Edit tour

Windows Analysis Report
https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/

Overview

General Information

Sample URL:	https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Analysis ID:	1427877
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,2780004439923109171,16103955136008577627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="author".. found
Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="author".. found
Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="author".. found

Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="copyright".. found
Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="copyright".. found
Source: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.253.34
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: global traffic	HTTP traffic detected: GET /gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/ HTTP/1.1Host: dickssportinggoods.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notice?domain=blackhawk-cashstar.com&c=teconsent&js=nj&noticeType=bb&text=true&gtm=1 HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c0.css HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /recipient-experience/static/js/concat/client.js HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /media/images/DICKS/DICKS.png HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://s3static.cashstar.com/media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c0.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=a37c HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset/notice.js/v/v1.7-3185 HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dickssportinggoods.cashstar.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recipient-experience/static/js/iovationBB.js HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /media/webfont/DICKS.json HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://dickssportinggoods.cashstar.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snare.js HTTP/1.1Host: mpsnare.iesnare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=a37c HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.2006570593677508&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/webfont/DICKS.json HTTP/1.1Host: s3static.cashstar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /media/images/DICKS/DICKS.png HTTP/1.1Host: s3static.cashstar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /script/logo.js HTTP/1.1Host: mpsnare.iesnare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.2006570593677508&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2 HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dickssportinggoods.cashstar.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://s3static.cashstar.com/media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/images/DICKS/favicon.ico HTTP/1.1Host: s3static.cashstar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20= HTTP/1.1Host: ht.blackhawknetwork.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/images/DICKS/favicon.ico HTTP/1.1Host: s3static.cashstar.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1Cx3NFWRXNwfr1r&MD=x6RZyozK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1Cx3NFWRXNwfr1r&MD=x6RZyozK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=6e38 HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.13047567448616437&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1Host: consent.trustarc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /snare.js HTTP/1.1Host: mpsnare.iesnare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=
Source: global traffic	HTTP traffic detected: GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=6e38 HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.13047567448616437&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1Host: consent.trustarc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20= HTTP/1.1Host: ht.blackhawknetwork.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: dickssportinggoods.cashstar.com

Source: unknown

HTTP traffic detected: POST /gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/ HTTP/1.1Host: dickssportinggoods.cashstar.comConnection: keep-aliveContent-Length: 1703Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://dickssportinggoods.cashstar.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://dickssportinggoods.cashstar.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: csrftoken=1rBlDrTaOJdqOPfof7ZoC8pkIiwCDA1C3e4Oc0mE1y7yLvF4MiyMyNyQshP6Oxh5; rexsessionid=6ue59m5mhae1a2w5tpdt8ji989zmiksc; datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G; TAsessionID=e58a22a8-87de-4dc3-94bc-522b41d24f38|NEW; notice_behavior=implied,us

Source: chromecache_84.1.dr	String found in binary or memory: http://consent-pref.trustarc.com/?type=blackhawk_cashstar_v11&layout=gdpr
Source: chromecache_84.1.dr	String found in binary or memory: http://consent.trustarc.com/noticemsg?
Source: chromecache_84.1.dr	String found in binary or memory: https://api-js-log.trustarc.com/error
Source: chromecache_84.1.dr	String found in binary or memory: https://consent.trustarc.com/
Source: chromecache_84.1.dr	String found in binary or memory: https://consent.trustarc.com/bannermsg?
Source: chromecache_84.1.dr	String found in binary or memory: https://consent.trustarc.com/get?name=bh-close-icon.svg
Source: chromecache_84.1.dr	String found in binary or memory: https://consent.trustarc.com/log
Source: chromecache_80.1.dr	String found in binary or memory: https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Source: chromecache_89.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_80.1.dr	String found in binary or memory: https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jpg
Source: chromecache_80.1.dr	String found in binary or memory: https://ht.blackhawknetwork.com/assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20sc
Source: chromecache_86.1.dr	String found in binary or memory: https://ht.blackhawknetwork.com/assets/images/logo.png?l=$
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/media/images/DICKS/android-chrome-192x192.png
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/media/images/DICKS/apple-touch-icon-152x152.png
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/media/images/DICKS/favicon.ico
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/recipient-experience/static/
Source: chromecache_80.1.dr	String found in binary or memory: https://s3static.cashstar.com/recipient-experience/static/js/concat/client.js

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.253.34:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@14/39@26/14

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,2780004439923109171,16103955136008577627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,2780004439923109171,16103955136008577627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://mpsnare.iesnare.com/script/logo.js	0%	Virustotal		Browse
https://mpsnare.iesnare.com/snare.js	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d-52ccktk4i3.execute-api.us-east-2.amazonaws.com	3.22.134.95	true	false	high
wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com	52.42.97.191	true	false	high
www.google.com	74.125.138.147	true	false	high
wdpthird-pr-0d2f5ae6feef9df0.elb.us-east-1.amazonaws.com	23.21.145.8	true	false	high
cashstar.map.fastly.net	151.101.0.138	true	false	unknown
prod.cashstar-et.map.fastly.net	151.101.1.24	true	false	unknown
consent.trustarc.com	3.161.150.4	true	false	high
ht.blackhawknetwork.com	unknown	unknown	false	high
s3static.cashstar.com	unknown	unknown	false	high
mpsnare.iesnare.com	unknown	unknown	false	unknown
dickssportinggoods.cashstar.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://consent.trustarc.com/asset/notice.js/v/v1.7-3185	false		high
https://consent.trustarc.com/log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=6e38	false		high
https://s3static.cashstar.com/media/images/DICKS/DICKS.png	false		high
https://mpsnare.iesnare.com/script/logo.js	false	0%, Virustotal, Browse	unknown
https://consent.trustarc.com/log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=a37c	false		high
https://consent.trustarc.com/bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.13047567448616437&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW	false		high
https://s3static.cashstar.com/media/images/DICKS/favicon.ico	false		high
https://consent.trustarc.com/notice?domain=blackhawk-cashstar.com&c=teconsent&js=nj&noticeType=bb&text=true&gtm=1	false		high
https://mpsnare.iesnare.com/snare.js	false	0%, Virustotal, Browse	unknown
https://s3static.cashstar.com/media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2	false		high
https://s3static.cashstar.com/media/webfont/DICKS.json	false		high
https://ht.blackhawknetwork.com/assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20=	false		high
https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/	false		high
https://s3static.cashstar.com/media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css	false		high
https://consent.trustarc.com/bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.2006570593677508&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://consent.trustarc.com/	chromecache_84.1.dr	false	high
https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jpg	chromecache_80.1.dr	false	high
http://consent.trustarc.com/noticemsg?	chromecache_84.1.dr	false	high
https://s3static.cashstar.com/media/images/DICKS/apple-touch-icon-152x152.png	chromecache_80.1.dr	false	high
https://consent.trustarc.com/bannermsg?	chromecache_84.1.dr	false	high
http://consent-pref.trustarc.com/?type=blackhawk_cashstar_v11&layout=gdpr	chromecache_84.1.dr	false	high
https://ht.blackhawknetwork.com/assets/images/logo.png?l=$	chromecache_86.1.dr	false	high
https://ht.blackhawknetwork.com/assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20sc	chromecache_80.1.dr	false	high
https://feross.org	chromecache_89.1.dr	false	high
https://api-js-log.trustarc.com/error	chromecache_84.1.dr	false	high
https://consent.trustarc.com/get?name=bh-close-icon.svg	chromecache_84.1.dr	false	high
https://consent.trustarc.com/log	chromecache_84.1.dr	false	high
https://s3static.cashstar.com/media/images/DICKS/android-chrome-192x192.png	chromecache_80.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.147	www.google.com	United States	15169	GOOGLEUS	false
3.161.150.4	consent.trustarc.com	United States	16509	AMAZON-02US	false
3.161.150.100	unknown	United States	16509	AMAZON-02US	false
151.101.1.24	prod.cashstar-et.map.fastly.net	United States	54113	FASTLYUS	false
151.101.0.138	cashstar.map.fastly.net	United States	54113	FASTLYUS	false
3.136.252.66	unknown	United States	16509	AMAZON-02US	false
3.161.150.25	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.21.145.8	wdpthird-pr-0d2f5ae6feef9df0.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
3.22.134.95	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
52.42.97.191	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16
192.168.2.13
192.168.2.14

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427877
Start date and time:	2024-04-18 09:45:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@14/39@26/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.185.94, 173.194.219.84, 172.217.215.100, 172.217.215.102, 172.217.215.138, 172.217.215.101, 172.217.215.113, 172.217.215.139, 34.104.35.123, 173.194.219.95, 142.251.15.95, 108.177.122.95, 74.125.136.95, 172.253.124.95, 64.233.177.95, 64.233.176.95, 142.250.9.95, 64.233.185.95, 142.250.105.95, 74.125.138.95, 172.217.215.95, 142.250.105.94, 64.233.185.138, 64.233.185.102, 64.233.185.113, 64.233.185.101, 64.233.185.100, 64.233.185.139, 173.194.219.139, 173.194.219.138, 173.194.219.100, 173.194.219.113, 173.194.219.102, 173.194.219.101, 142.250.9.102, 142.250.9.101, 142.250.9.138, 142.250.9.139, 142.250.9.100, 142.250.9.113
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, redirector.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 06:46:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991165713142043
Encrypted:	false
SSDEEP:	48:8KdzT73YHb3cidAKZdA1FehwiZUklqeh3y+3:8yX8C8y
MD5:	F14C3F13FE49704AA8CEBB2E12700418
SHA1:	353F37DF703A10280F02DDF65462F295B4D6BDBA
SHA-256:	C8616BA899A871AE3A69240B0EAE93C6FF9E3A74AFDDF6B62E9611388558872E
SHA-512:	65FD372E59FA17DDACC5CE1AB749F6AC3714695F835265293D3F18FE90E1F769F61CBE6A034D504B06BB116DBECEC14A23ACAA678AA7068986B75802253805BF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....} ..d...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 06:46:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005184774834301
Encrypted:	false
SSDEEP:	48:8OdzT73YHb3cidAKZdA1seh/iZUkAQkqehsy+2:8uX8c9Qly
MD5:	D373022BA1A616CCAAACDE12FF9DADCF
SHA1:	DBB19939121596906FC3DE60426CB836C02D65D8
SHA-256:	47F4FD0A8F5F31A39BF1B65CFE61F5BDBF4E6D278D247D3AD25D9DE37A5BE411
SHA-512:	8FB75F89FAD7EA724ADE2C0DE1B25AD3AF81079FC7D5316FC39CED6C70E3BCEA5A506AB90FD4AD66BC67CBB14B6590FE9E03355BEE88B9B9355E2C466D8101C2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....1O..d...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.014110277978799
Encrypted:	false
SSDEEP:	48:83dzT73AHb3cidAKZdA14meh7sFiZUkmgqeh7syy+BX:8BXUAngy
MD5:	1B9955F88DCF01BF01F511F3543447E4
SHA1:	941A3A10D49309E5FEC3DC1E62FD69FC7A14EAFB
SHA-256:	52BBE98B724B41E3F2FD09A9688E64F943E5EB4EE05CBB8F9E3B064849632094
SHA-512:	BC536AF4E970EE89FE622AEE78685E0EAD574072A4D2969E698D1407C9B673E7894BDBEDF5DA2C0F077F12293370EB495E63DE70C7E23510659B90EC25AB24BC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 06:46:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005468986530997
Encrypted:	false
SSDEEP:	48:8bdzT73YHb3cidAKZdA1TehDiZUkwqeh4y+R:89X83Ky
MD5:	0D431583403693D95B3C9DAFC865441E
SHA1:	E6680EF7615D7916F3C377FE5004BBEF8D7D684E
SHA-256:	CC5CB83F4856770AECE2010415E5590A989CA8ACE1ECEAE08A96375A6F1B7EA6
SHA-512:	8AB417DBD29595048A35773352D709BAD05B59A329FFB663F2136AEA4F9631617231F821F178FD0F2935F8005A426F15B7549E817A1D2D9203F518B6ECC8760E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........d...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 06:46:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.995517881586173
Encrypted:	false
SSDEEP:	48:8SdzT73YHb3cidAKZdA1dehBiZUk1W1qehmy+C:86X8n9Gy
MD5:	054255B846251B5D265FD725223BB0D1
SHA1:	6CEAA6C30AA0C053ED6E988F624BEC87DFC1F252
SHA-256:	1F230792B7C3A9EC4FA3A3824957CC726D7C84409A80EDAE784FD483EBEBEAA9
SHA-512:	678205FD7C0306B2BD9576FC2F0F88C8688129F6491F81EB64D00A0B147EF21A08A3ECD523C2C2231F4B3B2CB15F9AEB07C85F26413F30A86ED765019348476F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........d...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 06:46:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.004030550618465
Encrypted:	false
SSDEEP:	48:8bdzT73YHb3cidAKZdA1duTeehOuTbbiZUk5OjqehOuTbgy+yT+:89X8LTfTbxWOvTbgy7T
MD5:	B3844062A60FD0F4996AAF0B6DB77534
SHA1:	A4897A3FA31CDC24FC582741A1258DE433775999
SHA-256:	66E30EE1F908570A704BE34DDB0C756C21FEC66F9598AF335BF6C71271913F93
SHA-512:	0C116A66ED938B48F6971ACDBA5D6D32AC5997E0867F540B744632A7817A01F44552E1FDF30BFA06656AEDDE45865CAF11663CA61A49ECFA285292E4D54AA221
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....2...d...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.=....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1810)
Category:	downloaded
Size (bytes):	94379
Entropy (8bit):	5.297413209420254
Encrypted:	false
SSDEEP:	1536:+OkrkzhoXdEOMGBKEbA75CKxBK4Ca1z3eol+6F5WcQStmvbyF06:+4iETGBKi0BKTaxeofu6
MD5:	FD4C6774C4375AF26D9D3052B630294E
SHA1:	11275B2C3C04CCBA7F38ABA7E84850C97CAC3075
SHA-256:	7904D8846E66F0C538335E696B4E06FE1D1D10F8856E275316D409EFDA45EAD9
SHA-512:	9D6F053AF487C11FFE97C1654B67F995DEA2B76F954E200FF1B36FFE690499816F71D1DD5A942280F60A89A5B91AB3BC775E4B80C983BDDC1265C876190E4661
Malicious:	false
Reputation:	low
URL:	https://consent.trustarc.com/asset/notice.js/v/v1.7-3185
Preview:	function _truste_eu(){function t(){var g=truste.eu.bindMap;g.feat.isConsentRetrieved=g.feat.crossDomain?g.feat.isConsentRetrieved:!0;if(!t.done&&truste.util.isConsentResolved()){t.done=!0;var k=function(){var a=(new Date).getTime(),c=truste.util.readCookie(truste.eu.COOKIE_REPOP,!0),d=truste.eu.bindMap.popTime;return d&&d!=c&&a>=d}();k&&(g.feat.dropPopCookie=!0);truste.eu.ccpa.initialize();truste.eu.gpp.initialize();truste.eu.gpcDntAutoOptOut();truste.eu.gcm();var a=function(){var a=truste.eu.bindMap;.if(a.feat.consentResolution){var c=truste.util.readCookie(truste.eu.COOKIE_GDPR_PREF_NAME,!0);if(c&&(c=c.split(":"),!RegExp(a.behavior+"."+a.behaviorManager).test(c[2])&&(/(,us\|none)/i.test(c[2])\|\|"eu"==a.behaviorManager&&/implied.eu/i.test(c[2]))))return!0}return!1};truste.util.fireCustomEvent("truste-cookie",g.prefCookie);truste.eu.isGPCDNTEvent()?g.feat.dntShowUI&&"expressed"==g.behavior&&truste.util.executeOnCondition(function(){return g.prefCookie\|\|g.feat.gpp.gppApplies&&null==truste

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (12682)
Category:	downloaded
Size (bytes):	28069
Entropy (8bit):	5.643931463972625
Encrypted:	false
SSDEEP:	384:yDYS/9N4Mf/pIDG1SRu3tia53/ptHboMwUQCI/h1m7NfgQjdFojQAYKH3n6qtIR7:yMDDG10a53/fboMwUQC021A7nNtIRZbp
MD5:	83C60B8BA9DC299E1F56F76B7268054C
SHA1:	80CADEE900A6A7E790E3C234AA821D0F247F472F
SHA-256:	F4F3FA402B01F0B997341B6BAE614B0F63B7A4FBD4A7BEF1E93DCA2CDE23D28B
SHA-512:	1EF181D2D9C7FEF12EED6DD6E85F9D8C450D0F789F93A867A6A1A00F328236BA8F98455FAC6604B10021DF1DE92D51B76991817516D624CAE2FFB56FF68B5A0A
Malicious:	false
Reputation:	low
URL:	https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Preview:	.<!doctype html>.<html lang="en-us">.<head>. <meta charset="utf-8">.. . . <meta name="robots" content="noindex, nofollow">. .. <meta name="viewport" content="width=device-width,initial-scale=1">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name="format-detection" content="telephone=no">. <title>DICK'S Sporting Goods eGift Card </title>. <meta name="title" content="DICK'S Sporting Goods eGift Card">. <meta name="description" content="Click to view your DICK'S Sporting Goods eGift card!">.. . <link rel="image_src" href="https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jpg">. <meta property="og:type" content="website" />.. <meta property="og:title" content="DICK'S Sporting Goods eGift Card" />. <meta property="og:description" content="Click to view your DICK'S Sporting Goods eGift card!" />. <meta property="og:image" content="https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jp

