 3d 34 32 33 31 33 30 27 2c 27 68 74 74 70 73 3a 2f 2f 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f Data Ascii: Bootstrapper._serverTime = '2024-10-24 10:32:11'; Bootstrapper._clientIP = '173.254.250.71'; Bootstrapper.insertPageFiles(['https://nexus.ensighten.com/symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130','https://nexus.ensighten.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49737	52.17.240.122	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:11 UTC	753	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: symantec.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=87432529198126374650360190330118866763
2024-10-24 10:32:12 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:32:11 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: n8521X9bTwA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Wed, 16 Oct 2024 08:53:28 GMT DCS: dcs-prod-irl1-1-v067-0c6074d7b.edge-irl1.demdex.com 0 ms
2024-10-24 10:32:12 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49735	66.235.152.225	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:11 UTC	1901	OUT	GET /m2/symantec/mbox/json?mbox=sym_global_mbox&mboxSession=eeb7662070774edca038572e87dc71ba&mboxPC=&mboxPage=3e7eff5657134cacaa417b72c58a02fb&mboxRid=95487b1c763d4bf3aaa4b0e06803d432&mboxVersion=1.8.3&mboxCount=1&mboxTime=1729751529194&mboxHost=my.norton.com&mboxURL=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&mboxReferrer=&mboxXDomain=enabled&browserHeight=907&browserWidth=1280&browserTimeOffset=-240&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=ANGLE%20(Google%2C%20Vulkan%201.3.0%20(SwiftShader%20Device%20(Subzero)%20(0x0000C0DE))%2C%20SwiftShader%20driver)&Promocode=&profile.TCG=&vendor_type=&program_type=&site_country=&site_section=&content_title=&site_language=&traffic_source=&ExistingCustomer=&site_sub_section=&profile.promocode=&current_subchannel=&site_content_title=&original_subchannel=&profile.vendor_type=&profile.program_type=&profile.site_country=&site_sub_sub_section=&%20profile.site_section=&profile.site_language= [TRUNCATED] Host: symantec.tt.omtrdc.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://my.norton.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:12 UTC	1139	IN	HTTP/1.1 200 OK date: Thu, 24 Oct 2024 10:32:11 GMT content-type: application/json;charset=UTF-8 content-length: 1357 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding access-control-allow-origin: https://my.norton.com access-control-allow-credentials: true x-request-id: 95487b1c763d4bf3aaa4b0e06803d432 p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" set-cookie: symantec!mboxSession=eeb7662070774edca038572e87dc71ba; Max-Age=1860; Expires=Thu, 24-Oct-2024 11:03:11 GMT; Domain=symantec.tt.omtrdc.net; Path=/; Secure; HttpOnly; SameSite=None set-cookie: symantec!mboxPC=eeb7662070774edca038572e87dc71ba.37_0; Max-Age=63244800; Expires=Mon, 26-Oct-2026 10:32:11 GMT; Domain=symantec.tt.omtrdc.net; Path=/; Secure; HttpOnly; SameSite=None pragma: no-cache timing-allow-origin: * referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-24 10:32:12 UTC	1357	IN	Data Raw: 7b 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 65 65 62 37 36 36 32 30 37 30 37 37 34 65 64 63 61 30 33 38 35 37 32 65 38 37 64 63 37 31 62 61 22 2c 22 74 6e 74 49 64 22 3a 22 65 65 62 37 36 36 32 30 37 30 37 37 34 65 64 63 61 30 33 38 35 37 32 65 38 37 64 63 37 31 62 61 2e 33 37 5f 30 22 2c 22 6f 66 66 65 72 73 22 3a 5b 7b 22 70 6c 75 67 69 6e 73 22 3a 5b 22 3c 73 63 72 69 70 74 20 74 79 70 65 3d 5c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 5c 22 3e 5c 72 5c 6e 20 20 20 20 2f 2a 54 26 54 20 74 6f 20 53 69 74 65 43 61 74 20 76 33 20 3d 3d 3e 52 65 73 70 6f 6e 73 65 20 50 6c 75 67 69 6e 2a 2f 5c 72 5c 6e 20 20 20 20 77 69 6e 64 6f 77 2e 73 5f 74 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 73 5f 74 6e 74 20 7c 7c 20 27 27 2c 20 74 6e 74 56 61 6c 20 3d 20 27 3a 3a Data Ascii: {"sessionId":"eeb7662070774edca038572e87dc71ba","tntId":"eeb7662070774edca038572e87dc71ba.37_0","offers":[{"plugins":["<script type=\"text/javascript\">\r\n /T&T to SiteCat v3 ==>Response Plugin/\r\n window.s_tnt = window.s_tnt \|\| '', tntVal = '::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49738	52.208.241.210	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:11 UTC	519	OUT	GET /id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=67C716D751E567F70A490D4C%40AdobeOrg&d_nsid=0&ts=1729765929179 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=87432529198126374650360190330118866763
2024-10-24 10:32:12 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:32:11 GMT Content-Type: application/json;charset=utf-8 Content-Length: 367 Connection: close X-TID: PDI/yzhJRN4= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-irl1-2-v067-010c1a5fa.edge-irl1.demdex.com 6 ms set-cookie: demdex=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:11 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-10-24 10:32:12 UTC	367	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 37 32 37 32 33 36 34 38 33 39 31 36 38 37 37 37 33 36 30 33 33 39 31 30 35 31 32 38 33 30 34 39 37 30 37 34 36 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"87272364839168777360339105128304970746","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49739	65.9.66.103	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:12 UTC	583	OUT	GET /symantec/cp1/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/symantec/cp1/code/&publishedOn=Mon%20Jul%2003%2016:37:09%20GMT%202023&ClientID=21&PageID=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2 HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:13 UTC	464	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 489 Connection: close Server: CloudFront Date: Thu, 24 Oct 2024 10:32:13 GMT Expires: Thu, 24 Oct 2024 10:32:12 GMT Cache-Control: no-cache Cache-Control: no-store X-Cache: Miss from cloudfront Via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: PhClEXFM8E0UFUqNkH5Sj7peEm52_enoGKE0eStA5JQhQag5lP6qDA==