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	67397
Entropy (8bit):	5.046826327227623
Encrypted:	false
SSDEEP:	384:koLnkewDblQ5HH8yS2GUm4R9zR679mO85fk3DmHy4BWjAtNIGIlF6rcfD0pyMWuE:komvlQlGOCVG3yuGAXRheGqijPJsB
MD5:	283FC50D899DDCF9172DD0EE61B019C0
SHA1:	03278E91E9DF680A1FC17A7964BBA8BB694C2304
SHA-256:	9583F2378FB3026FDDFD3E319AA075FEC7C9FDF6E906CE8221D78916452F3271
SHA-512:	E9573139C3AD99043B0DF9FE3DA171B80205BEE81D7A9CC7342E267ADB8D0989A65FD57D00A7D92004DE18138B00892D8A0EE32E2F9F35D0B038F0BCD645FA0A
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c0.css
Preview:	html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,header,nav,section{display:block}h1{font-size:2em;margin:.67em 0}figcaption,figure,main{display:block}figure{margin:1em 40px}hr{-webkit-box-sizing:content-box;box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent;-webkit-text-decoration-skip:objects}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:inherit}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}dfn{font-style:italic}mark{background-color:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}audio,video{display:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	downloaded
Size (bytes):	33310
Entropy (8bit):	2.8885582398241043
Encrypted:	false
SSDEEP:	96:eqClPbjjjjjjje+3JqdtSuv4dal3qg4IqzwTmy:RClPbjjjjjjje+3MdtSu423S07
MD5:	6959E85C8EF11925E3F909E7BD21E06F
SHA1:	8AEDA8E4543998AA3E3E169FA366C3DDDF18E1E6
SHA-256:	2CF0CC834261CA4628180723674DF450F88D811FE2431FC8344AE25A32A510F9
SHA-512:	6E8A021045B13490AF91C23C0124E6785C3ABC7CB236A0801CA3123F8F8C071AD1928508AC4EB540434C49C41D3ACF54E6CFBDEC38086A293E80CE266860B1D0
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/images/DICKS/favicon.ico
Preview:	............ .(...V......... .(...~... .... .(.......00.... .($......@@.... .(@...A..(....... ..... .........................Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..}.^.\|.a.\|.a.\|.a.t{X.M\..Te..Te..Te..Te..Te..Te..Te..Te..Te..Sd..........................M\..Te..Te..Te..Te..Te..Te..Te..Te..Sd............................k.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............s...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............................m.Te..Te..Te..Te..Te..Te..Te..Te..Sd..........................Te..Te..Te..Te..Te..Te..Te..Te..Te..Sd....k...m...m...m..._.Te

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	285
Entropy (8bit):	5.245719685351739
Encrypted:	false
SSDEEP:	6:0IFi2/rS1MwG7RATK/hRMwG7LCsgNl5Q6ZLKYg5+d:jFiQrBRbp4LVg7S6Zm4
MD5:	C844BCE31E7D2A9F3EAD4CFFCD8F4E93
SHA1:	6678185C92E0FA00093AF5A4DFD0AD1B312F70C6
SHA-256:	E26D25EBA3898E69D64A78BD28BB754CF3455A0395856D71282AC4C67405C94D
SHA-512:	F9858DAF5B01E528EE18539FCA5FF0173F05E60B2A378E0265F91FDB1A7E4FB36301DAE5C66B6C1E6DECD9C3FA9E4BB43BAFE223C6287216734BB6DDD087D5A6
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css
Preview:	@font-face {. font-family:'DSGSans-Black';. src:url(/media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2) format('woff2'),. url(/media/fonts/DICKS/DSGSans-Black-8d1c0ee4323c0b05a29fafc04a190c1c.woff) format('woff');. font-weight: normal;. font-style: normal;.}.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3566)
Category:	downloaded
Size (bytes):	30343
Entropy (8bit):	5.419413558725847
Encrypted:	false
SSDEEP:	768:6jL/4kGKqhccNlq0TTquye0YviFIDOQ3dTIYkX:S4jKQccNlq0TTquyVYGISQ3dTIYkX
MD5:	E2265210C574F45B11E6EAEECE6C3A79
SHA1:	6183556DFFF6AF31D217E4E0DA30ED34005F02C1
SHA-256:	9532B9724499DF120475833280C59BEAFD7614EED5833D8B94757233FA01B088
SHA-512:	EEB6B17317F58F01A19E578AC57D0FDA28FF4B1AE9A8209AF9E547232739A033A4FE5DC4667D795D605E3F1D5FC2449131AF774B9D266A64CC29DEF342224C2F
Malicious:	false
Reputation:	low
URL:	https://consent.trustarc.com/notice?domain=blackhawk-cashstar.com&c=teconsent&js=nj&noticeType=bb&text=true&gtm=1
Preview:	var truste=window.truste\|\|{};truste.bn\|\|(truste.bn={});truste.eu\|\|(truste.eu={});truste.util\|\|(truste.util={});.truste.util.error=function(h,d,g){g=g\|\|{};var f=d&&d.toString()\|\|"",c=g.caller\|\|"";if(d&&d.stack){f+="\n"+d.stack.match(/(@\|at)[^\n\r\t]/)[0]+"\n"+d.stack.match(/(@\|at)[^\n\r\t]$/)[0].}truste.util.trace(h,f,g);if(truste.util.debug\|\|!d&&!h){return}var a={apigwlambdaUrl:"https://api-js-log.trustarc.com/error",enableJsLog:false};.if(a.enableJsLog){delete g.caller;delete g.mod;delete g.domain;delete g.authority;g.msg=h;var e=new (self.XMLHttpRequest\|\|self.XDomainRequest\|\|self.ActiveXObject)("MSXML2.XMLHTTP.3.0");.e.open("POST",a.apigwlambdaUrl,true);e.setRequestHeader&&e.setRequestHeader("Content-type","application/json");.e.send(truste.util.getJSON({info:truste.util.getJSON(g)\|\|"",error:f,caller:c}))}};truste.util.trace=function(){if(self.console&&console.log&&(this.debug\|\|this.debug!==false&&(self.location.hostname.indexOf(".")<0\|\|self.location.hostname.indexOf(".truste-svc.n

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.300371940736518
Encrypted:	false
SSDEEP:	3:YGQWp2FMCchFLWHmvHWLQskx5YQR9MMWXRGDDGrNAFWH41:YGQ8XFicds2aQR2nRGfaZHy
MD5:	D87BB4B83CAF10A10C1843EF3F55334A
SHA1:	C04E74412AF54638B9BC7D82F0958DA04579BDD8
SHA-256:	A677DF4CD44D48EDEA3CF206CB69FDF11D8CA36A6440DC6605E4C8E5A3C69F31
SHA-512:	DF60275011D6DDFFAF23B83CC3217DD685E854BB53B644444C970A99FF3F886A1D4019D221DD0368F4A718D99921BF13325E8B2AD1925586B0C10E8684C1C1E1
Malicious:	false
Reputation:	low
Preview:	{"custom":{"families":["DSGSans-Black"],"urls":["<STATIC_MEDIA_URL>/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css"]}}

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (876), with no line terminators
Category:	downloaded
Size (bytes):	876
Entropy (8bit):	5.75876185080404
Encrypted:	false
SSDEEP:	12:FOxSmOp2uD3UrUflUEdt8FS4wy5vysEvm9syWE1CHZFNjETbXdrlANqEirqK+dR7:FO5TuD3mmiSbyE4KqCHtjOtruCmJ3X6W
MD5:	FC761B56CB247DB9E3A3E8B6BA470CAA
SHA1:	B2D47C5D8D725D7CB53FD6226F9AFC62070DC1CB
SHA-256:	443675EC85877E5C9E622D024615502E6BC0221684F030C98000CB11E523D029
SHA-512:	307038561BBCA9947B8259CA75E7787904931AD540BD3D9CBECE6A1EDF7CDB82485478E196E407F5FEB6568ED00B7FAA6A79660E633FBF68126C8A97F6F56B67
Malicious:	false
Reputation:	low
URL:	https://ht.blackhawknetwork.com/assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20=
Preview:	var x = atob("ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20=");var temp = location.host.split(".").reverse();var root_domain = temp[1] + "." + temp[0];var m = x.split(",").find(s => root_domain.includes(s) \|\| s.includes(root_domain));if(!m) {var l = encodeURI(location.href);var r = encodeURI(document.referrer);(new Image()).src = `https://ht.blackhawknetwork.com/assets/images/logo.png?l=${l}&r=${r}&d=${x}`}

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	5.523771844669832
Encrypted:	false
SSDEEP:	3:CehBVfL68dK32pRCy1qJRS/+ThABEQKpKMeY:CQjfL68dKaVqAMeY
MD5:	0B4F8B034711B9CB4FE1E0233FBA891F
SHA1:	6F475A6DDDF42E66EE8462BC4613DF710CCB0428
SHA-256:	0C2C0DD115651CF042A0A6E61EBCD26288EAF8D876A552C1F3618470161414DA
SHA-512:	66AFEC3492002322C8BB4391111F682E097A1CE86A77300E3B88B41B1B9D341237B75C8FDC1A0DE5811257D19AB85D04DF393E1B352D5888DFE43EA6DDC6CF2A
Malicious:	false
Reputation:	low
URL:	https://mpsnare.iesnare.com/script/logo.js
Preview:	if(io_dp){io_dp.CTOKEN="h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=";io_dp.updateBlackboxes();}

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	185
Entropy (8bit):	4.865412818722476
Encrypted:	false
SSDEEP:	3:qIYJ0i1LDJ0VEKOLEHJA6XMFJUEEmTFfQROtILWLMyDAIuR20gJYRnd7HnERyqG0:qIk0u0VvHJALJUEfT5gWBYbDRd7Hnxqv
MD5:	A1C911138CC758A5597D8CA9DCC074F5
SHA1:	E2D37576F7ACAEDC4C7E6FCF5BB8FE9F0B7E451E
SHA-256:	7302F6AF948B0D0F966F246BE140D0A792B82991C7D0D6134F27C3AE941B5F87
SHA-512:	2CD860C66B28C8ED63D4D93244AB9FFC329294356C938A038971586D93C346CEBF2BEA301C4321BB30A075B33A7C909E6B4598232509CE6CD587B7AA46BE91B3
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/recipient-experience/static/js/iovationBB.js
Preview:	var io_install_stm=!1,io_install_flash=!1,io_enable_rip=!0,io_bb_callback=function(){return function(i,n){if(n){const l=document.getElementById("iovation_blackbox");l&&(l.value=i)}}}();

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (37997)
Category:	downloaded
Size (bytes):	86743
Entropy (8bit):	5.274024532711555
Encrypted:	false
SSDEEP:	1536:4fb+FjkVsAKlzqQdhxN0uVTSFEeXmL5ud8xGrw7bHhMljY9ukoaXlGlnZa064Z1d:L3leQLxN0uGFT1Uzhl9ukoagbTbd
MD5:	18397F8FF7E15F5CC12FF827AD1B3C8B
SHA1:	5BFBD54468758A43776F95400CFCA36D0B4CAF46
SHA-256:	8B3EDB28636A694F205BEBAB79149F357121AB780970CE3A5ACDCAE22347C93C
SHA-512:	519A0824310C623CFF88913055C3C3AF46710003B367CBD0121B7CF7EB9C97CF476DCF9D2FA4430473ECF8A45A60D5CA3D4D2F5FD619631F6F071A82FE993277
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/recipient-experience/static/js/concat/client.js
Preview:	!function(e){function t(n){if(r[n])return r[n].exports;var o=r[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,t),o.l=!0,o.exports}var n=window.webpackJsonp;window.webpackJsonp=function(t,r,i){for(var a,c,s=0,u=[];s<t.length;s++)c=t[s],o[c]&&u.push(o[c][0]),o[c]=0;for(a in r)Object.prototype.hasOwnProperty.call(r,a)&&(e[a]=r[a]);for(n&&n(t,r,i);u.length;)u.shift()()};var r={},o={8:0};t.e=function(e){function n(){c.onerror=c.onload=null,clearTimeout(s);var t=o[e];0!==t&&(t&&t[1](new Error("Loading chunk "+e+" failed.")),o[e]=void 0)}var r=o[e];if(0===r)return new Promise(function(e){e()});if(r)return r[2];var i=new Promise(function(t,n){r=o[e]=[t,n]});r[2]=i;var a=document.getElementsByTagName("head")[0],c=document.createElement("script");c.type="text/javascript",c.charset="utf-8",c.async=!0,c.timeout=12e4,t.nc&&c.setAttribute("nonce",t.nc),c.src=t.p+""+({0:"DateTimeFormatTimezone",1:"Intl"}[e]\|\|e)+"-"+{0:"d7c0f4022ab4955902e3",1:"096374ed6f11db062bd3",2:"814f183c8782953

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38567), with no line terminators
Category:	downloaded
Size (bytes):	38567
Entropy (8bit):	5.364837414651875
Encrypted:	false
SSDEEP:	768:e/7uG76wrX9gpv5eIPnLPDQWdaJ2gRpI+PhynxMRWIKnubF7cJDL7mhmcN/sUw:U9ccRx5WxMRWbubF7cBymcN/lw
MD5:	E92BA0D2E308BF0F1AA7E4D8B03C0FBE
SHA1:	1240446F89EA95038FEB8230F6A88F84A319A9BD
SHA-256:	27EB1C5470249F0EC6A59CA232EF546529744863BA892243C4B830BD7CC49C43
SHA-512:	5C03F14A593DFEBE187E2DA0AB880A3BE56EF466A04C1E2682A6E12635B7A2C5C4FF8AEAE82DCB0944CE91AFC61929C5CBE701B375FAD35D53BDA9B2B2887346
Malicious:	false
Reputation:	low
URL:	https://mpsnare.iesnare.com/snare.js
Preview:	/* Copyright(c) 2016, iovation, inc. All rights reserved */ window.io_last_error="";var _i_a=(window.io_global_object_name\|\|"IGLOO"),localObjectName="io";window[_i_a]=(window[_i_a]\|\|{});window[_i_a][localObjectName]=(window[_i_a][localObjectName]\|\|{});function __if_a(_if_gp){window.io_last_error=_if_gp;}function __if_b(_if_gp,_if_gq){var _i_b=_if_gq.toString();if(_if_gq instanceof Error&&typeof(_if_gq.description)!='undefined')_i_b=_if_gq.description;window.io_last_error=_if_gp+" "+_i_b;}function __if_c(_if_gr,_i_gl){if(typeof(window.io_bbout_element_id)=="undefined"){__if_a("io_bbout_element_id is not defined");return;}var _i_c=_i_aa.getElementById(window.io_bbout_element_id);_i_c["value"]=_if_gr;}var _i_d={__if_o:function(_if_gs){return _if_gs.getUTCFullYear()+"/"+this.__if_ac((_if_gs.getUTCMonth()+1).toString(),2)+"/"+this.__if_ac(_if_gs.getUTCDate().toString(),2)+" "+this.__if_ac(_if_gs.getUTCHours().toString(),2)+":"+this.__if_ac(_if_gs.getUTCMinutes().toString(),2)+":"+this.__if_

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.300371940736518
Encrypted:	false
SSDEEP:	3:YGQWp2FMCchFLWHmvHWLQskx5YQR9MMWXRGDDGrNAFWH41:YGQ8XFicds2aQR2nRGfaZHy
MD5:	D87BB4B83CAF10A10C1843EF3F55334A
SHA1:	C04E74412AF54638B9BC7D82F0958DA04579BDD8
SHA-256:	A677DF4CD44D48EDEA3CF206CB69FDF11D8CA36A6440DC6605E4C8E5A3C69F31
SHA-512:	DF60275011D6DDFFAF23B83CC3217DD685E854BB53B644444C970A99FF3F886A1D4019D221DD0368F4A718D99921BF13325E8B2AD1925586B0C10E8684C1C1E1
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/webfont/DICKS.json
Preview:	{"custom":{"families":["DSGSans-Black"],"urls":["<STATIC_MEDIA_URL>/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css"]}}

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	33310
Entropy (8bit):	2.8885582398241043
Encrypted:	false
SSDEEP:	96:eqClPbjjjjjjje+3JqdtSuv4dal3qg4IqzwTmy:RClPbjjjjjjje+3MdtSu423S07
MD5:	6959E85C8EF11925E3F909E7BD21E06F
SHA1:	8AEDA8E4543998AA3E3E169FA366C3DDDF18E1E6
SHA-256:	2CF0CC834261CA4628180723674DF450F88D811FE2431FC8344AE25A32A510F9
SHA-512:	6E8A021045B13490AF91C23C0124E6785C3ABC7CB236A0801CA3123F8F8C071AD1928508AC4EB540434C49C41D3ACF54E6CFBDEC38086A293E80CE266860B1D0
Malicious:	false
Reputation:	low
Preview:	............ .(...V......... .(...~... .... .(.......00.... .($......@@.... .(@...A..(....... ..... .........................Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..Te..}.^.\|.a.\|.a.\|.a.t{X.M\..Te..Te..Te..Te..Te..Te..Te..Te..Te..Sd..........................M\..Te..Te..Te..Te..Te..Te..Te..Te..Sd............................k.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............t...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............s...~...........z.Te..Te..Te..Te..Te..Te..Te..Te..Sd............................m.Te..Te..Te..Te..Te..Te..Te..Te..Sd..........................Te..Te..Te..Te..Te..Te..Te..Te..Te..Sd....k...m...m...m..._.Te

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5616 x 720, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	160113
Entropy (8bit):	7.774179959672584
Encrypted:	false
SSDEEP:	3072:8+ZXNf4IAvoNdF3SigOIJoCahoRlsM7K0nKIdGfqw423hLRwGgZhoA/1:ldf9b6igOJCahYW/7fqw4W3wGgZ+Ad
MD5:	970205D9DBAE569E6B69A49D1B2459DC
SHA1:	A2ECD763DDA3E5BE3D0C4B8DE654EB889811F290
SHA-256:	2E08E90F82F3BA618E4EFCCC016C7A74D8A83FECA7320669D14C45133227C534
SHA-512:	2E8DD0A41EFB6A8A031712431843532F1CDF6400F26805D048CCA2FF054840336C6E62FDD006D111C88E2C63070D0E7984115301A2E4A6BE415DF175B94227C9
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/images/DICKS/DICKS.png
Preview:	.PNG........IHDR.............q......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.0 (Macintosh)" xmp:CreateDate="2024-01-12T11:39:31-05:00" xmp:ModifyDate="2024-01-12T12:21:40-05:00" xmp:MetadataDate="2024-01-12T12:21:40-05:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ca584bf9-f982-4211-afad-4705f75ab694" xmpMM:DocumentID="xmp.did:ca584bf9-f982-4211-afad-4705f75ab694" xmpMM:OriginalDocumentID="xmp.did:ca584bf9-f982-4