2024-10-24 10:32:13 UTC	489	IN	Data Raw: 0a 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 5f 73 65 72 76 65 72 54 69 6d 65 20 3d 20 27 32 30 32 34 2d 31 30 2d 32 34 20 31 30 3a 33 32 3a 31 33 27 3b 20 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 5f 63 6c 69 65 6e 74 49 50 20 3d 20 27 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 31 27 3b 20 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 69 6e 73 65 72 74 50 61 67 65 46 69 6c 65 73 28 5b 27 68 74 74 70 73 3a 2f 2f 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f 6d 2f 73 79 6d 61 6e 74 65 63 2f 63 70 31 2f 63 6f 64 65 2f 35 35 65 64 30 39 30 61 31 34 66 34 30 65 36 62 37 62 30 32 61 31 62 62 66 63 37 32 61 31 61 39 2e 6a 73 3f 63 6f 6e 64 69 74 69 6f 6e 49 64 30 3d 34 32 33 31 33 30 27 2c 27 68 74 74 70 73 3a 2f 2f 6e 65 78 75 73 2e 65 6e 73 69 67 68 74 65 6e 2e 63 6f Data Ascii: Bootstrapper._serverTime = '2024-10-24 10:32:13'; Bootstrapper._clientIP = '173.254.250.71'; Bootstrapper.insertPageFiles(['https://nexus.ensighten.com/symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130','https://nexus.ensighten.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49742	65.9.66.72	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:12 UTC	589	OUT	GET /symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130 HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:13 UTC	692	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 11156 Connection: close Date: Thu, 24 Oct 2024 10:32:14 GMT x-amz-replication-status: COMPLETED Last-Modified: Tue, 05 Oct 2021 20:29:26 GMT ETag: "2838622562ea0dfb9f92cc6b6dd0cf0c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=315360000 x-amz-version-id: HsP7cmZW1bJL1yCFGrB78ozrtV_T1GEH Accept-Ranges: bytes Server: CloudFront Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 673c96d1f19de21216629aa48d90ac92.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: VucAnsZUEdgPqfO5Hqy-EQSzIZtC_J1g2JSq3LOihUQvMxoIEOoVEQ==
2024-10-24 10:32:13 UTC	11156	IN	Data Raw: 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 62 69 6e 64 49 6d 6d 65 64 69 61 74 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 42 6f 6f 74 73 74 72 61 70 70 65 72 3d 77 69 6e 64 6f 77 5b 22 42 6f 6f 74 73 74 72 61 70 70 65 72 22 5d 3b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3d 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 72 65 67 69 73 74 65 72 44 61 74 61 44 65 66 69 6e 69 74 69 6f 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 64 61 74 61 2e 64 65 66 69 6e 65 28 7b 65 78 74 72 61 63 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 2e 72 65 70 6c Data Ascii: Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return window.location.search.repl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49741	65.9.66.72	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:12 UTC	569	OUT	GET /symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:13 UTC	701	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 1459 Connection: close Date: Thu, 24 Oct 2024 09:20:29 GMT x-amz-replication-status: COMPLETED Last-Modified: Thu, 29 Jul 2021 18:14:03 GMT ETag: "693e44cb920a49cd359c9b2a0205281f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=315360000 x-amz-version-id: 01592tHpyjztnfecIjvHyV2fPk4f1Af2 Accept-Ranges: bytes Server: CloudFront Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Z0VL8sSMQ7YzDVcIDnA904YO-1BIpJuIYpqmXWpKV9CWeeKT9RVxSQ== Age: 4305
2024-10-24 10:32:13 UTC	1459	IN	Data Raw: 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 62 69 6e 64 44 4f 4d 50 61 72 73 65 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 42 6f 6f 74 73 74 72 61 70 70 65 72 3d 77 69 6e 64 6f 77 5b 22 42 6f 6f 74 73 74 72 61 70 70 65 72 22 5d 3b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3d 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3b 77 69 6e 64 6f 77 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 73 3d 22 75 73 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 62 75 79 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 77 77 77 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 22 3b 6d 62 6f 78 46 61 63 74 6f 72 79 44 65 66 61 75 6c 74 2e 61 64 64 4f 6e 4c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 65 74 4d 62 6f 78 53 65 73 73 69 6f 6e 49 Data Ascii: Bootstrapper.bindDOMParsed(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;window.crossDomains="us.norton.com,buy.norton.com,www.norton.com,";mboxFactoryDefault.addOnLoad(function(){var getMboxSessionI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49744	66.235.152.225	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:13 UTC	1819	OUT	GET /m2/symantec/mbox/json?mbox=sym_global_mbox&mboxSession=eeb7662070774edca038572e87dc71ba&mboxPC=&mboxPage=3e7eff5657134cacaa417b72c58a02fb&mboxRid=95487b1c763d4bf3aaa4b0e06803d432&mboxVersion=1.8.3&mboxCount=1&mboxTime=1729751529194&mboxHost=my.norton.com&mboxURL=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&mboxReferrer=&mboxXDomain=enabled&browserHeight=907&browserWidth=1280&browserTimeOffset=-240&screenHeight=1024&screenWidth=1280&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=ANGLE%20(Google%2C%20Vulkan%201.3.0%20(SwiftShader%20Device%20(Subzero)%20(0x0000C0DE))%2C%20SwiftShader%20driver)&Promocode=&profile.TCG=&vendor_type=&program_type=&site_country=&site_section=&content_title=&site_language=&traffic_source=&ExistingCustomer=&site_sub_section=&profile.promocode=&current_subchannel=&site_content_title=&original_subchannel=&profile.vendor_type=&profile.program_type=&profile.site_country=&site_sub_sub_section=&%20profile.site_section=&profile.site_language= [TRUNCATED] Host: symantec.tt.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: symantec!mboxSession=eeb7662070774edca038572e87dc71ba; symantec!mboxPC=eeb7662070774edca038572e87dc71ba.37_0
2024-10-24 10:32:13 UTC	855	IN	HTTP/1.1 200 OK date: Thu, 24 Oct 2024 10:32:13 GMT content-type: application/json;charset=UTF-8 content-length: 1357 vary: origin,access-control-request-method,access-control-request-headers,accept-encoding x-request-id: 95487b1c763d4bf3aaa4b0e06803d432 p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" set-cookie: symantec!mboxPC=eeb7662070774edca038572e87dc71ba.37_0; Max-Age=63244800; Expires=Mon, 26-Oct-2026 10:32:13 GMT; Domain=symantec.tt.omtrdc.net; Path=/; Secure; HttpOnly; SameSite=None pragma: no-cache timing-allow-origin: * referrer-policy: strict-origin-when-cross-origin server: jag strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-24 10:32:13 UTC	1357	IN	Data Raw: 7b 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 65 65 62 37 36 36 32 30 37 30 37 37 34 65 64 63 61 30 33 38 35 37 32 65 38 37 64 63 37 31 62 61 22 2c 22 74 6e 74 49 64 22 3a 22 65 65 62 37 36 36 32 30 37 30 37 37 34 65 64 63 61 30 33 38 35 37 32 65 38 37 64 63 37 31 62 61 2e 33 37 5f 30 22 2c 22 6f 66 66 65 72 73 22 3a 5b 7b 22 70 6c 75 67 69 6e 73 22 3a 5b 22 3c 73 63 72 69 70 74 20 74 79 70 65 3d 5c 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 5c 22 3e 5c 72 5c 6e 20 20 20 20 2f 2a 54 26 54 20 74 6f 20 53 69 74 65 43 61 74 20 76 33 20 3d 3d 3e 52 65 73 70 6f 6e 73 65 20 50 6c 75 67 69 6e 2a 2f 5c 72 5c 6e 20 20 20 20 77 69 6e 64 6f 77 2e 73 5f 74 6e 74 20 3d 20 77 69 6e 64 6f 77 2e 73 5f 74 6e 74 20 7c 7c 20 27 27 2c 20 74 6e 74 56 61 6c 20 3d 20 27 3a 3a Data Ascii: {"sessionId":"eeb7662070774edca038572e87dc71ba","tntId":"eeb7662070774edca038572e87dc71ba.37_0","offers":[{"plugins":["<script type=\"text/javascript\">\r\n /T&T to SiteCat v3 ==>Response Plugin/\r\n window.s_tnt = window.s_tnt \|\| '', tntVal = '::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49749	65.9.66.72	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:14 UTC	728	OUT	GET /error/e.gif?msg=mboxFactoryDefault%20is%20not%20defined&lnn=-1&fn=&cid=21&client=symantec&publishPath=cp1&rid=300053&did=167100&errorName=ReferenceError HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:14 UTC	391	IN	HTTP/1.1 204 No Content Connection: close Server: CloudFront Date: Thu, 24 Oct 2024 06:58:20 GMT Cache-Control: no-cache Cache-Control: no-store X-Cache: Hit from cloudfront Via: 1.1 6165dcc1fdf84ac65e8204c05709f1ca.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: zxgS7RLPFnKD3d3X6Qe83qI26BKreWdlA2uvFV8jO1z94r0-T_Ohpw== Age: 12834

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49750	65.9.66.103	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:14 UTC	396	OUT	GET /symantec/cp1/code/5a511eff6ece75f86134f0b7c2baed9b.js HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:14 UTC	701	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 1459 Connection: close Date: Thu, 24 Oct 2024 09:20:29 GMT x-amz-replication-status: COMPLETED Last-Modified: Thu, 29 Jul 2021 18:14:03 GMT ETag: "693e44cb920a49cd359c9b2a0205281f" x-amz-server-side-encryption: AES256 Cache-Control: max-age=315360000 x-amz-version-id: 01592tHpyjztnfecIjvHyV2fPk4f1Af2 Accept-Ranges: bytes Server: CloudFront Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c359abeab0060e721cfaac65ce34b1cc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 999Dg9Ohqh1QXGpr6uydVjdFCC8sJDkEUrYfmVysA1E5dFSnxsUuXw== Age: 4306
2024-10-24 10:32:14 UTC	1459	IN	Data Raw: 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 62 69 6e 64 44 4f 4d 50 61 72 73 65 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 42 6f 6f 74 73 74 72 61 70 70 65 72 3d 77 69 6e 64 6f 77 5b 22 42 6f 6f 74 73 74 72 61 70 70 65 72 22 5d 3b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3d 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3b 77 69 6e 64 6f 77 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 73 3d 22 75 73 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 62 75 79 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 77 77 77 2e 6e 6f 72 74 6f 6e 2e 63 6f 6d 2c 22 3b 6d 62 6f 78 46 61 63 74 6f 72 79 44 65 66 61 75 6c 74 2e 61 64 64 4f 6e 4c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 67 65 74 4d 62 6f 78 53 65 73 73 69 6f 6e 49 Data Ascii: Bootstrapper.bindDOMParsed(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;window.crossDomains="us.norton.com,buy.norton.com,www.norton.com,";mboxFactoryDefault.addOnLoad(function(){var getMboxSessionI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49751	52.214.221.135	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:14 UTC	662	OUT	GET /ibs:dpid=411&dpuuid=ZxoiLQAAAJqQkgNx HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=87432529198126374650360190330118866763
2024-10-24 10:32:14 UTC	891	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:32:14 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: rm961mTcRxk= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v067-0ce54ced4.edge-irl1.demdex.com 3 ms set-cookie: dpm=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:14 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:14 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-10-24 10:32:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49752	65.9.66.103	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:14 UTC	416	OUT	GET /symantec/cp1/code/55ed090a14f40e6b7b02a1bbfc72a1a9.js?conditionId0=423130 HTTP/1.1 Host: nexus.ensighten.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:14 UTC	699	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 11156 Connection: close Date: Thu, 24 Oct 2024 10:32:14 GMT x-amz-replication-status: COMPLETED Last-Modified: Tue, 05 Oct 2021 20:29:26 GMT ETag: "2838622562ea0dfb9f92cc6b6dd0cf0c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=315360000 x-amz-version-id: HsP7cmZW1bJL1yCFGrB78ozrtV_T1GEH Accept-Ranges: bytes Server: CloudFront Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 58b39782bf40f627ace295c1c6f59840.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Tsc5Aj9-HYWNRPVKDyIZK-7MDg0P4FAinb3H90_T8Xwcmcw7k0-JwQ== Age: 1