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 5616 x 720, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160113
Entropy (8bit):	7.774179959672584
Encrypted:	false
SSDEEP:	3072:8+ZXNf4IAvoNdF3SigOIJoCahoRlsM7K0nKIdGfqw423hLRwGgZhoA/1:ldf9b6igOJCahYW/7fqw4W3wGgZ+Ad
MD5:	970205D9DBAE569E6B69A49D1B2459DC
SHA1:	A2ECD763DDA3E5BE3D0C4B8DE654EB889811F290
SHA-256:	2E08E90F82F3BA618E4EFCCC016C7A74D8A83FECA7320669D14C45133227C534
SHA-512:	2E8DD0A41EFB6A8A031712431843532F1CDF6400F26805D048CCA2FF054840336C6E62FDD006D111C88E2C63070D0E7984115301A2E4A6BE415DF175B94227C9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............q......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 25.0 (Macintosh)" xmp:CreateDate="2024-01-12T11:39:31-05:00" xmp:ModifyDate="2024-01-12T12:21:40-05:00" xmp:MetadataDate="2024-01-12T12:21:40-05:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:ca584bf9-f982-4211-afad-4705f75ab694" xmpMM:DocumentID="xmp.did:ca584bf9-f982-4211-afad-4705f75ab694" xmpMM:OriginalDocumentID="xmp.did:ca584bf9-f982-4

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 14092, version 1.0
Category:	downloaded
Size (bytes):	14092
Entropy (8bit):	7.987597173814283
Encrypted:	false
SSDEEP:	384:b/LVVNLi9DmRU1M2GmlbN/7S8SOShQCH2n:tLO9DGU62G8bNjS8Txn
MD5:	73D994FC41CBF65F8414609D10B9ACCD
SHA1:	366C9FEC5B58AACF030932E52ADE6449DFEA1C56
SHA-256:	929F368D07D3DF469A0079BF33D46EED774422FFB8FE8DBA798014E2F1F88529
SHA-512:	114369C856D978848D8FD0BD899856A78A4EBFA61B109215578241A27CB3EF73FFA5AEDF66DF66EF61D34D7ED0C4CAEF466A9EA77BF9DBA1244D650A2D9267F5
Malicious:	false
Reputation:	low
URL:	https://s3static.cashstar.com/media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2
Preview:	wOF2......7........$..6.........................?FFTM...... ..B.`..&.....t..b.....6.$.... .....N...'............I..B.F9.......p.....J..E...o(:.....6.....(1....y.7N.&>..p.Q....uq.Dq+Z.].D.8.[Y........x........f2.....1.?\|..u.9...6.'9y...i...~.7.....R....(..bq..P..l...c...m./8..H..1..h.8.*"!.\.q..gc.Q..MGS/m.iK.......a....}/x"$B.W..x#........n..n'.(>....d\|+5.#. .C.O.....tx..{.@!.....>.Y..{+....X.D..c8....c.......i..LDS..5.~H.F..{.....:FfjL.5.?....n.R.-..4W]c.!....0.....g%.2c%.y.w.J.....s.g.Q..;X.>C......G9.Q...c...7.....`....E$....75..Mm..N7...$.7..4.&Zm....N...s.ty....@......k.C.......J.s.i..".j#!.u.r..>v...............-,V.<.@...f..=..`5.j.P...[R.k......s&..EG..$F.^].^.. K.H/H..`!=2.J.Re....n........MDJ)"A...D$......w.M;.g24"B.."....}..zy.eLkl{}o,F@..P...~. ...[..\|..'....P......"......(...\|......,`....u.GpP....0.6v..Sa.mR}...s......N..3NX.k.:.<....i..%.{.fo...#.A.=T......=...9?3.v].k}s.[...'?...@Z.3...4....)l~Vqms.t.8.g..B...b8O RT..........r....

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HYY:p
MD5:	66440D6DC015879C36B1C841867CBDC2
SHA1:	96881399700BDFE02C7EBB56F27D638ABFF05E46
SHA-256:	BFA563A7951DCFF6F9FDDF6E1EB2ADF24D406A23BB87D6A485FA0CD664517FF5
SHA-512:	8385649385F895CB251DFDA85ED44418512D4E79C259C43DAB1BE422BA37B8C019122783A313A69B943131041B52775889AB8B8E053C28CA0C13566815B1329D
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmhOFEpyNIn_RIFDbcVa3s=?alt=proto
Preview:	CgkKBw23FWt7GgA=