2024-10-24 10:32:14 UTC	11156	IN	Data Raw: 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 62 69 6e 64 49 6d 6d 65 64 69 61 74 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 42 6f 6f 74 73 74 72 61 70 70 65 72 3d 77 69 6e 64 6f 77 5b 22 42 6f 6f 74 73 74 72 61 70 70 65 72 22 5d 3b 76 61 72 20 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3d 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 6e 73 69 67 68 74 65 6e 4f 70 74 69 6f 6e 73 3b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 72 65 67 69 73 74 65 72 44 61 74 61 44 65 66 69 6e 69 74 69 6f 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 64 61 74 61 2e 64 65 66 69 6e 65 28 7b 65 78 74 72 61 63 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 2e 72 65 70 6c Data Ascii: Bootstrapper.bindImmediate(function(){var Bootstrapper=window["Bootstrapper"];var ensightenOptions=Bootstrapper.ensightenOptions;Bootstrapper.registerDataDefinition(function(){Bootstrapper.data.define({extract:function(){return window.location.search.repl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49756	52.208.241.210	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:15 UTC	473	OUT	GET /ibs:dpid=411&dpuuid=ZxoiLQAAAJqQkgNx HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=87432529198126374650360190330118866763; dpm=87432529198126374650360190330118866763
2024-10-24 10:32:15 UTC	891	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:32:15 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: YNic4FqUT84= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v067-0237dd27c.edge-irl1.demdex.com 3 ms set-cookie: dpm=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:15 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=87432529198126374650360190330118866763; Max-Age=15552000; Expires=Tue, 22 Apr 2025 10:32:15 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-10-24 10:32:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49761	63.140.62.222	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:16 UTC	2192	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s36224975530980?AQB=1&ndh=1&pf=1&t=24%2F9%2F2024%206%3A32%3A14%204%20240&sdid=39192FC575EFDA9E-79DEBE6A3E839DD8&mid=87272364839168777360339105128304970746&aamlh=6&ce=UTF-8&pageName=mynorton%3Aus%3Alifelock&g=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&v10=de527324-05e3-46eb-a2a7-43ab29c1aff7&c14=D%3Dv16&v18=mynorton%3Aus%3Alifelock&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v29=not%20signed%20in&c35=D%3DpageName&c41=mynorton&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-10-07&c48=Norton%20-%20My%20Subscription&v48=D%3Dc49&c49=lifelock&v49=D%3Dc48&v57=87272364839168777360339105128304970746&c59=mynorton%3Alifelock&v59=D%3Dc59&v72=mynorton&c75=D%3Dv57&v96=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&v133=na&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: at_check=true; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; mbox=session#eeb7662070774edca038572e87dc71ba#1729767792\|PC#eeb7662070774edca038572e87dc71ba.37_0#1793010732; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C20021%7CMCMID%7C87272364839168777360339105128304970746%7CMCAAMLH-1730370730%7C6%7CMCAAMB-1730370730%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729773130s%7CNONE%7CMCSYNCSOP%7C411-20028%7CvVersion%7C5.5.0; s_nr=1729765934933-New; event69=event69; channelStack=s_eVar72~mynorton; s_tbm=true; s_gpv=mynorton%3Aus%3Alifelock; s_gpv_custom=mynorton%3Alifelock; s_cc=true
2024-10-24 10:32:16 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 24 Oct 2024 10:32:16 GMT expires: Wed, 23 Oct 2024 10:32:16 GMT last-modified: Fri, 25 Oct 2024 10:32:16 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3714644064294043648-4618612124061290821 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-24 10:32:16 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49760	142.250.186.36	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:16 UTC	662	OUT	GET /recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:16 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 24 Oct 2024 10:32:16 GMT Date: Thu, 24 Oct 2024 10:32:16 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-24 10:32:16 UTC	629	IN	Data Raw: 35 64 39 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 5d9/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-10-24 10:32:16 UTC	875	IN	Data Raw: 35 75 65 72 61 76 63 7a 65 66 2f 77 49 6c 54 6b 62 56 6b 31 71 58 51 65 73 70 33 39 6e 56 2b 78 4e 45 43 50 64 4c 42 56 65 59 66 66 78 72 4d 38 54 6d 5a 54 36 52 41 72 57 47 51 56 43 4a 30 4c 52 69 76 44 37 67 6c 63 41 55 41 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b Data Ascii: 5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJk
2024-10-24 10:32:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49772	63.140.62.17	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:19 UTC	1960	OUT	GET /b/ss/symanteccom/1/JS-2.22.0-LDQM/s36224975530980?AQB=1&ndh=1&pf=1&t=24%2F9%2F2024%206%3A32%3A14%204%20240&sdid=39192FC575EFDA9E-79DEBE6A3E839DD8&mid=87272364839168777360339105128304970746&aamlh=6&ce=UTF-8&pageName=mynorton%3Aus%3Alifelock&g=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&server=norton&events=event69&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=us&c3=en&c8=D%3Dv163&v10=de527324-05e3-46eb-a2a7-43ab29c1aff7&c14=D%3Dv16&v18=mynorton%3Aus%3Alifelock&v21=D%3Dc21&v27=D%3Dc2&v28=D%3Dc3&v29=not%20signed%20in&c35=D%3DpageName&c41=mynorton&v41=D%3Dc41&c46=html&c47=page&v47=s_code_norton%202024-10-07&c48=Norton%20-%20My%20Subscription&v48=D%3Dc49&c49=lifelock&v49=D%3Dc48&v57=87272364839168777360339105128304970746&c59=mynorton%3Alifelock&v59=D%3Dc59&v72=mynorton&c75=D%3Dv57&v96=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&v133=na&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=907&mcorgid=67C716D751E567F70A490D4C%40AdobeOrg&AQE=1 HTTP/1.1 Host: oms.norton.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: at_check=true; AMCVS_67C716D751E567F70A490D4C%40AdobeOrg=1; mbox=session#eeb7662070774edca038572e87dc71ba#1729767792\|PC#eeb7662070774edca038572e87dc71ba.37_0#1793010732; AMCV_67C716D751E567F70A490D4C%40AdobeOrg=179643557%7CMCIDTS%7C20021%7CMCMID%7C87272364839168777360339105128304970746%7CMCAAMLH-1730370730%7C6%7CMCAAMB-1730370730%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1729773130s%7CNONE%7CMCSYNCSOP%7C411-20028%7CvVersion%7C5.5.0; s_nr=1729765934933-New; event69=event69; channelStack=s_eVar72~mynorton; s_tbm=true; s_gpv=mynorton%3Aus%3Alifelock; s_gpv_custom=mynorton%3Alifelock; s_cc=true
2024-10-24 10:32:19 UTC	574	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Thu, 24 Oct 2024 10:32:19 GMT expires: Wed, 23 Oct 2024 10:32:19 GMT last-modified: Fri, 25 Oct 2024 10:32:19 GMT pragma: no-cache p3p: CP="This is not a P3P policy" server: jag etag: 3714644070572326912-4618286763108839118 vary: * content-type: image/gif;charset=utf-8 content-length: 43 strict-transport-security: max-age=31536000; includeSubDomains cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-10-24 10:32:19 UTC	43	IN	Data Raw: 47 49 46 38 39 61 02 00 02 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 02 00 02 00 00 02 02 84 51 00 3b Data Ascii: GIF89a!,Q;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49771	142.250.186.164	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:19 UTC	489	OUT	GET /recaptcha/api.js?render=explicit&onload=ng2recaptchaloaded HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:19 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 24 Oct 2024 10:32:19 GMT Date: Thu, 24 Oct 2024 10:32:19 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-24 10:32:19 UTC	629	IN	Data Raw: 35 64 39 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 5d9/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-10-24 10:32:19 UTC	875	IN	Data Raw: 35 75 65 72 61 76 63 7a 65 66 2f 77 49 6c 54 6b 62 56 6b 31 71 58 51 65 73 70 33 39 6e 56 2b 78 4e 45 43 50 64 4c 42 56 65 59 66 66 78 72 4d 38 54 6d 5a 54 36 52 41 72 57 47 51 56 43 4a 30 4c 52 69 76 44 37 67 6c 63 41 55 41 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b Data Ascii: 5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJk
2024-10-24 10:32:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49779	150.171.28.10	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:21 UTC	515	OUT	GET /bat.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:21 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 51385 Content-Type: application/javascript Last-Modified: Wed, 16 Oct 2024 22:47:44 GMT Accept-Ranges: bytes ETag: "028e0691d20db1:0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B6C90A19F2C0489FA0713B4B2EBB0E0F Ref B: DFW311000105027 Ref C: 2024-10-24T10:32:21Z Date: Thu, 24 Oct 2024 10:32:20 GMT Connection: close
2024-10-24 10:32:21 UTC	1073	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 55 45 54 28 6f 29 7b 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 7d 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 3d 22 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 22 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 3d 22 62 61 74 2e 62 69 6e 67 2e 6e 65 74 22 3b 74 68 69 73 2e 55 52 4c 4c 45 4e 47 54 48 4c 49 4d 49 54 3d 34 30 39 36 3b 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3d 22 70 61 67 65 4c 6f 61 64 22 3b 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3d 22 63 75 73 74 6f 6d 22 3b 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3d 22 70 61 67 65 5f 76 69 65 77 22 3b 6f 2e 56 65 72 3d 6f 2e 56 65 72 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 Data Ascii: function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&
2024-10-24 10:32:21 UTC	8192	IN	Data Raw: 6f 72 6d 61 74 22 7d 2c 70 69 64 3a 7b 74 79 70 65 3a 22 70 69 64 22 7d 2c 22 65 6e 75 6d 22 3a 7b 74 79 70 65 3a 22 65 6e 75 6d 22 2c 65 72 72 6f 72 3a 22 7b 70 7d 20 76 61 6c 75 65 20 6d 75 73 74 20 62 65 20 6f 6e 65 20 6f 66 20 74 68 65 20 61 6c 6c 6f 77 65 64 20 76 61 6c 75 65 73 22 7d 2c 61 72 72 61 79 3a 7b 74 79 70 65 3a 22 61 72 72 61 79 22 2c 65 72 72 6f 72 3a 22 7b 70 7d 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 77 69 74 68 20 31 2b 20 65 6c 65 6d 65 6e 74 73 22 7d 2c 6f 62 6a 65 63 74 3a 7b 74 79 70 65 3a 22 6f 62 6a 65 63 74 22 2c 65 72 72 6f 72 3a 22 7b 70 7d 20 6d 75 73 74 20 62 65 20 61 6e 20 6f 62 6a 65 63 74 20 77 69 74 68 20 31 2b 20 65 6c 65 6d 65 6e 74 73 22 7d 7d 3b 74 68 69 73 2e 6b 6e 6f 77 6e 50 61 72 61 6d 73 3d 7b 65 Data Ascii: ormat"},pid:{type:"pid"},"enum":{type:"enum",error:"{p} value must be one of the allowed values"},array:{type:"array",error:"{p} must be an array with 1+ elements"},object:{type:"object",error:"{p} must be an object with 1+ elements"}};this.knownParams={e
2024-10-24 10:32:21 UTC	6743	IN	Data Raw: 6f 77 65 64 21 3d 3d 21 30 3f 6e 2e 72 65 70 6c 61 63 65 28 74 68 69 73 2e 64 6f 6d 61 69 6e 2c 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 29 3a 6e 7d 3b 74 68 69 73 2e 69 73 41 64 53 74 6f 72 61 67 65 41 6c 6c 6f 77 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 28 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2e 56 65 72 3c 32 7c 7c 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 63 6f 6f 6b 69 65 41 6c 6c 6f 77 65 64 3d 3d 3d 21 31 7c 7c 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 63 6f 6e 73 65 6e 74 2e 65 6e 61 62 6c 65 64 3d 3d 3d 21 30 26 26 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 63 6f 6e 73 65 6e 74 2e 61 64 53 74 6f 72 61 67 65 41 6c 6c 6f 77 65 64 3d 3d 3d 21 31 7c 7c 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 74 63 66 2e Data Ascii: owed!==!0?n.replace(this.domain,this.domainCl):n};this.isAdStorageAllowed=function(){return!(this.beaconParams.Ver<2\|\|this.uetConfig.cookieAllowed===!1\|\|this.uetConfig.consent.enabled===!0&&this.uetConfig.consent.adStorageAllowed===!1\|\|this.uetConfig.tcf.