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:46:18.424859047 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.424941063 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.425002098 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.425266027 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.425287008 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.425545931 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.425580978 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.425642014 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.425816059 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.425832987 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.746076107 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.746349096 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.746368885 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.746980906 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.747097969 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.747632980 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.747663021 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.747733116 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748054981 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748090982 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.748672962 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748754025 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.748823881 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748856068 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748864889 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.748923063 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.748931885 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.749001026 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.749942064 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.750025988 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.750104904 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.750185966 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.804104090 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:18.804122925 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:18.852113962 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.425894022 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.426050901 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.426145077 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.426172972 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.429323912 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.429392099 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.429402113 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.432751894 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.432821035 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.432828903 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.436194897 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.436275005 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.436281919 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.439733028 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.439790010 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.439799070 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.446715117 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.446777105 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.446794033 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.446813107 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.446861029 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.450213909 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.453696966 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.453747988 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.453773022 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.453782082 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.453850031 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.457118988 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.460618973 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.460654020 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.460726023 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.460736990 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.460819960 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.464200974 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.464287043 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.464354038 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.464551926 CEST	49703	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:46:19.464571953 CEST	443	49703	151.101.1.24	192.168.2.16
Apr 18, 2024 09:46:19.562313080 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.562413931 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.562491894 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.562516928 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.562539101 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.562946081 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.562979937 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.563024044 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.563085079 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.563288927 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.563319921 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.563462973 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.563476086 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.563633919 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.563658953 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.785674095 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.786027908 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.786057949 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.787518978 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.787600994 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.788789988 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.788880110 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.788992882 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.789002895 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:19.838103056 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:19.881880999 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.882245064 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.882277966 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.882833004 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.882913113 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.883898020 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.883949995 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.885015011 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.885123014 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.885230064 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.885245085 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.886372089 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.886646032 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.886712074 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.887945890 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.888019085 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.890458107 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.890520096 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.890676022 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.890853882 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.890876055 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.890916109 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.890930891 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:19.890989065 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:19.938987017 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.089704037 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.089770079 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.089790106 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.089859009 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.089896917 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.089912891 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.089920998 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.089972019 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.106899977 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.106962919 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.107022047 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.107055902 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.107081890 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.107191086 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.107259035 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.107543945 CEST	49706	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.107561111 CEST	443	49706	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.127590895 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145287037 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145304918 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145328999 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145342112 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145349979 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145385027 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.145417929 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.145443916 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.145468950 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.160687923 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.160830975 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.160883904 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.161010981 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.161047935 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.161099911 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.164352894 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.166301012 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.166331053 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.166393995 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.166414022 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.166425943 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.167928934 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.167974949 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.167994022 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.168010950 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.168065071 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.171469927 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.175034046 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.175117970 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.175132990 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.178672075 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.178750992 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.178765059 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.182313919 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.182393074 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.182405949 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.185646057 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.185709953 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.185722113 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.189241886 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.189320087 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.189331055 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.192759037 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.192830086 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.192842007 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.199758053 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.199794054 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.199836969 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.199848890 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.199911118 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.203310013 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.206885099 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.206960917 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.206973076 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.209104061 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.242325068 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.242343903 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.242369890 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.242412090 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.242469072 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.242511034 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.242531061 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.242554903 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.257121086 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.259862900 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.259900093 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.259953976 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.259972095 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.260001898 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.260020971 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.260047913 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.260091066 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.260268927 CEST	49705	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.260291100 CEST	443	49705	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.264368057 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.265954018 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.265985012 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.266011000 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.266026020 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.266071081 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.269273996 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.269762993 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.269809961 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.269886971 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.270175934 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.270195007 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.272368908 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.272413969 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.272423029 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.275512934 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.275598049 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.275605917 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.291457891 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.291471958 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.291486025 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.291551113 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.291562080 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.291593075 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.291613102 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.305275917 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.305320978 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.305381060 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.305612087 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.305630922 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.305699110 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.305710077 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.305839062 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.305871964 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.305923939 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.306117058 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.306133986 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.306451082 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.306463957 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.311367989 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.311451912 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.311460018 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.311507940 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.311717987 CEST	49704	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.311733961 CEST	443	49704	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.323323011 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.323355913 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.323421001 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.324120045 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.324132919 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.324556112 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.324584007 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.324644089 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.325272083 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.325282097 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.431658030 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.431694031 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.431763887 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.432018995 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.432030916 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.480005980 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.480319977 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.480359077 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.480755091 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.481621027 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.481707096 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.481832027 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.520040989 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.520308971 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.520329952 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.520723104 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.520849943 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.521060944 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.521126986 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.521262884 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.521279097 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.521393061 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.522703886 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.522764921 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.523050070 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.523128033 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.523159981 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.524112940 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.536191940 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.536447048 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.536461115 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.536973953 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.537301064 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.537380934 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.537455082 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.568115950 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.568130970 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.576081038 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.576092005 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.580127001 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.623107910 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.641011000 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.641298056 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.641323090 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.641681910 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.641751051 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.642378092 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.642424107 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.642663956 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.642724037 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.642882109 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.642894030 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.687110901 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.688644886 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.699145079 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.699167967 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.699245930 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.699316978 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.699362993 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.699388027 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.719873905 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.719902992 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.719985962 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.720052004 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.720094919 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.746761084 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762202024 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762217045 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762262106 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762290955 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762303114 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762305021 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.762376070 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762415886 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.762415886 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.762415886 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.762450933 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.767225981 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.779546022 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.779573917 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.779601097 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.779690027 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.779753923 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.779788971 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.790082932 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.790412903 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.790445089 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.791919947 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.791995049 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.793242931 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.793335915 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.793438911 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.793447971 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:20.802731037 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.802752018 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.802841902 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.802901983 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.802968025 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.816441059 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.816629887 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.816694021 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.817341089 CEST	49709	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.817363024 CEST	443	49709	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.819411993 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.819437027 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.819530010 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.819588900 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.819647074 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.828711033 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.828819036 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.828866959 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.829514980 CEST	49710	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.829531908 CEST	443	49710	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.831085920 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.832386017 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.832417011 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.832468033 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.832484007 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.832518101 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.832530975 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.833717108 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.833758116 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.833827019 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.834129095 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.834142923 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.837191105 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.837311983 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.837363005 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.837835073 CEST	49711	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.837846994 CEST	443	49711	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.843091011 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.843136072 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.843189001 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.843218088 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.843236923 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.843261957 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.846067905 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:20.859258890 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.859296083 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.859364986 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.859400034 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.859416962 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.859424114 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.859452963 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.859473944 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.876677036 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.876729965 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.876776934 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.876818895 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.876847982 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.895684004 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.895745039 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.895797014 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.895858049 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.895890951 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.906038046 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.906059980 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.906157970 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.906218052 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.906287909 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.913084030 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.913156986 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.913191080 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.913240910 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.913274050 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.913312912 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.913367987 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.913564920 CEST	49708	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.913595915 CEST	443	49708	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.914982080 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.915035963 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.915102005 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.915118933 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.915148973 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.915168047 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.923851967 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.923876047 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.923960924 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.924016953 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.924076080 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.926156044 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:20.926189899 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:20.926254988 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:20.926563025 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:20.926579952 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:20.930078030 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.930120945 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.930166960 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.934691906 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.935406923 CEST	49707	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.935421944 CEST	443	49707	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.939428091 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.939471960 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.939543009 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.939821005 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:20.939837933 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:20.940144062 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940172911 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.940227032 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940316916 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940337896 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.940398932 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940556049 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940567970 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:20.940732956 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:20.940754890 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.131253004 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131284952 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131294966 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131342888 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131349087 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.131361008 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131371975 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131393909 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.131412029 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.131412029 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.131433964 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.131438971 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.139571905 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.139939070 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.139969110 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.141431093 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.141506910 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.141874075 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.141957998 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.142016888 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.149461031 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.149682045 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.149713993 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.150201082 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.150552988 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.150631905 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.150664091 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.152189970 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.152415991 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:21.152446032 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.152771950 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.153120995 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:21.153178930 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.153269053 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:21.181068897 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.188113928 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.196129084 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.197165966 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.197196007 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.197242022 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.200129032 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.245888948 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.257064104 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.257320881 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.257333040 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.257391930 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.257576942 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.257610083 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.257714033 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.257771969 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.258124113 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.258238077 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.258411884 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.258481026 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.258603096 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.258651972 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.258723021 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.258728981 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.259130001 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.259191036 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.259279966 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.259361982 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.259387970 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.259412050 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.305046082 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305059910 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305135965 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305150032 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.305172920 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305182934 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305192947 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.305226088 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.305231094 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.305275917 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.305408001 CEST	49712	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.305421114 CEST	443	49712	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.308613062 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.308643103 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.308722019 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.308928967 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.308938980 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.309087992 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.309179068 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.309209108 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.356089115 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.364404917 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.364609957 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.364677906 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.364900112 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.365226030 CEST	49716	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.365259886 CEST	443	49716	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.368217945 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.368518114 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.368573904 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.369596958 CEST	49715	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.369617939 CEST	443	49715	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.376883030 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.376907110 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.377008915 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.377224922 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.377242088 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382246017 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382271051 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382291079 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382332087 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382339001 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.382353067 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382383108 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382383108 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.382404089 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.382409096 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.382442951 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.391108990 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.391246080 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.391299009 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.391710043 CEST	49718	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.391724110 CEST	443	49718	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.402967930 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.403019905 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.403055906 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.403203964 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.403204918 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.403237104 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.447545052 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.447645903 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.447705030 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:21.448484898 CEST	49717	443	192.168.2.16	3.161.150.4
Apr 18, 2024 09:46:21.448503971 CEST	443	49717	3.161.150.4	192.168.2.16
Apr 18, 2024 09:46:21.450812101 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.450829983 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.450913906 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.451097012 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.451745987 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.451761007 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.479140997 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.479172945 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.479218006 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.479289055 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.479338884 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.479338884 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.479378939 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.479424953 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.496548891 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.496593952 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.496668100 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.496686935 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.496716022 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.496735096 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.509819984 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.509867907 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.509931087 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.509954929 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.509988070 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.510018110 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.559628963 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.559662104 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.559818029 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.559818029 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.559853077 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.559909105 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.580319881 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.580368042 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.580518007 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.580518007 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.580549955 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.580604076 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.589648962 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.589695930 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.589744091 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.589766026 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.589791059 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.589817047 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.598735094 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.598779917 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.598831892 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.598845005 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.598872900 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.598910093 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605081081 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.605132103 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.605165958 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605179071 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.605207920 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605237961 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605263948 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.605320930 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605421066 CEST	49719	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.605448961 CEST	443	49719	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.662312984 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.662619114 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.662635088 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.663119078 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.663393021 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.663398027 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.663492918 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.663513899 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.663604021 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.663613081 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.663933039 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.664170980 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.664222956 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.664248943 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.699326038 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.699573994 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.699584961 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.699951887 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.700295925 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.700361013 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.700506926 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.705070972 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:21.705076933 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:21.705121994 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.705127954 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.748110056 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.806085110 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.806235075 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.806294918 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.806303978 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.806327105 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.806380033 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.809591055 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.813105106 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.813163996 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.813174009 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.816538095 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.816598892 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.816606998 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.820652962 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.820718050 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.820727110 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.821552992 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.821613073 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.821757078 CEST	49721	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:21.821768999 CEST	443	49721	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:21.888398886 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.888572931 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:21.888645887 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.889102936 CEST	49722	443	192.168.2.16	3.161.150.100
Apr 18, 2024 09:46:21.889110088 CEST	443	49722	3.161.150.100	192.168.2.16
Apr 18, 2024 09:46:22.012042999 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:22.012139082 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:22.012192011 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:22.012675047 CEST	49720	443	192.168.2.16	52.42.97.191
Apr 18, 2024 09:46:22.012687922 CEST	443	49720	52.42.97.191	192.168.2.16
Apr 18, 2024 09:46:22.017817020 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.017860889 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.017936945 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.018157005 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.018176079 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.139019966 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.139059067 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.139137983 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.139383078 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.139401913 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.334530115 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.334830999 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.334852934 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.335386038 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.335683107 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.335764885 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.335819960 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.380122900 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.408349991 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.408591032 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.408648014 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.410363913 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.410440922 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.411231041 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.411319017 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.411359072 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.456119061 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.465080976 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.465128899 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.512072086 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.578727961 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.578859091 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.578903913 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.578928947 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.578955889 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.579058886 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.582169056 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.585629940 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.585679054 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.585684061 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.585705996 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.585752010 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.589042902 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.592463970 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.592521906 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.592530012 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.595998049 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.596059084 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.596065998 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.599435091 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.599495888 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.599503040 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.602906942 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.602960110 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.602972984 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.606401920 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.606452942 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.606460094 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.609867096 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.609925032 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.609931946 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.616731882 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.616775036 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.616792917 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.616800070 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.616837978 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.620162964 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.620282888 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.620332003 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.620529890 CEST	49723	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.620553970 CEST	443	49723	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.624069929 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.624124050 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.624224901 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.624444962 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.624466896 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.676994085 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.677069902 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.677125931 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.677545071 CEST	49724	443	192.168.2.16	3.22.134.95
Apr 18, 2024 09:46:22.677573919 CEST	443	49724	3.22.134.95	192.168.2.16
Apr 18, 2024 09:46:22.834350109 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.834678888 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.834724903 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.835125923 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.835443020 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.835506916 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:22.835599899 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:22.880124092 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042062044 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042171955 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042216063 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.042239904 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042275906 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042309999 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042313099 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.042320967 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.042362928 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.042372942 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.045527935 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.045558929 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.045588017 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.045597076 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.045638084 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.049009085 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.052488089 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.052546024 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.052552938 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.055943966 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.055984974 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.055991888 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.059406042 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.059453011 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.059461117 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.062925100 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.062969923 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.062977076 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.066333055 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.066390991 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.066397905 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.073267937 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.073306084 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.073327065 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.073342085 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.073393106 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.076699972 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.076792002 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.076838970 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.076984882 CEST	49725	443	192.168.2.16	151.101.0.138
Apr 18, 2024 09:46:23.077001095 CEST	443	49725	151.101.0.138	192.168.2.16
Apr 18, 2024 09:46:23.149276972 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.149317980 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.149394035 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.149606943 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.149624109 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.365678072 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.365974903 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.365991116 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.366880894 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.366950989 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.368206024 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.368258953 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.418081045 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:23.418091059 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:23.466093063 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:25.753633976 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:26.055121899 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:26.659141064 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:27.868171930 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:30.283123970 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:33.007035971 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.007075071 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.007184029 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.017524004 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.017538071 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.457473993 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:33.457562923 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:33.457674980 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:33.497231960 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.497293949 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.497390032 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.498559952 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.498585939 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.540725946 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.540868044 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.548682928 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.548712015 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.549190044 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.595957041 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.625849962 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:33.672117949 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:33.715514898 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.715614080 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.719388008 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.719414949 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.719753981 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.764166117 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.812125921 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.924719095 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:33.933641911 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.933818102 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.935323954 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.935383081 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.935383081 CEST	49732	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.935411930 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.935424089 CEST	443	49732	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.977436066 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.977488995 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:33.977566957 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.977936029 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:33.977947950 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.034919977 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.034955025 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.034966946 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.034981966 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.035012960 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.035056114 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.035083055 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.035104990 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.035110950 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.035140991 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.035159111 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.035175085 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.035217047 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.049705029 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.049746037 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.049767017 CEST	49731	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:46:34.049774885 CEST	443	49731	20.114.59.183	192.168.2.16
Apr 18, 2024 09:46:34.191591978 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.191766977 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.193139076 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.193156004 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.193495989 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.194683075 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.224076033 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:34.240118980 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.398390055 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.398503065 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.398574114 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.399329901 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.399348021 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.399360895 CEST	49733	443	192.168.2.16	23.55.253.34
Apr 18, 2024 09:46:34.399365902 CEST	443	49733	23.55.253.34	192.168.2.16
Apr 18, 2024 09:46:34.543740988 CEST	49727	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:46:34.543770075 CEST	443	49727	74.125.138.147	192.168.2.16
Apr 18, 2024 09:46:34.830101967 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:35.084112883 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:36.040091038 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:38.391289949 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:38.455085039 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:38.694097042 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:39.302088976 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:40.516109943 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:42.927187920 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:43.262157917 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:44.684192896 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 18, 2024 09:46:47.729199886 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:46:52.866158009 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 18, 2024 09:46:57.343199015 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 18, 2024 09:47:03.808227062 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:03.808253050 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:08.768233061 CEST	49697	80	192.168.2.16	199.232.210.172
Apr 18, 2024 09:47:08.768333912 CEST	49698	80	192.168.2.16	199.232.210.172
Apr 18, 2024 09:47:08.875170946 CEST	80	49698	199.232.210.172	192.168.2.16
Apr 18, 2024 09:47:08.875200033 CEST	80	49698	199.232.210.172	192.168.2.16
Apr 18, 2024 09:47:08.875303030 CEST	49698	80	192.168.2.16	199.232.210.172
Apr 18, 2024 09:47:08.875418901 CEST	80	49697	199.232.210.172	192.168.2.16
Apr 18, 2024 09:47:08.875437975 CEST	80	49697	199.232.210.172	192.168.2.16
Apr 18, 2024 09:47:08.875505924 CEST	49697	80	192.168.2.16	199.232.210.172
Apr 18, 2024 09:47:10.486433983 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:10.486505032 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:10.486618996 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:10.486990929 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:10.487006903 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.008933067 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.009083986 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.011497021 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.011512995 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.011837006 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.013523102 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.056130886 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.517112017 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.517148018 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.517168045 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.517364025 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.517405987 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.517494917 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.521222115 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.521245956 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:11.521258116 CEST	49734	443	192.168.2.16	20.114.59.183
Apr 18, 2024 09:47:11.521265030 CEST	443	49734	20.114.59.183	192.168.2.16
Apr 18, 2024 09:47:20.543744087 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:20.544126987 CEST	443	49702	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:20.544245005 CEST	49702	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:23.100231886 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:23.100269079 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.100356102 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:23.100626945 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:23.100642920 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.318190098 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.318780899 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:23.318824053 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.319318056 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.319952965 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:23.320044994 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:23.370120049 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:27.748191118 CEST	49688	443	192.168.2.16	13.107.21.200
Apr 18, 2024 09:47:33.359949112 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:33.360088110 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:33.360244989 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:34.548125029 CEST	49736	443	192.168.2.16	74.125.138.147
Apr 18, 2024 09:47:34.548161983 CEST	443	49736	74.125.138.147	192.168.2.16
Apr 18, 2024 09:47:57.596570015 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.596699953 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.596833944 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.597022057 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.597100019 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.597172976 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.597244024 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.597276926 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.597399950 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.597431898 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.809982061 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.810091019 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.810400963 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.810452938 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.810550928 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.810591936 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.811008930 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.811125994 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.811161041 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.811692953 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.811793089 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.811882019 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.811927080 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.811990976 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.812024117 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.812129021 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.812258959 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.812365055 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.854285955 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:57.854322910 CEST	443	49738	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:57.902198076 CEST	49738	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.868906021 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.868992090 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869015932 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869039059 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869070053 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869090080 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.869126081 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869153023 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.869163990 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869178057 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.869185925 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.869245052 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.872173071 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.875607014 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.875648022 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.875696898 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.875730038 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.875782013 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.878783941 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.882236004 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.882302046 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.882327080 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.885691881 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.885782957 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.885811090 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.889183998 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.889260054 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.889288902 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.892618895 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.892689943 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.892718077 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.896096945 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.896182060 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:58.896189928 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.896238089 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.896440983 CEST	49739	443	192.168.2.16	151.101.1.24
Apr 18, 2024 09:47:58.896465063 CEST	443	49739	151.101.1.24	192.168.2.16
Apr 18, 2024 09:47:59.012042999 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012124062 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.012207985 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012290001 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012363911 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.012438059 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012789011 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012842894 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.012962103 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.012998104 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.029303074 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.029387951 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.029488087 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.029664040 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.029695988 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.225697041 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.226033926 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.226073027 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.226571083 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.226963997 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.227082968 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.227173090 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.233237028 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.233622074 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.233655930 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.234813929 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.235192060 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.235317945 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.235330105 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.235372066 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.268162012 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.274326086 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.275068045 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.275130033 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.278300047 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.281111002 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.289979935 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.290235996 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.291733027 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.336123943 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.510360003 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.510437965 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.510507107 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.510571957 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.510631084 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.510667086 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.510701895 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.523493052 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.523607969 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.523670912 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.524774075 CEST	49740	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.524797916 CEST	443	49740	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.529630899 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.529820919 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.529901028 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.530442953 CEST	49741	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.530463934 CEST	443	49741	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.627783060 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.627906084 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.627964973 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.628007889 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.628043890 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.628083944 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.628149986 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.628245115 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.628310919 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.628597975 CEST	49742	443	192.168.2.16	23.21.145.8
Apr 18, 2024 09:47:59.628627062 CEST	443	49742	23.21.145.8	192.168.2.16
Apr 18, 2024 09:47:59.634413958 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.634514093 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.634591103 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.634632111 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.634666920 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.634731054 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.635027885 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.635066032 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.635356903 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.635384083 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.790693998 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:47:59.790756941 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:47:59.790863037 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:47:59.791134119 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:47:59.791167974 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:47:59.848634005 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.848927021 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.848963022 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.849446058 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.849760056 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.849870920 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.849886894 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.854666948 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.854926109 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.854942083 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.856178045 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.856643915 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.856827021 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.856863976 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.896106958 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:47:59.899110079 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.899110079 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:47:59.899185896 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.058335066 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.058643103 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:48:00.058677912 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.059156895 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.059505939 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:48:00.059588909 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.059704065 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:48:00.074673891 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.074889898 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.075176001 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:48:00.075795889 CEST	49743	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:48:00.075813055 CEST	443	49743	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.079574108 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.079773903 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.079850912 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:48:00.080193043 CEST	49744	443	192.168.2.16	3.161.150.25
Apr 18, 2024 09:48:00.080204964 CEST	443	49744	3.161.150.25	192.168.2.16
Apr 18, 2024 09:48:00.100159883 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.329010963 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.329102993 CEST	443	49745	3.136.252.66	192.168.2.16
Apr 18, 2024 09:48:00.329180002 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:48:00.329850912 CEST	49745	443	192.168.2.16	3.136.252.66
Apr 18, 2024 09:48:00.329890966 CEST	443	49745	3.136.252.66	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:46:18.316699982 CEST	50884	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:18.316817999 CEST	54574	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:18.375456095 CEST	53	50889	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:18.421747923 CEST	53	61631	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:18.423590899 CEST	53	54574	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:18.424119949 CEST	53	50884	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:19.021076918 CEST	53	54873	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:19.454371929 CEST	61910	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:19.454689980 CEST	52887	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:19.457355976 CEST	49675	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:19.457556009 CEST	52713	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:19.561261892 CEST	53	61910	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:19.561543941 CEST	53	49675	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:19.561594963 CEST	53	52887	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:19.562201977 CEST	53	52713	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.325761080 CEST	60760	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.325943947 CEST	53705	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.430869102 CEST	53	60760	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.430916071 CEST	53	53705	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.433489084 CEST	53	61236	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.821139097 CEST	56183	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.821315050 CEST	55660	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.832516909 CEST	50901	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.832882881 CEST	64096	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:20.925436974 CEST	53	56183	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.925484896 CEST	53	55660	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.937242985 CEST	53	50901	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:20.939650059 CEST	53	64096	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:22.015866995 CEST	53348	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:22.016191006 CEST	57123	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:22.120575905 CEST	53	53348	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:22.138372898 CEST	53	57123	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:23.043953896 CEST	59474	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:23.044225931 CEST	62712	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:46:23.148219109 CEST	53	59474	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:23.148241997 CEST	53	62712	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:35.987306118 CEST	53	60244	1.1.1.1	192.168.2.16
Apr 18, 2024 09:46:54.745892048 CEST	53	60444	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:17.119796991 CEST	53	55018	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:18.318974018 CEST	53	61293	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:29.272361040 CEST	53	60878	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:30.086419106 CEST	138	138	192.168.2.16	192.168.2.255
Apr 18, 2024 09:47:46.108175039 CEST	53	62208	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:57.488462925 CEST	50927	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:57.488749027 CEST	49449	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:57.595689058 CEST	53	50927	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:57.595767975 CEST	53	49449	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:58.906434059 CEST	52874	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:58.906699896 CEST	54195	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:58.923881054 CEST	62987	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:58.924089909 CEST	60793	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:59.011234999 CEST	53	54195	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.011552095 CEST	53	52874	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.028700113 CEST	53	62987	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.028759956 CEST	53	60793	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.527586937 CEST	49356	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:59.527719021 CEST	53490	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:59.633553028 CEST	53	53490	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.633721113 CEST	53	49356	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.647840023 CEST	63056	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:59.648230076 CEST	61706	53	192.168.2.16	1.1.1.1
Apr 18, 2024 09:47:59.755227089 CEST	53	63056	1.1.1.1	192.168.2.16
Apr 18, 2024 09:47:59.872015953 CEST	53	61706	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 18, 2024 09:47:59.872118950 CEST	192.168.2.16	1.1.1.1	c286	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 09:46:18.316699982 CEST	192.168.2.16	1.1.1.1	0xf794	Standard query (0)	dickssportinggoods.cashstar.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:18.316817999 CEST	192.168.2.16	1.1.1.1	0x1465	Standard query (0)	dickssportinggoods.cashstar.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:19.454371929 CEST	192.168.2.16	1.1.1.1	0x2459	Standard query (0)	s3static.cashstar.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.454689980 CEST	192.168.2.16	1.1.1.1	0xbda8	Standard query (0)	s3static.cashstar.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:19.457355976 CEST	192.168.2.16	1.1.1.1	0xe1a9	Standard query (0)	consent.trustarc.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.457556009 CEST	192.168.2.16	1.1.1.1	0xc1c3	Standard query (0)	consent.trustarc.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:20.325761080 CEST	192.168.2.16	1.1.1.1	0x8fa3	Standard query (0)	mpsnare.iesnare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.325943947 CEST	192.168.2.16	1.1.1.1	0xc078	Standard query (0)	mpsnare.iesnare.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:20.821139097 CEST	192.168.2.16	1.1.1.1	0x63e8	Standard query (0)	consent.trustarc.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.821315050 CEST	192.168.2.16	1.1.1.1	0x127d	Standard query (0)	consent.trustarc.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:20.832516909 CEST	192.168.2.16	1.1.1.1	0xe53d	Standard query (0)	s3static.cashstar.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.832882881 CEST	192.168.2.16	1.1.1.1	0x3c86	Standard query (0)	s3static.cashstar.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:22.015866995 CEST	192.168.2.16	1.1.1.1	0x82a3	Standard query (0)	ht.blackhawknetwork.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:22.016191006 CEST	192.168.2.16	1.1.1.1	0x335a	Standard query (0)	ht.blackhawknetwork.com	65	IN (0x0001)	false
Apr 18, 2024 09:46:23.043953896 CEST	192.168.2.16	1.1.1.1	0x6566	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.044225931 CEST	192.168.2.16	1.1.1.1	0xd2e5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 09:47:57.488462925 CEST	192.168.2.16	1.1.1.1	0x2a77	Standard query (0)	dickssportinggoods.cashstar.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:57.488749027 CEST	192.168.2.16	1.1.1.1	0xaed5	Standard query (0)	dickssportinggoods.cashstar.com	65	IN (0x0001)	false
Apr 18, 2024 09:47:58.906434059 CEST	192.168.2.16	1.1.1.1	0x6647	Standard query (0)	consent.trustarc.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:58.906699896 CEST	192.168.2.16	1.1.1.1	0x5773	Standard query (0)	consent.trustarc.com	65	IN (0x0001)	false
Apr 18, 2024 09:47:58.923881054 CEST	192.168.2.16	1.1.1.1	0xf85f	Standard query (0)	mpsnare.iesnare.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:58.924089909 CEST	192.168.2.16	1.1.1.1	0xcaff	Standard query (0)	mpsnare.iesnare.com	65	IN (0x0001)	false
Apr 18, 2024 09:47:59.527586937 CEST	192.168.2.16	1.1.1.1	0x5c7a	Standard query (0)	consent.trustarc.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.527719021 CEST	192.168.2.16	1.1.1.1	0x189	Standard query (0)	consent.trustarc.com	65	IN (0x0001)	false
Apr 18, 2024 09:47:59.647840023 CEST	192.168.2.16	1.1.1.1	0x9914	Standard query (0)	ht.blackhawknetwork.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.648230076 CEST	192.168.2.16	1.1.1.1	0x1a4d	Standard query (0)	ht.blackhawknetwork.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 09:46:18.423590899 CEST	1.1.1.1	192.168.2.16	0x1465	No error (0)	dickssportinggoods.cashstar.com	prod.cashstar-et.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:18.424119949 CEST	1.1.1.1	192.168.2.16	0xf794	No error (0)	dickssportinggoods.cashstar.com	prod.cashstar-et.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:18.424119949 CEST	1.1.1.1	192.168.2.16	0xf794	No error (0)	prod.cashstar-et.map.fastly.net		151.101.1.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:18.424119949 CEST	1.1.1.1	192.168.2.16	0xf794	No error (0)	prod.cashstar-et.map.fastly.net		151.101.65.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:18.424119949 CEST	1.1.1.1	192.168.2.16	0xf794	No error (0)	prod.cashstar-et.map.fastly.net		151.101.129.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:18.424119949 CEST	1.1.1.1	192.168.2.16	0xf794	No error (0)	prod.cashstar-et.map.fastly.net		151.101.193.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561261892 CEST	1.1.1.1	192.168.2.16	0x2459	No error (0)	s3static.cashstar.com	cashstar.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561261892 CEST	1.1.1.1	192.168.2.16	0x2459	No error (0)	cashstar.map.fastly.net		151.101.0.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561261892 CEST	1.1.1.1	192.168.2.16	0x2459	No error (0)	cashstar.map.fastly.net		151.101.64.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561261892 CEST	1.1.1.1	192.168.2.16	0x2459	No error (0)	cashstar.map.fastly.net		151.101.128.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561261892 CEST	1.1.1.1	192.168.2.16	0x2459	No error (0)	cashstar.map.fastly.net		151.101.192.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561543941 CEST	1.1.1.1	192.168.2.16	0xe1a9	No error (0)	consent.trustarc.com		3.161.150.4	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561543941 CEST	1.1.1.1	192.168.2.16	0xe1a9	No error (0)	consent.trustarc.com		3.161.150.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561543941 CEST	1.1.1.1	192.168.2.16	0xe1a9	No error (0)	consent.trustarc.com		3.161.150.83	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561543941 CEST	1.1.1.1	192.168.2.16	0xe1a9	No error (0)	consent.trustarc.com		3.161.150.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:19.561594963 CEST	1.1.1.1	192.168.2.16	0xbda8	No error (0)	s3static.cashstar.com	cashstar.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:20.430869102 CEST	1.1.1.1	192.168.2.16	0x8fa3	No error (0)	mpsnare.iesnare.com	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:20.430869102 CEST	1.1.1.1	192.168.2.16	0x8fa3	No error (0)	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com		52.42.97.191	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.430869102 CEST	1.1.1.1	192.168.2.16	0x8fa3	No error (0)	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com		44.238.162.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.430916071 CEST	1.1.1.1	192.168.2.16	0xc078	No error (0)	mpsnare.iesnare.com	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:20.925436974 CEST	1.1.1.1	192.168.2.16	0x63e8	No error (0)	consent.trustarc.com		3.161.150.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.925436974 CEST	1.1.1.1	192.168.2.16	0x63e8	No error (0)	consent.trustarc.com		3.161.150.4	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.925436974 CEST	1.1.1.1	192.168.2.16	0x63e8	No error (0)	consent.trustarc.com		3.161.150.83	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.925436974 CEST	1.1.1.1	192.168.2.16	0x63e8	No error (0)	consent.trustarc.com		3.161.150.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.937242985 CEST	1.1.1.1	192.168.2.16	0xe53d	No error (0)	s3static.cashstar.com	cashstar.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:20.937242985 CEST	1.1.1.1	192.168.2.16	0xe53d	No error (0)	cashstar.map.fastly.net		151.101.0.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.937242985 CEST	1.1.1.1	192.168.2.16	0xe53d	No error (0)	cashstar.map.fastly.net		151.101.192.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.937242985 CEST	1.1.1.1	192.168.2.16	0xe53d	No error (0)	cashstar.map.fastly.net		151.101.128.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.937242985 CEST	1.1.1.1	192.168.2.16	0xe53d	No error (0)	cashstar.map.fastly.net		151.101.64.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:20.939650059 CEST	1.1.1.1	192.168.2.16	0x3c86	No error (0)	s3static.cashstar.com	cashstar.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:22.120575905 CEST	1.1.1.1	192.168.2.16	0x82a3	No error (0)	ht.blackhawknetwork.com	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:22.120575905 CEST	1.1.1.1	192.168.2.16	0x82a3	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.22.134.95	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:22.120575905 CEST	1.1.1.1	192.168.2.16	0x82a3	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.21.79.54	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:22.120575905 CEST	1.1.1.1	192.168.2.16	0x82a3	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.133.251.5	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:22.138372898 CEST	1.1.1.1	192.168.2.16	0x335a	No error (0)	ht.blackhawknetwork.com	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148219109 CEST	1.1.1.1	192.168.2.16	0x6566	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:46:23.148241997 CEST	1.1.1.1	192.168.2.16	0xd2e5	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 09:47:57.595689058 CEST	1.1.1.1	192.168.2.16	0x2a77	No error (0)	dickssportinggoods.cashstar.com	prod.cashstar-et.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:47:57.595689058 CEST	1.1.1.1	192.168.2.16	0x2a77	No error (0)	prod.cashstar-et.map.fastly.net		151.101.1.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:57.595689058 CEST	1.1.1.1	192.168.2.16	0x2a77	No error (0)	prod.cashstar-et.map.fastly.net		151.101.65.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:57.595689058 CEST	1.1.1.1	192.168.2.16	0x2a77	No error (0)	prod.cashstar-et.map.fastly.net		151.101.129.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:57.595689058 CEST	1.1.1.1	192.168.2.16	0x2a77	No error (0)	prod.cashstar-et.map.fastly.net		151.101.193.24	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:57.595767975 CEST	1.1.1.1	192.168.2.16	0xaed5	No error (0)	dickssportinggoods.cashstar.com	prod.cashstar-et.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:47:59.011552095 CEST	1.1.1.1	192.168.2.16	0x6647	No error (0)	consent.trustarc.com		3.161.150.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.011552095 CEST	1.1.1.1	192.168.2.16	0x6647	No error (0)	consent.trustarc.com		3.161.150.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.011552095 CEST	1.1.1.1	192.168.2.16	0x6647	No error (0)	consent.trustarc.com		3.161.150.4	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.011552095 CEST	1.1.1.1	192.168.2.16	0x6647	No error (0)	consent.trustarc.com		3.161.150.83	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.028700113 CEST	1.1.1.1	192.168.2.16	0xf85f	No error (0)	mpsnare.iesnare.com	wdpthird-pr-0d2f5ae6feef9df0.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:47:59.028700113 CEST	1.1.1.1	192.168.2.16	0xf85f	No error (0)	wdpthird-pr-0d2f5ae6feef9df0.elb.us-east-1.amazonaws.com		23.21.145.8	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.028700113 CEST	1.1.1.1	192.168.2.16	0xf85f	No error (0)	wdpthird-pr-0d2f5ae6feef9df0.elb.us-east-1.amazonaws.com		52.6.11.66	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.028759956 CEST	1.1.1.1	192.168.2.16	0xcaff	No error (0)	mpsnare.iesnare.com	wdpthird-pr-1c6ba7bb96976191.elb.us-west-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:47:59.633721113 CEST	1.1.1.1	192.168.2.16	0x5c7a	No error (0)	consent.trustarc.com		3.161.150.25	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.633721113 CEST	1.1.1.1	192.168.2.16	0x5c7a	No error (0)	consent.trustarc.com		3.161.150.83	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.633721113 CEST	1.1.1.1	192.168.2.16	0x5c7a	No error (0)	consent.trustarc.com		3.161.150.4	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.633721113 CEST	1.1.1.1	192.168.2.16	0x5c7a	No error (0)	consent.trustarc.com		3.161.150.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.755227089 CEST	1.1.1.1	192.168.2.16	0x9914	No error (0)	ht.blackhawknetwork.com	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 09:47:59.755227089 CEST	1.1.1.1	192.168.2.16	0x9914	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.136.252.66	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.755227089 CEST	1.1.1.1	192.168.2.16	0x9914	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.129.159.211	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.755227089 CEST	1.1.1.1	192.168.2.16	0x9914	No error (0)	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		3.136.90.60	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:47:59.872015953 CEST	1.1.1.1	192.168.2.16	0x1a4d	No error (0)	ht.blackhawknetwork.com	d-52ccktk4i3.execute-api.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

dickssportinggoods.cashstar.com

https:

consent.trustarc.com

s3static.cashstar.com

mpsnare.iesnare.com

ht.blackhawknetwork.com

slscr.update.microsoft.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49703	151.101.1.24	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:18 UTC	715	OUT	GET /gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/ HTTP/1.1 Host: dickssportinggoods.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:19 UTC	1341	IN	HTTP/1.1 200 OK Connection: close Content-Length: 28945 Content-Type: text/html; charset=utf-8 Server: nginx Content-Security-Policy: upgrade-insecure-requests; frame-ancestors 'self' X-Robots-Tag: noindex, nofollow Content-Language: en-us Referrer-Policy: origin ETag: "e5812babd5f2d00b830588482c0de21e" Set-Cookie: csrftoken=1rBlDrTaOJdqOPfof7ZoC8pkIiwCDA1C3e4Oc0mE1y7yLvF4MiyMyNyQshP6Oxh5; expires=Thu, 17 Apr 2025 07:46:19 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure Set-Cookie: rexsessionid=6ue59m5mhae1a2w5tpdt8ji989zmiksc; expires=Fri, 19 Apr 2024 07:46:19 GMT; HttpOnly; Max-Age=86400; Path=/; SameSite=Lax; Secure Strict-Transport-Security: max-age=16070400; preload; includeSubDomains; Access-Control-Allow-Origin: https://dickssportinggoods.cashstar.com X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-UA-Compatible: IE=edge Fastly-Restarts: 1 Accept-Ranges: bytes Via: 1.1 varnish, 1.1 varnish x-datadome: protected set-cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G; Max-Age=31536000; Domain=.cashstar.com; Path=/; Secure; SameSite=Lax Date: Thu, 18 Apr 2024 07:46:19 GMT X-Served-By: cache-pdk-kpdk1780042-PDK, cache-pdk-kpdk1780042-PDK X-Cache: MISS, MISS X-Cache-Hits: 0, 0
2024-04-18 07:46:19 UTC	124	IN	Data Raw: 58 2d 54 69 6d 65 72 3a 20 53 31 37 31 33 34 32 36 33 37 39 2e 38 30 31 38 30 37 2c 56 53 30 2c 56 45 35 37 33 0d 0a 56 61 72 79 3a 20 43 6f 6f 6b 69 65 2c 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 2c 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 66 61 73 74 6c 79 2d 73 65 72 76 69 63 65 3a 20 50 72 6f 64 20 2d 20 43 6f 6e 73 75 6d 65 72 0d 0a 0d 0a Data Ascii: X-Timer: S1713426379.801807,VS0,VE573Vary: Cookie, Accept-Language, Accept-EncodingX-fastly-service: Prod - Consumer
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 Data Ascii: <!doctype html><html lang="en-us"><head> <meta charset="utf-8"> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=device-width,initial-scale=1"> <meta http-equiv="X-UA-Compatible"
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6c 69 63 6b 20 74 6f 20 76 69 65 77 20 79 6f 75 72 20 44 49 43 4b 26 23 33 39 3b 53 20 53 70 6f 72 74 69 6e 67 20 47 6f 6f 64 73 20 65 47 69 66 74 20 63 61 72 64 21 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 66 70 73 74 61 74 69 63 2e 63 61 73 68 73 74 61 72 2e 63 6f 6d 2f 66 61 63 65 70 6c 61 74 65 73 2f 44 41 42 43 50 59 55 38 36 2f 4d 41 53 54 45 52 2d 31 2e 6a 70 67 22 20 2f 3e 0a 20 20 20 20 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 33 73 74 61 74 69 63 2e Data Ascii: twitter:description" content="Click to view your DICK'S Sporting Goods eGift card!" /> <meta name="twitter:image" content="https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jpg" /> <link rel="stylesheet" href="https://s3static.
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 20 20 20 20 20 20 61 6c 6c 6f 77 41 6c 6c 43 6f 6f 6b 69 65 73 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 64 6f 4c 6f 61 64 4e 52 20 3d 20 28 29 20 3d 3e 20 7b 0a 20 20 20 20 20 20 20 20 3b 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 3b 4e 52 45 55 4d 2e 69 6e 69 74 3d 7b 70 72 69 76 61 63 79 3a 7b 63 6f 6f 6b 69 65 73 5f 65 6e 61 62 6c 65 64 3a 74 72 75 65 7d 7d 3b 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 2c 5f 5f 6e 72 5f 72 65 71 75 69 72 65 3d 66 75 Data Ascii: allowAllCookies = true; } </script> <script type="text/javascript"> const doLoadNR = () => { ;window.NREUM\|\|(NREUM={});NREUM.init={privacy:{cookies_enabled:true}}; window.NREUM\|\|(NREUM={}),__nr_require=fu
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 5d 2c 6e 29 2c 74 7d 66 69 6e 61 6c 6c 79 7b 63 2e 65 6d 69 74 28 22 66 6e 2d 65 6e 64 22 2c 5b 75 2e 6e 6f 77 28 29 5d 2c 6e 29 7d 7d 7d 7d 3b 61 28 22 61 63 74 69 6f 6e 54 65 78 74 2c 73 65 74 4e 61 6d 65 2c 73 65 74 41 74 74 72 69 62 75 74 65 2c 73 61 76 65 2c 69 67 6e 6f 72 65 2c 6f 6e 45 6e 64 2c 67 65 74 43 6f 6e 74 65 78 74 2c 65 6e 64 2c 67 65 74 22 2e 73 70 6c 69 74 28 22 2c 22 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 6d 5b 65 5d 3d 69 28 6c 2b 65 29 7d 29 2c 6e 65 77 72 65 6c 69 63 2e 6e 6f 74 69 63 65 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 6e 65 77 20 45 72 72 6f 72 28 74 29 29 2c 6f 28 22 65 72 72 22 2c 5b 74 2c 75 2e 6e 6f 77 28 29 2c 21 31 2c 65 Data Ascii: ],n),t}finally{c.emit("fn-end",[u.now()],n)}}}};a("actionText,setName,setAttribute,save,ignore,onEnd,getContext,end,get".split(","),function(t,e){m[e]=i(l+e)}),newrelic.noticeError=function(t,e){"string"==typeof t&&(t=new Error(t)),o("err",[t,u.now(),!1,e
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 6e 6f 77 28 29 2c 67 3d 21 30 2c 64 28 22 74 69 6d 69 6e 67 22 2c 5b 22 66 69 22 2c 65 2c 6e 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 29 7b 22 68 69 64 64 65 6e 22 3d 3d 3d 74 26 26 64 28 22 70 61 67 65 48 69 64 65 22 2c 5b 70 2e 6e 6f 77 28 29 5d 29 7d 69 66 28 21 28 22 69 6e 69 74 22 69 6e 20 4e 52 45 55 4d 26 26 22 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 22 69 6e 20 4e 52 45 55 4d 2e 69 6e 69 74 26 26 22 65 6e 61 62 6c 65 64 22 69 6e 20 4e 52 45 55 4d 2e 69 6e 69 74 2e 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 26 26 4e 52 45 55 4d 2e 69 6e 69 74 2e 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 2e 65 6e 61 62 6c 65 64 3d 3d 3d 21 31 29 29 7b 76 61 72 20 63 2c 75 2c 73 2c 64 3d 74 28 22 68 61 6e 64 6c 65 22 29 2c 70 3d 74 28 22 6c Data Ascii: now(),g=!0,d("timing",["fi",e,n])}}function f(t){"hidden"===t&&d("pageHide",[p.now()])}if(!("init"in NREUM&&"page_view_timing"in NREUM.init&&"enabled"in NREUM.init.page_view_timing&&NREUM.init.page_view_timing.enabled===!1)){var c,u,s,d=t("handle"),p=t("l
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 65 6e 65 72 28 6f 2c 65 2c 21 31 29 7d 65 2e 65 78 70 6f 72 74 73 3d 72 3b 76 61 72 20 69 2c 6f 2c 61 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 3f 28 69 3d 22 68 69 64 64 65 6e 22 2c 6f 3d 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 61 3d 22 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 22 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 6d 73 48 69 64 64 65 6e 3f 28 69 3d 22 6d 73 48 69 64 64 65 6e 22 2c 6f 3d 22 6d 73 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 77 65 62 6b 69 74 48 69 64 64 65 6e 26 26 28 69 3d 22 77 65 62 6b 69 74 48 Data Ascii: ener(o,e,!1)}e.exports=r;var i,o,a;"undefined"!=typeof document.hidden?(i="hidden",o="visibilitychange",a="visibilityState"):"undefined"!=typeof document.msHidden?(i="msHidden",o="msvisibilitychange"):"undefined"!=typeof document.webkitHidden&&(i="webkitH
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 7d 76 61 72 20 79 3d 7b 7d 2c 77 3d 7b 7d 2c 62 3d 7b 6f 6e 3a 6f 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 6f 2c 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 6d 2c 65 6d 69 74 3a 6e 2c 67 65 74 3a 67 2c 6c 69 73 74 65 6e 65 72 73 3a 76 2c 63 6f 6e 74 65 78 74 3a 65 2c 62 75 66 66 65 72 3a 68 2c 61 62 6f 72 74 3a 66 2c 61 62 6f 72 74 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 72 65 74 75 72 6e 20 75 28 74 2c 63 2c 61 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 72 7d 66 75 6e 63 74 69 6f 6e 20 66 28 29 7b 28 64 2e 61 70 69 7c 7c 64 2e 66 65 61 74 75 72 65 29 26 26 28 6c 2e 61 62 6f 72 74 65 64 3d 21 30 2c 64 3d 6c 2e 62 61 63 6b 6c 6f 67 3d 7b 7d 29 Data Ascii: }var y={},w={},b={on:o,addEventListener:o,removeEventListener:m,emit:n,get:g,listeners:v,context:e,buffer:h,abort:f,aborted:!1};return b}function o(t){return u(t,c,a)}function a(){return new r}function f(){(d.api\|\|d.feature)&&(l.aborted=!0,d=l.backlog={})
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 72 2c 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 76 2e 72 65 61 64 79 53 74 61 74 65 26 26 6f 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 66 28 22 6d 61 72 6b 22 2c 5b 22 64 6f 6d 43 6f 6e 74 65 6e 74 22 2c 61 28 29 2b 4d 2e 6f 66 66 73 65 74 5d 2c 6e 75 6c 6c 2c 22 61 70 69 22 29 7d 76 61 72 20 61 3d 74 28 33 29 2c 66 3d 74 28 22 68 61 6e 64 6c 65 22 29 2c 63 3d 74 28 38 29 2c 75 3d 74 28 22 65 65 22 29 2c 73 3d 74 28 36 29 2c 64 3d 74 28 34 29 2c 70 3d 74 28 32 29 2c 6c 3d 70 2e 67 65 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 28 22 73 73 6c 22 29 3d 3d 3d 21 31 3f 22 68 74 74 70 22 3a 22 68 74 74 70 73 22 2c 6d 3d 77 69 6e 64 6f 77 2c 76 Data Ascii: rentNode.insertBefore(r,e)}}function i(){"complete"===v.readyState&&o()}function o(){f("mark",["domContent",a()+M.offset],null,"api")}var a=t(3),f=t("handle"),c=t(8),u=t("ee"),s=t(6),d=t(4),p=t(2),l=p.getConfiguration("ssl")===!1?"http":"https",m=window,v
2024-04-18 07:46:19 UTC	1379	IN	Data Raw: 73 3d 22 2d 22 3d 3d 3d 72 2e 63 68 61 72 41 74 28 30 29 3b 66 6f 72 28 75 3d 30 3b 75 3c 65 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 63 3d 65 5b 75 5d 2c 66 3d 74 5b 63 5d 2c 61 28 66 29 7c 7c 28 74 5b 63 5d 3d 6e 28 66 2c 73 3f 63 2b 72 3a 72 2c 69 2c 63 2c 6f 29 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 6e 2c 72 2c 6f 2c 61 29 7b 69 66 28 21 6d 7c 7c 65 29 7b 76 61 72 20 66 3d 6d 3b 6d 3d 21 30 3b 74 72 79 7b 74 2e 65 6d 69 74 28 6e 2c 72 2c 6f 2c 65 2c 61 29 7d 63 61 74 63 68 28 63 29 7b 69 28 5b 63 2c 6e 2c 72 2c 6f 5d 2c 74 29 7d 6d 3d 66 7d 7d 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 73 29 2c 6e 2e 69 6e 50 6c 61 63 65 3d 72 2c 6e 2e 66 6c 61 67 3d 70 2c 6e 7d 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 65 7c 7c 28 65 3d 73 29 3b 74 72 79 7b 65 2e 65 6d Data Ascii: s="-"===r.charAt(0);for(u=0;u<e.length;u++)c=e[u],f=t[c],a(f)\|\|(t[c]=n(f,s?c+r:r,i,c,o))}function f(n,r,o,a){if(!m\|\|e){var f=m;m=!0;try{t.emit(n,r,o,e,a)}catch(c){i([c,n,r,o],t)}m=f}}return t\|\|(t=s),n.inPlace=r,n.flag=p,n}function i(t,e){e\|\|(e=s);try{e.em