2024-10-24 10:32:21 UTC	8192	IN	Data Raw: 68 3e 31 26 26 6e 5b 30 5d 21 3d 3d 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 29 74 3d 6e 5b 30 5d 2c 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 6e 2c 31 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 75 65 74 4c 6f 61 64 65 64 7c 7c 74 68 69 73 2e 65 76 71 43 44 69 73 70 61 74 63 68 26 26 74 68 69 73 2e 70 72 6f 63 65 73 73 45 61 72 6c 79 5b 74 5d 3f 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 5f 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 3a 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 65 76 65 6e 74 50 75 73 68 51 75 65 75 65 2e 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 7d 3b 74 68 69 73 2e 5f 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 Data Ascii: h>1&&n[0]!==this.pageLoadEvt)t=n[0],i=Array.prototype.slice.call(n,1);else return;this.uetInstance.uetLoaded\|\|this.evqCDispatch&&this.processEarly[t]?this.uetInstance._push([t,i,r]):this.uetInstance.eventPushQueue.push([t,i,r])};this._push=function(n){var
2024-10-24 10:32:21 UTC	8192	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 26 26 28 75 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 2e 63 6f 6e 74 65 6e 74 2c 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 75 29 26 26 28 6e 2e 6b 77 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 69 2c 22 2c 22 29 29 29 2c 74 3f 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 50 61 67 65 29 26 26 21 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 72 22 29 26 26 28 6e 2e 72 3d 74 68 69 73 Data Ascii: getElementsByTagName("meta").keywords&&(u=window.document.head.getElementsByTagName("meta").keywords.content,this.stringExists(u)&&(n.kw=encodeURIComponent(u).replace(/%2C/gi,","))),t?this.stringExists(this.previousPage)&&!n.hasOwnProperty("r")&&(n.r=this
2024-10-24 10:32:22 UTC	8192	IN	Data Raw: 26 26 28 74 2e 70 72 6f 64 69 64 3d 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 22 29 3e 30 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 74 79 70 65 22 29 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 3d 6e 75 6c 6c 7c 7c 74 2e 70 61 67 65 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 28 29 3d 3d 3d 22 22 29 26 26 64 65 6c 65 74 65 20 74 2e 70 61 67 65 74 79 70 65 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 Data Ascii: &&(t.prodid=t.ecomm_prodid,delete t.ecomm_prodid);t.hasOwnProperty("ecomm_pagetype")>0&&(t.pagetype=t.ecomm_pagetype,delete t.ecomm_pagetype);t.hasOwnProperty("pagetype")&&(t.pagetype==null\|\|t.pagetype.toString()==="")&&delete t.pagetype;t.hasOwnProperty(
2024-10-24 10:32:22 UTC	8192	IN	Data Raw: 76 61 72 20 69 3d 74 68 69 73 2e 63 6c 6f 6e 65 28 6e 29 3b 72 65 74 75 72 6e 20 69 2e 61 6c 74 26 26 64 65 6c 65 74 65 20 69 2e 61 6c 74 2c 74 68 69 73 2e 63 6c 6f 6e 65 28 74 2c 69 29 7d 3b 74 68 69 73 2e 66 69 72 65 42 65 61 63 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 69 2c 73 2c 65 3d 74 68 69 73 2e 67 65 74 43 6c 55 72 6c 28 74 68 69 73 2e 75 72 6c 50 72 65 66 69 78 29 2c 74 3d 74 68 69 73 2e 63 6f 6d 62 69 6e 65 28 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2c 6e 29 2c 72 3d 74 68 69 73 2e 73 74 72 69 6e 67 69 66 79 54 6f 52 65 71 75 65 73 74 28 74 29 2c 66 3d 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 28 65 2b 72 29 2c 6f 3d 5b 22 72 22 2c 22 65 6c 32 22 2c 22 65 63 32 22 2c 22 65 61 32 22 Data Ascii: var i=this.clone(n);return i.alt&&delete i.alt,this.clone(t,i)};this.fireBeacon=function(n){for(var i,s,e=this.getClUrl(this.urlPrefix),t=this.combine(this.beaconParams,n),r=this.stringifyToRequest(t),f=this.removeTrailingAmp(e+r),o=["r","el2","ec2","ea2"
2024-10-24 10:32:22 UTC	2609	IN	Data Raw: 6f 6d 6d 5f 74 6f 74 61 6c 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 55 61 73 50 72 6f 64 75 63 74 73 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 61 5f 65 22 3a 74 68 69 73 2e 6d 61 70 47 74 6d 45 63 6f 6d 6d 65 72 63 65 50 75 72 63 68 61 73 65 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 61 34 22 3a 74 68 69 73 2e 72 65 70 6c 61 63 65 47 74 6d 50 61 72 61 6d 28 6e 2c 22 76 61 6c 75 65 22 2c 22 65 76 65 6e 74 5f 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 47 61 34 49 74 65 6d 73 28 6e 29 7d 72 65 74 75 72 6e 20 6e 7d 3b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 55 72 6c 43 68 61 6e 67 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d Data Ascii: omm_totalvalue");this.mapGtmUasProducts(n);break;case"ua_e":this.mapGtmEcommercePurchase(n);break;case"ga4":this.replaceGtmParam(n,"value","event_value");this.mapGtmGa4Items(n)}return n};var t=window.location.href;this.documentUrlChanged=function(){var n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49783	150.171.28.10	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:22 UTC	528	OUT	GET /p/action/5441611.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:23 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 369 Content-Type: application/javascript; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 090068B48CA141B49510CA49BF7622CD Ref B: DFW311000106045 Ref C: 2024-10-24T10:32:22Z Date: Thu, 24 Oct 2024 10:32:22 GMT Connection: close
2024-10-24 10:32:23 UTC	369	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 63 2c 6b 2c 61 2c 62 2c 74 2c 65 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 63 73 20 3d 20 64 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 0d 0a 20 20 20 20 69 66 20 28 63 73 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 75 6f 20 3d 20 63 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 75 65 74 6f 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 6f 20 26 26 20 77 5b 75 6f 5d 20 26 26 20 74 79 70 65 6f 66 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 28 7b 27 63 6f 27 3a 20 63 2c 20 27 6b 63 27 3a 20 6b 2c 20 27 61 74 27 3a Data Ascii: (function(w,d,c,k,a,b,t,e) { var cs = d.currentScript; if (cs) { var uo = cs.getAttribute('data-ueto'); if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') { w[uo].setUserSignals({'co': c, 'kc': k, 'at':