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49706	3.161.150.4	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:19 UTC	619	OUT	GET /notice?domain=blackhawk-cashstar.com&c=teconsent&js=nj&noticeType=bb&text=true&gtm=1 HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:20 UTC	471	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=UTF-8 Content-Length: 30343 Connection: close Date: Thu, 18 Apr 2024 07:46:19 GMT Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 f28e07477e8f18f76e7bc8a3375bb1e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: 4n8ABXLkFbkUR65Rsf1lynaUHhuh1nMFYTmuFY2SGl5IeWEhivy1PQ== Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: max-age=3600 Vary: Origin
2024-04-18 07:46:20 UTC	15780	IN	Data Raw: 76 61 72 20 74 72 75 73 74 65 3d 77 69 6e 64 6f 77 2e 74 72 75 73 74 65 7c 7c 7b 7d 3b 74 72 75 73 74 65 2e 62 6e 7c 7c 28 74 72 75 73 74 65 2e 62 6e 3d 7b 7d 29 3b 74 72 75 73 74 65 2e 65 75 7c 7c 28 74 72 75 73 74 65 2e 65 75 3d 7b 7d 29 3b 74 72 75 73 74 65 2e 75 74 69 6c 7c 7c 28 74 72 75 73 74 65 2e 75 74 69 6c 3d 7b 7d 29 3b 0a 74 72 75 73 74 65 2e 75 74 69 6c 2e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 64 2c 67 29 7b 67 3d 67 7c 7c 7b 7d 3b 76 61 72 20 66 3d 64 26 26 64 2e 74 6f 53 74 72 69 6e 67 28 29 7c 7c 22 22 2c 63 3d 67 2e 63 61 6c 6c 65 72 7c 7c 22 22 3b 69 66 28 64 26 26 64 2e 73 74 61 63 6b 29 7b 66 2b 3d 22 5c 6e 22 2b 64 2e 73 74 61 63 6b 2e 6d 61 74 63 68 28 2f 28 40 7c 61 74 29 5b 5e 5c 6e 5c 72 5c 74 5d 2a 2f 29 5b 30 5d 2b Data Ascii: var truste=window.truste\|\|{};truste.bn\|\|(truste.bn={});truste.eu\|\|(truste.eu={});truste.util\|\|(truste.util={});truste.util.error=function(h,d,g){g=g\|\|{};var f=d&&d.toString()\|\|"",c=g.caller\|\|"";if(d&&d.stack){f+="\n"+d.stack.match(/(@\|at)[^\n\r\t]*/)[0]+
2024-04-18 07:46:20 UTC	14563	IN	Data Raw: 6f 70 3a 22 31 35 70 78 22 2c 72 69 67 68 74 3a 22 31 30 70 78 22 7d 3b 0a 24 74 65 6d 70 5f 62 6f 78 5f 6f 76 65 72 6c 61 79 3d 7b 70 61 64 64 69 6e 67 3a 22 30 70 78 22 2c 6d 61 72 67 69 6e 3a 22 32 30 70 78 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 22 7d 3b 24 74 65 6d 70 5f 62 6f 78 5f 6f 76 65 72 6c 61 79 5f 62 6f 72 64 65 72 3d 7b 64 69 73 70 6c 61 79 3a 22 6e 6f 6e 65 22 7d 3b 0a 24 74 65 6d 70 5f 65 78 74 65 72 6e 61 6c 63 73 73 3d 22 40 6d 65 64 69 61 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 20 61 63 74 69 76 65 29 20 7b 20 2e 74 72 75 73 74 65 2d 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 66 69 6c 74 65 72 3a 20 69 6e 76 65 72 74 28 39 39 25 29 20 73 65 70 69 61 28 31 30 30 25 29 20 73 61 74 75 72 61 74 65 Data Ascii: op:"15px",right:"10px"};$temp_box_overlay={padding:"0px",margin:"20px auto !important"};$temp_box_overlay_border={display:"none"};$temp_externalcss="@media (forced-colors: active) { .truste-close-button-container{filter: invert(99%) sepia(100%) saturate