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49784	150.171.29.10	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:22 UTC	342	OUT	GET /bat.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:23 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 51385 Content-Type: application/javascript Last-Modified: Wed, 16 Oct 2024 22:47:44 GMT Accept-Ranges: bytes ETag: "028e0691d20db1:0" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 45325D16573F45E2B9C83E316345BE3C Ref B: SN4AA2022403035 Ref C: 2024-10-24T10:32:22Z Date: Thu, 24 Oct 2024 10:32:22 GMT Connection: close
2024-10-24 10:32:23 UTC	3375	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 55 45 54 28 6f 29 7b 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 7d 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 3d 22 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 22 3b 74 68 69 73 2e 64 6f 6d 61 69 6e 43 6c 3d 22 62 61 74 2e 62 69 6e 67 2e 6e 65 74 22 3b 74 68 69 73 2e 55 52 4c 4c 45 4e 47 54 48 4c 49 4d 49 54 3d 34 30 39 36 3b 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 3d 22 70 61 67 65 4c 6f 61 64 22 3b 74 68 69 73 2e 63 75 73 74 6f 6d 45 76 74 3d 22 63 75 73 74 6f 6d 22 3b 74 68 69 73 2e 70 61 67 65 56 69 65 77 45 76 74 3d 22 70 61 67 65 5f 76 69 65 77 22 3b 6f 2e 56 65 72 3d 6f 2e 56 65 72 21 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 Data Ascii: function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&
2024-10-24 10:32:23 UTC	8192	IN	Data Raw: 2c 22 70 72 6f 6d 6f 74 69 6f 6e 73 2e 6e 61 6d 65 22 3a 7b 7d 2c 70 69 64 3a 7b 74 79 70 65 3a 22 6f 62 6a 65 63 74 22 7d 2c 22 70 69 64 2e 65 6d 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 7d 2c 22 70 69 64 2e 65 6d 61 69 6c 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 2c 62 65 61 63 6f 6e 3a 22 65 6d 22 7d 2c 22 70 69 64 2e 70 68 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 7d 2c 22 70 69 64 2e 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 22 3a 7b 74 79 70 65 3a 22 70 69 64 22 2c 62 65 61 63 6f 6e 3a 22 70 68 22 7d 7d 3b 74 68 69 73 2e 6b 6e 6f 77 6e 45 76 65 6e 74 73 3d 7b 61 64 64 5f 70 61 79 6d 65 6e 74 5f 69 6e 66 6f 3a 5b 5d 2c 61 64 64 5f 74 6f 5f 63 61 72 74 3a 5b 22 72 65 76 65 6e 75 65 5f 76 61 6c 75 65 22 2c 22 63 75 72 72 65 6e 63 79 22 2c 22 69 74 65 6d 73 22 5d 2c Data Ascii: ,"promotions.name":{},pid:{type:"object"},"pid.em":{type:"pid"},"pid.email":{type:"pid",beacon:"em"},"pid.ph":{type:"pid"},"pid.phone_number":{type:"pid",beacon:"ph"}};this.knownEvents={add_payment_info:[],add_to_cart:["revenue_value","currency","items"],
2024-10-24 10:32:23 UTC	4441	IN	Data Raw: 73 2e 75 65 74 43 6f 6e 66 69 67 2e 75 69 64 43 6f 6f 6b 69 65 3d 6f 2e 75 69 64 43 6f 6f 6b 69 65 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 67 74 6d 54 61 67 53 6f 75 72 63 65 3d 75 6e 64 65 66 69 6e 65 64 3b 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 67 74 6d 54 61 67 53 6f 75 72 63 65 22 29 26 26 6f 2e 67 74 6d 54 61 67 53 6f 75 72 63 65 26 26 74 79 70 65 6f 66 20 6f 2e 67 74 6d 54 61 67 53 6f 75 72 63 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 28 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 67 74 6d 54 61 67 53 6f 75 72 63 65 3d 6f 2e 67 74 6d 54 61 67 53 6f 75 72 63 65 29 3b 74 68 69 73 2e 75 65 74 43 6f 6e 66 69 67 2e 67 74 61 67 50 69 64 3d 21 31 3b 6f 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 50 69 64 22 29 26 Data Ascii: s.uetConfig.uidCookie=o.uidCookie);this.uetConfig.gtmTagSource=undefined;o.hasOwnProperty("gtmTagSource")&&o.gtmTagSource&&typeof o.gtmTagSource=="string"&&(this.uetConfig.gtmTagSource=o.gtmTagSource);this.uetConfig.gtagPid=!1;o.hasOwnProperty("pagePid")&
2024-10-24 10:32:23 UTC	8192	IN	Data Raw: 68 3e 31 26 26 6e 5b 30 5d 21 3d 3d 74 68 69 73 2e 70 61 67 65 4c 6f 61 64 45 76 74 29 74 3d 6e 5b 30 5d 2c 69 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 6e 2c 31 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 3b 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 75 65 74 4c 6f 61 64 65 64 7c 7c 74 68 69 73 2e 65 76 71 43 44 69 73 70 61 74 63 68 26 26 74 68 69 73 2e 70 72 6f 63 65 73 73 45 61 72 6c 79 5b 74 5d 3f 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 5f 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 3a 74 68 69 73 2e 75 65 74 49 6e 73 74 61 6e 63 65 2e 65 76 65 6e 74 50 75 73 68 51 75 65 75 65 2e 70 75 73 68 28 5b 74 2c 69 2c 72 5d 29 7d 3b 74 68 69 73 2e 5f 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 Data Ascii: h>1&&n[0]!==this.pageLoadEvt)t=n[0],i=Array.prototype.slice.call(n,1);else return;this.uetInstance.uetLoaded\|\|this.evqCDispatch&&this.processEarly[t]?this.uetInstance._push([t,i,r]):this.uetInstance.eventPushQueue.push([t,i,r])};this._push=function(n){var
2024-10-24 10:32:23 UTC	8192	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 26 26 28 75 3d 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6d 65 74 61 22 29 2e 6b 65 79 77 6f 72 64 73 2e 63 6f 6e 74 65 6e 74 2c 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 75 29 26 26 28 6e 2e 6b 77 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 29 2e 72 65 70 6c 61 63 65 28 2f 25 32 43 2f 67 69 2c 22 2c 22 29 29 29 2c 74 3f 74 68 69 73 2e 73 74 72 69 6e 67 45 78 69 73 74 73 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 50 61 67 65 29 26 26 21 6e 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 72 22 29 26 26 28 6e 2e 72 3d 74 68 69 73 Data Ascii: getElementsByTagName("meta").keywords&&(u=window.document.head.getElementsByTagName("meta").keywords.content,this.stringExists(u)&&(n.kw=encodeURIComponent(u).replace(/%2C/gi,","))),t?this.stringExists(this.previousPage)&&!n.hasOwnProperty("r")&&(n.r=this
2024-10-24 10:32:23 UTC	8192	IN	Data Raw: 26 26 28 74 2e 70 72 6f 64 69 64 3d 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 72 6f 64 69 64 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 22 29 3e 30 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 2c 64 65 6c 65 74 65 20 74 2e 65 63 6f 6d 6d 5f 70 61 67 65 74 79 70 65 29 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 70 61 67 65 74 79 70 65 22 29 26 26 28 74 2e 70 61 67 65 74 79 70 65 3d 3d 6e 75 6c 6c 7c 7c 74 2e 70 61 67 65 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 28 29 3d 3d 3d 22 22 29 26 26 64 65 6c 65 74 65 20 74 2e 70 61 67 65 74 79 70 65 3b 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 Data Ascii: &&(t.prodid=t.ecomm_prodid,delete t.ecomm_prodid);t.hasOwnProperty("ecomm_pagetype")>0&&(t.pagetype=t.ecomm_pagetype,delete t.ecomm_pagetype);t.hasOwnProperty("pagetype")&&(t.pagetype==null\|\|t.pagetype.toString()==="")&&delete t.pagetype;t.hasOwnProperty(
2024-10-24 10:32:23 UTC	8192	IN	Data Raw: 76 61 72 20 69 3d 74 68 69 73 2e 63 6c 6f 6e 65 28 6e 29 3b 72 65 74 75 72 6e 20 69 2e 61 6c 74 26 26 64 65 6c 65 74 65 20 69 2e 61 6c 74 2c 74 68 69 73 2e 63 6c 6f 6e 65 28 74 2c 69 29 7d 3b 74 68 69 73 2e 66 69 72 65 42 65 61 63 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 69 2c 73 2c 65 3d 74 68 69 73 2e 67 65 74 43 6c 55 72 6c 28 74 68 69 73 2e 75 72 6c 50 72 65 66 69 78 29 2c 74 3d 74 68 69 73 2e 63 6f 6d 62 69 6e 65 28 74 68 69 73 2e 62 65 61 63 6f 6e 50 61 72 61 6d 73 2c 6e 29 2c 72 3d 74 68 69 73 2e 73 74 72 69 6e 67 69 66 79 54 6f 52 65 71 75 65 73 74 28 74 29 2c 66 3d 74 68 69 73 2e 72 65 6d 6f 76 65 54 72 61 69 6c 69 6e 67 41 6d 70 28 65 2b 72 29 2c 6f 3d 5b 22 72 22 2c 22 65 6c 32 22 2c 22 65 63 32 22 2c 22 65 61 32 22 Data Ascii: var i=this.clone(n);return i.alt&&delete i.alt,this.clone(t,i)};this.fireBeacon=function(n){for(var i,s,e=this.getClUrl(this.urlPrefix),t=this.combine(this.beaconParams,n),r=this.stringifyToRequest(t),f=this.removeTrailingAmp(e+r),o=["r","el2","ec2","ea2"
2024-10-24 10:32:23 UTC	2609	IN	Data Raw: 6f 6d 6d 5f 74 6f 74 61 6c 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 55 61 73 50 72 6f 64 75 63 74 73 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 75 61 5f 65 22 3a 74 68 69 73 2e 6d 61 70 47 74 6d 45 63 6f 6d 6d 65 72 63 65 50 75 72 63 68 61 73 65 28 6e 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 67 61 34 22 3a 74 68 69 73 2e 72 65 70 6c 61 63 65 47 74 6d 50 61 72 61 6d 28 6e 2c 22 76 61 6c 75 65 22 2c 22 65 76 65 6e 74 5f 76 61 6c 75 65 22 29 3b 74 68 69 73 2e 6d 61 70 47 74 6d 47 61 34 49 74 65 6d 73 28 6e 29 7d 72 65 74 75 72 6e 20 6e 7d 3b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 55 72 6c 43 68 61 6e 67 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d Data Ascii: omm_totalvalue");this.mapGtmUasProducts(n);break;case"ua_e":this.mapGtmEcommercePurchase(n);break;case"ga4":this.replaceGtmParam(n,"value","event_value");this.mapGtmGa4Items(n)}return n};var t=window.location.href;this.documentUrlChanged=function(){var n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49786	150.171.28.10	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:24 UTC	939	OUT	GET /action/0?ti=5441611&Ver=2&mid=8c334c8f-32ac-4c88-b600-ee9d8553bcf6&bo=1&sid=40e9d39091f311ef95348b02c946a95b&vid=40ea030091f311ef84760da8773eaf28&vids=1&msclkid=N&uach=pv%3D10.0.0&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Norton%20-%20My%20Subscription&p=https%3A%2F%2Fmy.norton.com%2Fextspa%2Fllonboard%2Fidv%2Fform2&r=&lt=8208&evt=pageLoad&sv=1&cdb=AQAQ&rn=227139 HTTP/1.1 Host: bat.bing.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://my.norton.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:24 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=2A1E2B7BDB746C6C05913E59DA7C6D78; domain=.bing.com; expires=Tue, 18-Nov-2025 10:32:24 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=bat.bing.com; expires=Thu, 31-Oct-2024 10:32:24 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 20FEDE481E8B420FB1DCC1202AF17793 Ref B: DFW30EDGE1816 Ref C: 2024-10-24T10:32:24Z Date: Thu, 24 Oct 2024 10:32:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49785	150.171.29.10	443	6868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 10:32:24 UTC	355	OUT	GET /p/action/5441611.js HTTP/1.1 Host: bat.bing.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 10:32:24 UTC	572	IN	HTTP/1.1 200 OK Cache-Control: private,max-age=1800 Content-Length: 369 Content-Type: application/javascript; charset=utf-8 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8228133B8F734802B4473502046C8A07 Ref B: SN4AA2022405049 Ref C: 2024-10-24T10:32:24Z Date: Thu, 24 Oct 2024 10:32:23 GMT Connection: close
2024-10-24 10:32:24 UTC	369	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 63 2c 6b 2c 61 2c 62 2c 74 2c 65 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 63 73 20 3d 20 64 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 0d 0a 20 20 20 20 69 66 20 28 63 73 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 75 6f 20 3d 20 63 73 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 75 65 74 6f 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 75 6f 20 26 26 20 77 5b 75 6f 5d 20 26 26 20 74 79 70 65 6f 66 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 5b 75 6f 5d 2e 73 65 74 55 73 65 72 53 69 67 6e 61 6c 73 28 7b 27 63 6f 27 3a 20 63 2c 20 27 6b 63 27 3a 20 6b 2c 20 27 61 74 27 3a Data Ascii: (function(w,d,c,k,a,b,t,e) { var cs = d.currentScript; if (cs) { var uo = cs.getAttribute('data-ueto'); if (uo && w[uo] && typeof w[uo].setUserSignals === 'function') { w[uo].setUserSignals({'co': c, 'kc': k, 'at':

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5464, Parent PID: 1300

General

Target ID:	0
Start time:	06:32:01
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6868, Parent PID: 5464

General

Target ID:	2
Start time:	06:32:03
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,4355322394269608029,16993460720195172481,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6360, Parent PID: 1300

General

Target ID:	3
Start time:	06:32:05
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://my.norton.com/extspa/llonboard/idv/form2"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://my.norton.com/extspa/llonboard/idv/form2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Windows Analysis Report
https://my.norton.com/extspa/llonboard/idv/form2