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49705	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:19 UTC	771	OUT	GET /media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c0.css HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:20 UTC	735	IN	HTTP/1.1 200 OK Connection: close Content-Length: 67397 x-amz-id-2: IIOWjto3O//ToMuzvjLXhFkfLPzpUIGEsCYwYCJrodxuQLlKSQwxpbHBfHBLqUomgXSB9VvFwr4= x-amz-request-id: 21GFG4JCZC4AJ8XD x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:28:48 GMT ETag: "283fc50d899ddcf9172dd0ee61b019c0" x-amz-server-side-encryption: AES256 x-amz-version-id: wOqUoJDmUzoo1eHYaJsIThlFxi6eQAJk Content-Type: text/css Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:20 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130067-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426380.939040,VS0,VE137 Vary: Accept-Encoding Cache-Control: public,max-age=31536000
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 68 74 6d 6c 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 7d 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 66 6f 6f 74 65 72 2c 68 65 61 64 65 72 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 3b 6d 61 72 67 69 6e 3a 2e 36 37 65 6d 20 30 7d 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 6d 61 69 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 66 69 67 75 72 65 7b 6d 61 72 67 69 6e 3a 31 65 6d 20 34 30 70 78 7d 68 72 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 Data Ascii: html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,header,nav,section{display:block}h1{font-size:2em;margin:.67em 0}figcaption,figure,main{display:block}figure{margin:1em 40px}hr{-webkit-box-si
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 7d 2e 69 6e 74 65 72 73 74 69 74 69 61 6c 2d 66 6f 72 6d 2d 70 75 72 63 68 61 73 65 72 2d 64 61 74 61 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 69 6e 74 65 72 73 74 69 74 69 61 6c 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 65 6e 74 65 72 2d 65 6d 61 69 6c 2d 61 67 61 69 6e 2d 74 69 74 6c 65 2c 2e 65 6e 74 65 72 2d 65 6d 61 69 6c 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 72 65 6d 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a Data Ascii: t-weight:700;padding-top:30px}.interstitial-form-purchaser-data{font-weight:400}.section-header-interstitial{text-align:center}.enter-email-again-title,.enter-email-title{color:rgba(0,0,0,.6);font-size:.75rem;font-style:normal;font-weight:400;line-height:
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 62 72 61 7a 7a 61 76 69 6c 6c 65 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 34 30 70 78 7d 69 2e 66 6c 61 67 2e 63 68 3a 62 65 66 6f 72 65 2c 69 2e 66 6c 61 67 2e 73 77 69 74 7a 65 72 6c 61 6e 64 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 36 36 70 78 7d 69 2e 66 6c 61 67 2e 63 69 3a 62 65 66 6f 72 65 2c 69 2e 66 6c 61 67 2e 63 6f 74 65 2e 64 69 76 6f 69 72 65 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 2d 31 30 39 32 70 78 7d 69 2e 66 6c 61 67 2e 63 6b 3a 62 65 66 6f 72 65 2c 69 2e 66 6c 61 67 2e 63 6f 6f 6b 2e 69 73 6c 61 6e 64 73 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 Data Ascii: brazzaville:before{background-position:0 -1040px}i.flag.ch:before,i.flag.switzerland:before{background-position:0 -1066px}i.flag.ci:before,i.flag.cote.divoire:before{background-position:0 -1092px}i.flag.ck:before,i.flag.cook.islands:before{background-posi
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 7d 2e 6c 61 6e 67 75 61 67 65 5f 70 69 63 6b 65 72 5f 5f 73 65 6c 65 63 74 65 64 5f 69 63 6f 6e 7b 77 69 64 74 68 3a 31 65 6d 3b 68 65 69 67 68 74 3a 31 65 6d 7d 2e 6c 61 6e 67 75 61 67 65 5f 70 69 63 6b 65 72 5f 5f 73 65 6c 65 63 74 5f 6c 61 6e 67 75 61 67 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 7d 2e 6c 61 6e 67 75 61 67 65 5f 70 69 63 6b 65 72 5f 5f 73 65 6c 65 63 74 5f 73 65 6c 65 63 74 65 64 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 3b Data Ascii: n-self:center;-webkit-box-flex:0;flex:0 1 auto}.language_picker__selected_icon{width:1em;height:1em}.language_picker__select_language{-webkit-box-flex:0;flex:0 1 auto;align-self:center}.language_picker__select_selected{text-align:right;-webkit-box-flex:1;
2024-04-18 07:46:20 UTC	1861	IN	Data Raw: 6d 65 6e 74 43 75 70 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 72 6f 74 61 74 65 50 61 79 6d 65 6e 74 43 75 70 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 36 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 36 30 64 65 67 29 7d 35 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 36 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 36 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 36 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 36 30 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 Data Ascii: mentCup 2s infinite linear}@-webkit-keyframes rotatePaymentCup{0%{-webkit-transform:rotate(-60deg);transform:rotate(-60deg)}50%{-webkit-transform:rotate(60deg);transform:rotate(60deg)}100%{-webkit-transform:rotate(-60deg);transform:rotate(-60deg)}}@keyfra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49704	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:19 UTC	729	OUT	GET /recipient-experience/static/js/concat/client.js HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:20 UTC	709	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86743 x-amz-id-2: U1QbG9NBnzloDnnqqy3l9DZOWCn3CWRp22NLL5nDEVc7t/TBt7KnVm5Hh++yhXJL7Fs0JJsMwyw= x-amz-request-id: 9C4FTR76CMKZRN5E x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:27:15 GMT ETag: "18397f8ff7e15f5cc12ff827ad1b3c8b" x-amz-server-side-encryption: AES256 x-amz-version-id: 5mcm5rcM5k8rRln3yxSXw3KwDU2y8jDB Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:20 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130029-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426380.945573,VS0,VE163 Vary: Accept-Encoding
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 6e 29 7b 69 66 28 72 5b 6e 5d 29 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 72 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 74 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3b 77 69 6e 64 6f 77 2e 77 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 69 29 7b 66 6f 72 28 76 61 72 20 61 2c 63 2c 73 3d 30 2c 75 3d 5b 5d 3b 73 3c 74 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 63 3d 74 5b 73 5d 2c 6f 5b 63 Data Ascii: !function(e){function t(n){if(r[n])return r[n].exports;var o=r[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,t),o.l=!0,o.exports}var n=window.webpackJsonp;window.webpackJsonp=function(t,r,i){for(var a,c,s=0,u=[];s<t.length;s++)c=t[s],o[c
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 65 2e 64 65 66 61 75 6c 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 74 2e 64 28 6e 2c 22 61 22 2c 6e 29 2c 6e 7d 2c 74 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 7d 2c 74 2e 70 3d 22 2f 72 65 63 69 70 69 65 6e 74 2d 65 78 70 65 72 69 65 6e 63 65 2f 73 74 61 74 69 63 2f 6a 73 2f 63 6f 6e 63 61 74 2f 22 2c 74 2e 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 2c 65 7d 2c 74 28 74 2e 73 3d 35 34 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 32 31 29 28 22 77 6b Data Ascii: e.default}:function(){return e};return t.d(n,"a",n),n},t.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},t.p="/recipient-experience/static/js/concat/",t.oe=function(e){throw console.error(e),e},t(t.s=54)}([function(e,t,n){var r=n(21)("wk
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 67 61 74 6f 72 2e 70 72 6f 64 75 63 74 26 26 22 4e 53 22 21 3d 3d 6e 61 76 69 67 61 74 6f 72 2e 70 72 6f 64 75 63 74 29 26 26 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 2c 74 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 65 26 26 76 6f 69 64 20 30 21 3d 3d 65 29 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 5b 65 5d 29 2c 72 28 65 29 29 66 6f 72 28 76 61 72 20 6e 3d 30 2c 6f 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 6f 3b 6e 2b 2b 29 74 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 5b 6e 5d 2c 6e 2c 65 29 3b 65 6c 73 65 20 66 6f 72 28 76 61 72 20 69 20 69 6e 20 65 29 4f 62 6a 65 63 Data Ascii: gator.product&&"NS"!==navigator.product)&&("undefined"!=typeof window&&"undefined"!=typeof document)}function b(e,t){if(null!==e&&void 0!==e)if("object"!=typeof e&&(e=[e]),r(e))for(var n=0,o=e.length;n<o;n++)t.call(null,e[n],n,e);else for(var i in e)Objec
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 76 61 72 20 6e 3d 5b 5d 2c 72 3d 21 30 2c 6f 3d 21 31 2c 69 3d 76 6f 69 64 20 30 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 61 2c 63 3d 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 28 29 3b 21 28 72 3d 28 61 3d 63 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6e 2e 70 75 73 68 28 61 2e 76 61 6c 75 65 29 2c 21 74 7c 7c 6e 2e 6c 65 6e 67 74 68 21 3d 3d 74 29 3b 72 3d 21 30 29 3b 7d 63 61 74 63 68 28 65 29 7b 6f 3d 21 30 2c 69 3d 65 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 21 72 26 26 63 2e 72 65 74 75 72 6e 26 26 63 2e 72 65 74 75 72 Data Ascii: fineProperty(t,"__esModule",{value:!0});var r=function(){function e(e,t){var n=[],r=!0,o=!1,i=void 0;try{for(var a,c=e[Symbol.iterator]();!(r=(a=c.next()).done)&&(n.push(a.value),!t\|\|n.length!==t);r=!0);}catch(e){o=!0,i=e}finally{try{!r&&c.return&&c.retur
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 74 79 70 65 6f 66 20 65 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 21 6e 28 33 32 29 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 21 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 22 61 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 7d 7d 29 2e 61 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2c 6f 3d 74 2e 69 67 6e 6f 72 65 55 74 69 6c 46 6f 63 75 73 43 68 61 6e 67 65 73 3d 21 31 2c 69 3d 28 74 Data Ascii: typeof e}},function(e,t,n){e.exports=!n(32)(function(){return 7!=Object.defineProperty({},"a",{get:function(){return 7}}).a})},function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r=arguments,o=t.ignoreUtilFocusChanges=!1,i=(t
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 2d 29 7b 76 61 72 20 72 3d 74 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 6e 5d 3b 69 66 28 63 28 72 29 7c 7c 65 28 72 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 31 7d 2c 74 2e 61 74 74 65 6d 70 74 46 6f 63 75 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 69 67 6e 6f 72 65 55 74 69 6c 46 6f 63 75 73 43 68 61 6e 67 65 73 3d 6f 3d 21 30 2c 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 66 6f 63 75 73 26 26 65 2e 66 6f 63 75 73 28 29 2c 74 2e 69 67 6e 6f 72 65 55 74 69 6c 46 6f 63 75 73 43 68 61 6e 67 65 73 3d 6f 3d 21 31 2c 64 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 3d 3d 65 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7b 7d 2e 74 6f 53 74 72 69 6e 67 3b Data Ascii: -){var r=t.childNodes[n];if(c(r)\|\|e(r))return!0}return!1},t.attemptFocus=function(e){return t.ignoreUtilFocusChanges=o=!0,e&&"function"==typeof e.focus&&e.focus(),t.ignoreUtilFocusChanges=o=!1,document.activeElement===e})},function(e,t){var n={}.toString;
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 65 29 2c 65 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 65 2c 74 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 32 29 2c 6f 3d 6e 28 33 29 2c 69 3d 6e 28 36 29 2c 61 3d 6e 28 31 31 29 2c 63 3d 6e 28 31 32 29 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 75 2c 6c 2c 66 2c 64 2c 68 3d 65 26 73 2e 46 2c 6d 3d 65 26 73 2e 47 2c 70 3d 65 26 73 2e 53 2c 76 3d 65 26 73 2e 50 2c 67 3d 65 26 73 2e 42 2c 79 3d 6d 3f 72 3a 70 3f 72 5b 74 5d 7c 7c 28 72 5b 74 5d 3d 7b 7d 29 3a 28 72 5b 74 5d 7c 7c 7b 7d 29 2e 70 72 6f Data Ascii: e),e}},function(e,t){var n={}.hasOwnProperty;e.exports=function(e,t){return n.call(e,t)}},function(e,t,n){var r=n(2),o=n(3),i=n(6),a=n(11),c=n(12),s=function(e,t,n){var u,l,f,d,h=e&s.F,m=e&s.G,p=e&s.S,v=e&s.P,g=e&s.B,y=m?r:p?r[t]\|\|(r[t]={}):(r[t]\|\|{}).pro
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 31 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 30 2c 72 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 53 79 6d 62 6f 6c 28 22 2e 63 6f 6e 63 61 74 28 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 2c 22 29 5f 22 2c 28 2b 2b 6e 2b 72 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 37 29 2c 6f 3d 6e 28 32 29 2e 64 6f 63 75 6d 65 6e 74 2c 69 3d 72 28 6f 29 26 26 72 28 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 69 3f 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 65 29 3a 7b 7d 7d 7d Data Ascii: 1},function(e,t){var n=0,r=Math.random();e.exports=function(e){return"Symbol(".concat(void 0===e?"":e,")_",(++n+r).toString(36))}},function(e,t,n){var r=n(7),o=n(2).document,i=r(o)&&r(o.createElement);e.exports=function(e){return i?o.createElement(e):{}}}
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 65 64 26 26 28 75 5b 66 2e 6e 61 6d 65 5d 3d 21 30 29 3a 75 5b 66 2e 6e 61 6d 65 5d 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 68 26 26 22 72 61 64 69 6f 22 3d 3d 66 2e 74 79 70 65 29 63 6f 6e 74 69 6e 75 65 7d 65 6c 73 65 20 69 66 28 21 68 29 63 6f 6e 74 69 6e 75 65 3b 69 66 28 22 73 65 6c 65 63 74 2d 6d 75 6c 74 69 70 6c 65 22 21 3d 3d 66 2e 74 79 70 65 29 6e 3d 72 28 6e 2c 64 2c 68 29 3b 65 6c 73 65 7b 68 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6d 3d 66 2e 6f 70 74 69 6f 6e 73 2c 70 3d 21 31 2c 76 3d 30 3b 76 3c 6d 2e 6c 65 6e 67 74 68 3b 2b 2b 76 29 7b 76 61 72 20 67 3d 6d 5b 76 5d 2c 79 3d 74 2e 65 6d 70 74 79 26 26 21 67 2e 76 61 6c 75 65 2c 62 3d 67 2e 76 61 6c 75 65 7c 7c 79 3b 67 2e 73 65 6c 65 63 74 65 64 26 26 62 26 26 28 70 3d 21 30 2c 6e 3d 74 2e 68 Data Ascii: ed&&(u[f.name]=!0):u[f.name]=!1),void 0==h&&"radio"==f.type)continue}else if(!h)continue;if("select-multiple"!==f.type)n=r(n,d,h);else{h=[];for(var m=f.options,p=!1,v=0;v<m.length;++v){var g=m[v],y=t.empty&&!g.value,b=g.value\|\|y;g.selected&&b&&(p=!0,n=t.h
2024-04-18 07:46:20 UTC	1379	IN	Data Raw: 31 26 65 29 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 28 32 26 65 29 2c 77 72 69 74 61 62 6c 65 3a 21 28 34 26 65 29 2c 76 61 6c 75 65 3a 74 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 32 32 29 2c 6f 3d 6e 28 31 37 29 2c 69 3d 6e 28 31 31 29 2c 61 3d 6e 28 36 29 2c 63 3d 6e 28 31 33 29 2c 73 3d 6e 28 36 32 29 2c 75 3d 6e 28 33 30 29 2c 6c 3d 6e 28 36 38 29 2c 66 3d 6e 28 30 29 28 22 69 74 65 72 61 74 6f 72 22 29 2c 64 3d 21 28 5b 5d 2e 6b 65 79 73 26 26 22 6e 65 78 74 22 69 6e 5b 5d 2e 6b 65 79 73 28 29 29 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 6d 2c 70 2c 76 Data Ascii: 1&e),configurable:!(2&e),writable:!(4&e),value:t}}},function(e,t,n){"use strict";var r=n(22),o=n(17),i=n(11),a=n(6),c=n(13),s=n(62),u=n(30),l=n(68),f=n(0)("iterator"),d=!([].keys&&"next"in[].keys()),h=function(){return this};e.exports=function(e,t,n,m,p,v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49707	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	835	OUT	GET /media/images/DICKS/DICKS.png HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://s3static.cashstar.com/media/style/recipient_experience/DICKS.283fc50d899ddcf9172dd0ee61b019c0.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:20 UTC	673	IN	HTTP/1.1 200 OK Connection: close Content-Length: 160113 x-amz-id-2: +UibiJES5xqhMMCGPMfOrkR6t0V4vfFomAJkm7HuqekF5/Qr89g+guTuavWKhKh6F6G9kENDBUM= x-amz-request-id: NEAVY8PM27B0SF60 x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:30:18 GMT ETag: "970205d9dbae569e6b69a49d1b2459dc" x-amz-server-side-encryption: AES256 x-amz-version-id: PXdz_Ks9b2CZNKhi8IuKnrwiDitiVQ3h Content-Type: image/png Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 18 Apr 2024 07:46:20 GMT Via: 1.1 varnish Age: 165 X-Served-By: cache-pdk-kfty2130066-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1713426381.635500,VS0,VE2
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 15 f0 00 00 02 d0 08 06 00 00 00 71 c7 95 04 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 04 f5 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 31 20 37 39 2e 31 34 36 32 38 39 39 37 37 37 2c 20 32 30 32 33 2f 30 36 2f 32 35 2d 32 33 3a 35 37 3a 31 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 Data Ascii: PNGIHDRqpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rd
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: f2 4f 1c d4 a9 82 cf e5 81 b3 5f 4a 69 7b 0c 8a 55 b7 b5 9b 64 59 9a 2b 5c ed c6 a0 70 75 4f bb 71 96 9e 94 d2 e6 18 dc 5f 3b db 4d b2 ac 6c 8b 88 cf a4 94 7e 25 22 76 15 45 71 b0 e5 3c 00 00 0b 7a e8 c0 35 5b 63 f0 79 5f 15 ae 7b e5 e5 77 ee ab 68 17 2c 4b 3f fe 8e 9f 7c a2 ed 0c 4b c9 5c e9 dd fc d7 cd 15 e0 45 44 9c 2d 25 78 ef fa f9 eb 67 be fe c8 81 ad 4d 9f fb 8a 4b 2e df f7 ff fe ab 5f e9 34 7d 6e 5b 7e f6 7d 37 7f 70 e6 af fe e2 1f b4 71 f6 7f fa d0 7f b8 e0 4c 1f db d6 fd 71 36 19 fd 58 32 ff e3 c8 4d ef 79 ef ad ad 05 ab 48 ea bc a2 95 7f 9e f5 ee bf fb 53 bb 7f f5 e6 f7 67 6d 9c bd dc fd d3 9b fe 79 7e db 27 3e d6 54 21 db 09 8a 99 af 9f 95 5f 44 7c ff 6f 7c e0 4d 4f 3e fd d4 df 7a ec e0 13 7f e3 81 87 1e dc 76 cf d7 ee db f4 f0 93 4f b4 f6 77 Data Ascii: O_Ji{UdY+\puOq_;Ml~%"vEq<z5[cy_{wh,K?\|K\ED-%xgMK._4}n[~}7pqLq6X2MyHSgmy~'>T!_D\|o\|MO>zvOw
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 6d 8f 1b 36 d0 a7 fd 93 ce cd c2 9b 9b 05 fe f9 11 d0 ae f4 d6 5b 8a eb f9 af 1b ad a5 be ad 85 b9 ad 1d ba de f3 a4 db 7b 6a 5f c8 2b a5 1b ff db 79 0a 00 30 33 2f ba 75 5f 29 bb 39 01 03 93 05 ce c9 30 a3 e4 3f c7 20 a5 db b3 06 3a ae df 55 79 6f 73 c9 af bb 75 8d b6 d9 5b ce 97 90 12 38 78 4c e2 dd 2f 80 ab ae b9 06 53 a7 4d 83 c9 64 82 d9 64 42 5c 5c 1c c6 a4 f7 ee b5 96 91 66 33 46 0f 18 d8 a9 48 7d 68 bf 0c fc f0 b2 99 c8 48 ee 7c 3f 4d da 98 3b e5 26 14 e6 5e 8c 7e f1 f1 aa a3 10 51 df 56 a8 78 fd d5 52 ca 15 8a 33 90 7e 66 2b 5e bf 98 e5 d0 2d e6 a9 0e 00 f5 f7 37 44 44 44 a4 50 5d 7d 41 36 80 7b 54 e7 d0 50 71 5d 7d 81 45 75 08 22 52 67 d1 dd 0b 4a 66 5c 79 c3 b9 45 53 ae d9 a6 32 c7 ca 9a 75 16 95 eb 13 51 f0 0b a6 72 4e a2 9e 6c a9 dd 7e ad ea Data Ascii: m6[{j_+y03/u_)90? :Uyosu[8xL/SMddB\\f3FH}hH\|?M;&^~QVxR3~f+^-7DDDP]}A6{TPq]}Eu"RgJf\yES2uQrNl~
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 02 99 c0 5b 94 6b e4 e3 bd 0a 1f c7 d9 75 cc d0 95 0a 3f c6 da 75 ca 60 08 03 7e e6 0e 1f c7 d9 75 cc d0 51 ad 2c aa ae 09 70 8e 42 0d 72 f8 c3 61 f0 7a 44 a4 af 6b 8c 5e b0 3c 2f 7f 30 80 61 46 af ab 98 0b 40 e7 37 2b 10 11 11 11 05 9f 4b 35 98 63 12 00 5f 9e 67 ce d3 60 2d 22 0a cc 6d f0 ed f6 da 2c b6 e7 21 9a 98 59 66 b5 9d d3 d3 a0 32 ab 6d 18 80 35 30 ae bc 57 02 38 65 d0 5a 44 44 44 44 44 44 44 a4 31 16 f8 86 86 ec 5e ef 29 58 48 e6 0b 1e 0b ff f0 b8 b4 e2 f5 c4 83 b7 a1 ee f1 18 78 f4 74 f9 fb c5 c7 b7 8c 8d 8b 8a c1 b8 c1 23 15 a4 d4 c6 fe fd fb 51 55 b5 ae dd 36 b3 25 01 b1 e3 82 bb c0 d7 75 fa 0c 86 66 66 b6 64 16 42 e0 fb 3f fc 11 ae be f6 5a 44 7a 8b 71 87 0d 1b 8e c5 0f ff 12 e7 8d 1b 07 a7 d3 09 a7 d3 89 33 67 ce c0 e9 72 c1 e9 74 22 2d 3d Data Ascii: [ku?u`~uQ,pBrazDk^</0aF@7+K5c_g`-"m,!Yf2m50W8eZDDDDDDD1^)XHxt#QU6%uffdB?ZDzq3grt"-=
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 1d 46 44 9c 77 cd e5 57 be de b2 6e ed ed 3f ff d3 ac 9f 3a 9d a5 d8 d5 9e 78 fa e2 db a7 4c bd cc e9 1c 92 df c6 57 1c bb fa 96 c9 d7 5f e7 74 0e 11 33 5c 3f 71 72 78 e3 a6 8d 15 fa 1e 95 5f 2e ad 3e ff f6 eb 27 4e 0e 3b 9d 43 a4 00 55 db b8 d6 52 a3 b6 61 c9 5e 2e 0f da 94 23 1b d1 0c f6 09 5a 9c 61 57 af 1a b5 0d ab 73 9c 51 6d 42 8e 6c 44 33 dc 2f 68 61 86 b6 d6 74 50 ee da 96 95 a5 3c f5 c0 6a 8b 66 97 a6 ff 0c 5a 34 7f 87 68 86 fb 05 2d cc d0 56 b4 83 cb 83 36 64 c8 46 b6 e7 a4 48 21 38 dc a4 39 3d f7 f0 b1 39 c0 47 c0 30 93 d6 70 ca 68 e0 d9 0c f7 2d 63 cf 65 c6 d9 fa cf 5e 2e cb b7 02 df 0d 4e 07 10 11 11 29 40 3f 02 ee 70 3a 44 86 ba 00 3f 20 55 c8 fa 9d 50 32 fe 77 33 86 86 92 f1 55 61 af ff 1c 60 02 70 3d 70 b0 19 73 5d 66 1b b0 12 58 4e ea 71 Data Ascii: FDwWn?:xLW_t3\?qrx_.>'N;CURa^.#ZaWsQmBlD3/hatP<jfZ4h-V6dFH!89=9G0ph-ce^.N)@?p:D? UP2w3Ua`p=ps]fXNq
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 46 f7 62 7c 68 e4 e1 9e 73 27 ec f1 92 97 de 5d c8 e5 91 07 59 b3 69 23 b0 1d 4f fa 39 a1 85 7c ce 6e dd 7f 28 5b f7 1f 8a 11 6d e4 de 59 bf 67 f3 e6 cd dc 78 d3 4d 4e c7 2a 3a 3d ba 75 e7 5b c7 9e c4 d7 0e af e0 dc 07 7e cd 3b 79 5a e2 9b 6f cf ea 15 11 11 11 11 11 11 77 6a 6a ae 2a 25 55 ca 0b 3b 5f 74 1f 04 4a b1 b6 80 41 ac f7 6a 21 16 a5 96 97 cd 5d d2 d4 5c f5 2a 30 ce e9 2c 92 91 a3 d2 db d9 a4 8b 97 77 29 f6 5d cd ce 22 93 1d 7f 36 96 97 cd 5d 6d 63 3e 11 11 11 11 11 11 91 3d 09 da b8 56 bd 49 73 aa 4d 9a d3 91 a7 32 dc cf ce 9f dd 44 4d 98 51 6d c2 8c 4c cd cf a2 94 34 68 61 8e b6 ea b3 d8 37 68 51 86 1d a2 19 ee b7 04 77 fe 9c 30 a3 db d8 86 22 e4 b6 a2 26 cd 09 9a 34 a7 23 51 9b d6 11 c9 07 9d 2d de 6d ab 53 4f 3d ad 49 c4 5a 23 be c0 5f 81 2b Data Ascii: Fb\|hs']Yi#O9\|n([mYgxMN:=u[~;yZowjj%U;_tJAj!]\*0,w)]"6]mc>=VIsM2DMQmL4ha7hQw0"&4#Q-mSO=IZ#_+
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 4f 2d 83 02 f1 e8 f6 ba c2 a2 e7 01 fc d8 c4 2c b2 69 da 17 44 44 44 44 44 44 44 44 64 3d 7e 78 db e6 d2 fd 49 b1 5d 7f d2 4c d9 42 91 1d 80 c8 21 b2 e3 b1 12 6e 59 8f 33 8f 3b 16 eb b6 ac cf 98 02 df dc 11 23 f0 ed 11 a3 f0 34 3f b7 41 8e 97 1d cf 43 56 e3 7b 71 22 22 22 22 22 22 a2 8c d6 01 a0 da 82 75 f2 2d 58 43 2f 2b 32 55 43 3d e1 43 cf 09 ab 44 44 8e d1 b8 7a 55 ad ec 0c e9 4a 7e 0f a3 65 e7 a0 9e d5 37 ae c8 29 bb f7 8e a7 67 dd 71 ef 0f 64 67 21 ca 56 1b 3a db c4 8b 0d af 35 96 4d 9a 62 4a 99 f6 9a 4f 3e fe 95 19 f3 92 7c a1 b7 5e 1f 56 39 bb aa b4 7c ea f4 6a d9 59 88 1c a4 18 40 02 f6 ff 59 42 07 80 62 e5 a7 ef 86 64 07 f9 9a 12 57 05 e4 5d 50 49 ef 05 4e 5c 50 ef 73 7b 51 0b 90 6b 61 ff e3 10 28 71 3d 84 9a 44 a9 c9 ab 54 c3 da 62 6d e3 3f ae Data Ascii: O-,iDDDDDDDDd=~xI]LB!nY3;#4?ACV{q""""""u-XC/+2UC=CDDzUJ~e7)gqdg!V:5MbJO>\|^V9\|jY@YBbdW]PIN\Ps{Qka(q=DTbm?
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 84 c8 81 fa 21 e5 be 74 40 2d e9 ed 96 a2 28 b5 42 88 0a f4 7d 82 e2 10 a8 c7 40 8f 73 11 75 47 08 e1 82 f6 63 35 d4 cb d7 43 50 8f bf be 8a ec 86 08 21 8a 15 45 a9 d5 b0 a6 13 15 43 2d f4 d3 7a 52 71 48 08 e1 32 a3 b4 35 59 1e ab e7 b5 c4 67 e7 f2 58 45 51 12 c9 e7 43 ad a5 60 43 a0 9e 30 e4 35 29 52 af 92 8f ad 0a 1d 9b cc 57 14 25 64 4a 18 22 b2 52 71 5e 6e 43 42 76 88 83 f8 64 07 30 90 0f 26 9f 24 a7 55 5e 6e 43 a2 a5 75 5c 29 b4 5d bc 80 88 48 b7 a7 5e 5b 72 ab ec 0c 05 67 9d 5b ac 67 7c f9 d4 e9 d5 6f be f3 76 b9 ec e2 e1 37 df 79 bb 1c fc d9 88 63 3d 16 5a 34 63 d0 11 83 1a 6f 9f 52 56 27 3b 0b 91 91 f2 4e ce 9d 0f b5 a4 c0 31 a6 4d 9e fa c6 5b 8d b1 8d a1 b7 5e 1f 26 3b 0b 75 af be 71 45 4e 7d e3 8a 9b 9e 5f 5e 3f 71 7c a1 e7 cd d3 f2 47 4e 2c 9b Data Ascii: !t@-(B}@suGc5CP!EC-zRqH25YgXEQC`C05)RW%dJ"Rq^nCBvd0&$U^nCu\)]H^[rg[g\|ov7yc=Z4coRV';N1M[^&;uqEN}_^?q\|GN,
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 2b d5 38 ae da c4 0c 5a 55 03 28 d7 30 6e a2 10 a2 54 51 94 76 73 e3 c8 21 84 28 80 b1 f7 c7 18 21 44 b5 a2 28 a5 06 ce 99 89 8a 91 7e 39 62 71 a6 1e 97 44 19 2a 23 ca 7b 93 e5 ae e3 65 e7 b0 b1 f1 2d ad e3 0a 9c 7c 3f b3 c4 97 c8 f9 66 3e 3a 7b ec 9c 67 17 f1 b9 da 61 fe fe c2 93 93 86 9d 70 e2 3d 65 93 a6 34 cb ce e2 44 07 8a 37 9d 54 e2 1b 5d b3 6a 50 f3 c6 d6 85 bb 76 ef 2a b8 a7 ec f6 db 64 e7 21 e7 bb 6f ce ac 80 dd 1e 03 83 8f 3e 46 d3 2f a5 3f 59 df f2 3b 99 af 5d 13 0a 2e 6a 67 81 af ea f4 fc 51 5b 9b 5a 9b 87 c9 ce 41 44 19 ca fc c2 d1 43 85 7b fc 4a 89 ab 18 c0 e3 69 ce bf 2c cd ed 0f 55 8b 9a 44 6d af 23 ec b4 0f b5 f3 1a 30 87 56 cb 34 15 99 aa fb 31 dd 8b 2c ca e6 35 79 fe b0 8e b1 5e 93 32 d8 49 38 c5 ed 0a 0c cc d0 93 90 05 6b 10 11 11 11 Data Ascii: +8ZU(0nTQvs!(!D(~9bqD#{e-\|?f>:{gap=e4D7T]jPvd!o>F/?Y;].jgQ[ZADC{Ji,UDm#0V41,5y^2I8k
2024-04-18 07:46:20 UTC	12657	IN	Data Raw: fa 5f fc f7 73 4b 8e b5 aa 5c 3c 38 74 e2 b2 1f fb f1 7b 2f dc 5a f9 f7 ed f3 09 10 b1 ab 32 10 ad bf af ef 95 46 97 e6 d4 ba 34 67 29 8d 25 57 b4 ce 61 27 bf d4 71 a5 1a 5d 98 51 ed c2 8c bc a6 63 a2 d9 5c 72 55 f1 e7 b1 d1 e1 fa a9 e8 ed f3 9a 47 a3 83 b5 b5 82 32 64 69 f4 70 af 6e 1b ee e2 ac c9 2e ce 02 00 00 00 00 00 00 00 80 dc 7c b8 a1 cf 25 25 1f 0f 00 00 2c 8f f7 e2 40 5e f3 8a 7c 47 a3 55 ae b8 b9 bc 44 a7 98 8e d6 87 9f 26 db 59 8b 34 1a f9 1e fb 6c f8 40 56 44 eb 1c e4 2d ef 1c 0b e7 6c 29 07 d2 34 9d ca b9 76 34 e7 ba 59 c5 c9 11 d1 59 49 f9 68 e4 bc 56 db 45 ca f5 0e 72 1c 48 d3 74 ac 83 f5 7d 2d 4d d3 b1 24 49 6a 91 ff c3 fe 3b 92 24 69 b8 26 01 32 4d 46 c4 50 d9 21 58 b1 a1 68 bd ef 18 2d 37 06 50 94 7d b7 dd 3c da 2f e5 81 17 0f 0e 9d 50 Data Ascii: _sK\<8t{/Z2F4g)%Wa'q]Qc\rUG2dipn.\|%%,@^\|GUD&Y4l@VD-l)4v4YYIhVErHt}-M$Ij;$i&2MFP!Xh-7P}</P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49709	3.161.150.4	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	728	OUT	GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=a37c HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:20 UTC	1475	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:46:20 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Miss from cloudfront Via: 1.1 e9b0912bfb25a87d9798160f6315bd3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: kV7OR37g4TQtobXgtMf7bsFwr5Fq1YUzsIyGFIegeCJzo5jOU5uiiw== Vary: Origin
2024-04-18 07:46:20 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49708	3.161.150.4	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	608	OUT	GET /asset/notice.js/v/v1.7-3185 HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dickssportinggoods.cashstar.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:20 UTC	582	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 94379 Connection: close Last-Modified: Tue, 19 Mar 2024 02:16:13 GMT Pragma: public Date: Thu, 18 Apr 2024 07:46:20 GMT Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 57674a900f587a3a1f1571205e001c6c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: GLq-B3-RzujPSyd1FU8bj52SZxH5qR8KPHHYQBflA4pqQnyAJLWbhg== Age: 375 Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: max-age=2592000 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 74 72 75 73 74 65 5f 65 75 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 67 3d 74 72 75 73 74 65 2e 65 75 2e 62 69 6e 64 4d 61 70 3b 67 2e 66 65 61 74 2e 69 73 43 6f 6e 73 65 6e 74 52 65 74 72 69 65 76 65 64 3d 67 2e 66 65 61 74 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 3f 67 2e 66 65 61 74 2e 69 73 43 6f 6e 73 65 6e 74 52 65 74 72 69 65 76 65 64 3a 21 30 3b 69 66 28 21 74 2e 64 6f 6e 65 26 26 74 72 75 73 74 65 2e 75 74 69 6c 2e 69 73 43 6f 6e 73 65 6e 74 52 65 73 6f 6c 76 65 64 28 29 29 7b 74 2e 64 6f 6e 65 3d 21 30 3b 76 61 72 20 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 63 3d 74 72 75 73 74 65 2e 75 74 69 6c 2e 72 65 61 64 43 6f 6f 6b 69 Data Ascii: function _truste_eu(){function t(){var g=truste.eu.bindMap;g.feat.isConsentRetrieved=g.feat.crossDomain?g.feat.isConsentRetrieved:!0;if(!t.done&&truste.util.isConsentResolved()){t.done=!0;var k=function(){var a=(new Date).getTime(),c=truste.util.readCooki
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 65 2e 75 74 69 6c 2e 63 72 65 61 74 65 43 6f 6f 6b 69 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 74 72 75 73 74 65 2e 75 74 69 6c 2e 63 6f 6f 6b 69 65 26 26 21 65 26 26 28 62 3d 74 72 75 73 74 65 2e 75 74 69 6c 2e 63 6f 6f 6b 69 65 2e 63 6f 6e 76 65 72 74 28 62 29 29 3b 65 3d 74 72 75 73 74 65 2e 65 75 2e 62 69 6e 64 4d 61 70 7c 7c 7b 7d 3b 76 61 72 20 66 3d 0a 22 3b 20 65 78 70 69 72 65 73 3d 22 2c 6c 3b 63 3f 22 30 22 3d 3d 63 3f 66 3d 22 22 3a 28 6c 3d 6e 65 77 20 44 61 74 65 28 63 29 2c 66 2b 3d 63 29 3a 28 6c 3d 6e 65 77 20 44 61 74 65 2c 6c 2e 73 65 74 44 61 74 65 28 6c 2e 67 65 74 44 61 74 65 28 29 2b 65 2e 63 6f 6f 6b 69 65 45 78 70 69 72 79 29 2c 66 2b 3d 6c 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 29 3b 64 26 26 74 72 75 Data Ascii: e.util.createCookie=function(a,b,c,d,e){truste.util.cookie&&!e&&(b=truste.util.cookie.convert(b));e=truste.eu.bindMap\|\|{};var f="; expires=",l;c?"0"==c?f="":(l=new Date(c),f+=c):(l=new Date,l.setDate(l.getDate()+e.cookieExpiry),f+=l.toGMTString());d&&tru
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 66 63 6c 6f 73 65 62 75 74 74 6f 6e 28 29 2c 74 72 75 73 74 65 2e 65 75 2e 63 70 72 61 2e 73 68 6f 75 6c 64 53 68 6f 77 46 69 6e 50 72 6f 67 28 29 3f 74 72 75 73 74 65 2e 65 75 2e 63 6c 69 63 6b 4c 69 73 74 65 6e 65 72 28 37 2c 21 30 2c 7b 63 70 72 61 43 6f 6e 73 65 6e 74 3a 22 30 22 2c 63 70 72 61 53 6f 75 72 63 65 3a 22 6f 70 74 6f 75 74 2d 63 6c 6f 73 65 22 7d 29 3a 74 72 75 73 74 65 2e 75 74 69 6c 2e 6f 70 74 6f 75 74 52 65 71 75 69 72 65 64 28 29 29 7d 29 3b 0a 74 72 75 73 74 65 2e 65 75 2e 6e 6f 74 69 63 65 4c 50 2e 6f 63 6c 6f 73 65 26 26 22 66 61 6c 73 65 22 21 3d 74 72 75 73 74 65 2e 65 75 2e 6e 6f 74 69 63 65 4c 50 2e 6f 63 6c 6f 73 65 26 26 28 66 3d 73 65 6c 66 2e 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 74 72 75 Data Ascii: fclosebutton(),truste.eu.cpra.shouldShowFinProg()?truste.eu.clickListener(7,!0,{cpraConsent:"0",cpraSource:"optout-close"}):truste.util.optoutRequired())});truste.eu.noticeLP.oclose&&"false"!=truste.eu.noticeLP.oclose&&(f=self.document.getElementById(tru
2024-04-18 07:46:20 UTC	14808	IN	Data Raw: 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 3b 74 72 75 73 74 65 2e 75 74 69 6c 2e 65 72 72 6f 72 28 61 2c 62 2c 63 29 7d 3b 74 72 75 73 74 65 2e 65 75 2e 61 70 70 6c 79 43 53 53 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 29 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 2e 73 74 79 6c 65 5b 63 5d 3d 61 5b 63 5d 7d 3b 74 72 75 73 74 65 2e 65 75 2e 63 72 65 61 74 65 50 72 65 66 56 69 65 77 53 74 79 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 73 65 6c 66 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 64 3d 32 2a 74 72 75 73 74 65 2e 65 75 2e 66 69 6e 64 48 69 67 68 65 73 74 5a 49 6e 64 65 78 28 22 64 69 76 22 29 2c 65 3d 4d 61 74 68 2e 6d 69 6e 28 32 31 34 37 34 38 Data Ascii: self.location.pathname;truste.util.error(a,b,c)};truste.eu.applyCSS=function(a,b){if(a)for(var c in a)b.style[c]=a[c]};truste.eu.createPrefViewStyle=function(a,b){var c=self.document.documentElement,d=2*truste.eu.findHighestZIndex("div"),e=Math.min(214748
2024-04-18 07:46:20 UTC	16384	IN	Data Raw: 6e 2e 68 6f 73 74 6e 61 6d 65 3b 74 72 79 7b 61 3f 74 72 75 73 74 65 2e 75 74 69 6c 2e 68 74 74 70 52 65 71 75 65 73 74 28 74 72 75 73 74 65 2e 65 75 2e 55 53 45 52 5f 43 4f 4e 53 45 4e 54 5f 43 45 4e 54 45 52 5f 53 45 52 56 45 52 2b 68 2c 22 50 4f 53 54 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 75 73 65 72 5f 69 64 3a 61 2c 75 73 65 72 5f 70 72 65 66 65 72 65 6e 63 65 73 3a 62 2c 64 6f 6d 61 69 6e 3a 63 2c 66 69 6e 61 6e 63 69 61 6c 5f 70 72 6f 67 72 61 6d 3a 64 2c 0a 63 72 6f 73 73 5f 64 6f 6d 61 69 6e 3a 65 2c 63 6f 6f 6b 69 65 5f 64 61 74 65 3a 44 61 74 65 2e 6e 6f 77 28 29 2c 6f 70 74 6f 75 74 5f 64 6f 6d 61 69 6e 73 3a 66 7c 7c 22 22 2c 73 69 74 65 3a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 63 6f 6f 6b Data Ascii: n.hostname;try{a?truste.util.httpRequest(truste.eu.USER_CONSENT_CENTER_SERVER+h,"POST",JSON.stringify({user_id:a,user_preferences:b,domain:c,financial_program:d,cross_domain:e,cookie_date:Date.now(),optout_domains:f\|\|"",site:window.location.hostname,cook
2024-04-18 07:46:20 UTC	14035	IN	Data Raw: 63 6f 6e 73 65 6e 74 7d 3b 74 68 69 73 2e 74 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 44 69 64 20 67 65 74 43 6f 6e 73 65 6e 74 20 41 50 49 20 63 61 6c 6c 20 66 6f 72 3a 20 22 2b 64 2b 22 20 66 72 6f 6d 3a 20 22 2b 28 74 68 69 73 2e 63 61 64 64 79 7c 7c 7b 7d 29 2e 66 72 6f 6d 2b 22 2c 20 67 6f 74 20 72 65 73 75 6c 74 3a 20 22 2c 6d 29 3b 30 3c 65 26 26 28 6d 2e 6f 72 69 67 69 6e 3d 63 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 29 3b 72 65 74 75 72 6e 20 6d 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 74 68 69 73 2e 73 65 63 6f 6e 64 61 72 79 41 63 74 69 6f 6e 28 61 2c 62 2c 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 61 72 67 75 6d 65 6e 74 73 5b 33 5d 29 7d 7d 3b 64 2e 70 72 6f 63 65 73 73 4d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c Data Ascii: consent};this.tconsole.log("Did getConsent API call for: "+d+" from: "+(this.caddy\|\|{}).from+", got result: ",m);0<e&&(m.origin=c.location.hostname);return m;default:return this.secondaryAction(a,b,arguments[2],arguments[3])}};d.processMessage=function(a,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49711	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	726	OUT	GET /recipient-experience/static/js/iovationBB.js HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:20 UTC	706	IN	HTTP/1.1 200 OK Connection: close Content-Length: 185 x-amz-id-2: Drf1SEZ+pUu7P/a3/kpBGw4NeaVHpLPym5lMWJBWTrwwFnlqaYJfSVI2/Sg877199IrLiDhrVCE= x-amz-request-id: 9C449CB89591HRVE x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:27:15 GMT ETag: "a1c911138cc758a5597d8ca9dcc074f5" x-amz-server-side-encryption: AES256 x-amz-version-id: McMkQDoC6qdqrEvFK44dX2avynGF0hzG Content-Type: application/javascript Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:20 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130032-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426381.691270,VS0,VE94 Vary: Accept-Encoding
2024-04-18 07:46:20 UTC	185	IN	Data Raw: 76 61 72 20 69 6f 5f 69 6e 73 74 61 6c 6c 5f 73 74 6d 3d 21 31 2c 69 6f 5f 69 6e 73 74 61 6c 6c 5f 66 6c 61 73 68 3d 21 31 2c 69 6f 5f 65 6e 61 62 6c 65 5f 72 69 70 3d 21 30 2c 69 6f 5f 62 62 5f 63 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 69 2c 6e 29 7b 69 66 28 6e 29 7b 63 6f 6e 73 74 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 69 6f 76 61 74 69 6f 6e 5f 62 6c 61 63 6b 62 6f 78 22 29 3b 6c 26 26 28 6c 2e 76 61 6c 75 65 3d 69 29 7d 7d 7d 28 29 3b Data Ascii: var io_install_stm=!1,io_install_flash=!1,io_enable_rip=!0,io_bb_callback=function(){return function(i,n){if(n){const l=document.getElementById("iovation_blackbox");l&&(l.value=i)}}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49710	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	634	OUT	GET /media/webfont/DICKS.json HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://dickssportinggoods.cashstar.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:20 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 126 x-amz-id-2: q+3E9Lr8F9aABhblClClHLH0phr6Cu/VfCvKgECqmHvHFv1uMmaAAy5mHF6Vj3mAd4isrTW5xNc= x-amz-request-id: 9C46JBJEPQEHHBF3 Access-Control-Allow-Methods: GET Access-Control-Expose-Headers: Content-Length, Content-Type, Date Access-Control-Max-Age: 0 x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:29:00 GMT ETag: "d87bb4b83caf10a10c1843ef3f55334a" x-amz-server-side-encryption: AES256 x-amz-version-id: g0gEP9eAho_1mtH6e6bY5aULae2qeOWw Content-Type: application/json Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:20 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kpdk1780074-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426381.695741,VS0,VE82 Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
2024-04-18 07:46:20 UTC	126	IN	Data Raw: 7b 22 63 75 73 74 6f 6d 22 3a 7b 22 66 61 6d 69 6c 69 65 73 22 3a 5b 22 44 53 47 53 61 6e 73 2d 42 6c 61 63 6b 22 5d 2c 22 75 72 6c 73 22 3a 5b 22 3c 53 54 41 54 49 43 5f 4d 45 44 49 41 5f 55 52 4c 3e 2f 66 6f 6e 74 73 2f 44 49 43 4b 53 2f 66 6f 6e 74 73 2e 63 38 34 34 62 63 65 33 31 65 37 64 32 61 39 66 33 65 61 64 34 63 66 66 63 64 38 66 34 65 39 33 2e 63 73 73 22 5d 7d 7d Data Ascii: {"custom":{"families":["DSGSans-Black"],"urls":["<STATIC_MEDIA_URL>/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css"]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49712	52.42.97.191	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:20 UTC	542	OUT	GET /snare.js HTTP/1.1 Host: mpsnare.iesnare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:21 UTC	511	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 07:46:21 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 38567 Connection: close Set-Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=;Path=/;Expires=Fri, 18-Apr-2025 07:46:21 GMT;Max-Age=31536000;Secure;HttpOnly;SameSite=None Cache-Control: no-cache, private Pragma: no-cache Expires: 0 p3p: CP="NON DSP COR CURa" Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-04-18 07:46:21 UTC	15873	IN	Data Raw: 2f 2a 20 43 6f 70 79 72 69 67 68 74 28 63 29 20 32 30 31 36 2c 20 69 6f 76 61 74 69 6f 6e 2c 20 69 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 20 2a 2f 20 77 69 6e 64 6f 77 2e 69 6f 5f 6c 61 73 74 5f 65 72 72 6f 72 3d 22 22 3b 76 61 72 20 5f 69 5f 61 3d 28 77 69 6e 64 6f 77 2e 69 6f 5f 67 6c 6f 62 61 6c 5f 6f 62 6a 65 63 74 5f 6e 61 6d 65 7c 7c 22 49 47 4c 4f 4f 22 29 2c 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 3d 22 69 6f 22 3b 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 3d 28 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 7c 7c 7b 7d 29 3b 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 5b 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 5d 3d 28 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 5b 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 5d 7c 7c 7b 7d 29 3b 66 75 6e Data Ascii: /* Copyright(c) 2016, iovation, inc. All rights reserved */ window.io_last_error="";var _i_a=(window.io_global_object_name\|\|"IGLOO"),localObjectName="io";window[_i_a]=(window[_i_a]\|\|{});window[_i_a][localObjectName]=(window[_i_a][localObjectName]\|\|{});fun
2024-04-18 07:46:21 UTC	1024	IN	Data Raw: 34 30 30 30 30 2c 30 78 32 2c 30 78 34 30 30 30 32 2c 30 78 32 2c 30 78 34 30 30 30 32 2c 30 78 32 30 30 30 30 30 30 2c 30 78 32 30 34 30 30 30 30 2c 30 78 32 30 30 30 30 30 30 2c 30 78 32 30 34 30 30 30 30 2c 30 78 32 30 30 30 30 30 32 2c 30 78 32 30 34 30 30 30 32 2c 30 78 32 30 30 30 30 30 32 2c 30 78 32 30 34 30 30 30 32 5d 3b 76 61 72 20 5f 69 5f 63 6a 3d 5b 30 2c 30 78 31 30 30 30 30 30 30 30 2c 30 78 38 2c 30 78 31 30 30 30 30 30 30 38 2c 30 2c 30 78 31 30 30 30 30 30 30 30 2c 30 78 38 2c 30 78 31 30 30 30 30 30 30 38 2c 30 78 34 30 30 2c 30 78 31 30 30 30 30 34 30 30 2c 30 78 34 30 38 2c 30 78 31 30 30 30 30 34 30 38 2c 30 78 34 30 30 2c 30 78 31 30 30 30 30 34 30 30 2c 30 78 34 30 38 2c 30 78 31 30 30 30 30 34 30 38 5d 3b 76 61 72 20 5f 69 5f 63 Data Ascii: 40000,0x2,0x40002,0x2,0x40002,0x2000000,0x2040000,0x2000000,0x2040000,0x2000002,0x2040002,0x2000002,0x2040002];var _i_cj=[0,0x10000000,0x8,0x10000008,0,0x10000000,0x8,0x10000008,0x400,0x10000400,0x408,0x10000408,0x400,0x10000400,0x408,0x10000408];var _i_c
2024-04-18 07:46:21 UTC	7639	IN	Data Raw: 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 32 34 29 7c 28 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 31 36 29 7c 28 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 38 29 7c 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3b 5f 69 5f 61 77 3d 28 28 5f 69 5f 62 70 3e 3e 3e 34 29 5e 20 5f 69 5f 62 71 29 26 30 78 30 66 30 66 30 66 30 66 3b 5f 69 5f 62 71 20 5e 3d 5f 69 5f 61 77 3b 5f 69 5f 62 70 20 5e 3d 28 5f 69 5f 61 77 3c 3c 34 29 3b 5f 69 5f 61 77 3d 28 28 5f 69 5f 62 71 3e 3e 3e 2d 31 36 29 5e 20 5f 69 5f 62 70 29 26 30 78 30 30 30 30 66 66 66 66 3b 5f 69 5f 62 70 20 5e 3d 5f 69 5f 61 77 3b 5f 69 5f 62 71 20 5e Data Ascii: if_hb.charCodeAt(_i_bi++)<<24)\|(_if_hb.charCodeAt(_i_bi++)<<16)\|(_if_hb.charCodeAt(_i_bi++)<<8)\|_if_hb.charCodeAt(_i_bi++);_i_aw=((_i_bp>>>4)^ _i_bq)&0x0f0f0f0f;_i_bq ^=_i_aw;_i_bp ^=(_i_aw<<4);_i_aw=((_i_bq>>>-16)^ _i_bp)&0x0000ffff;_i_bp ^=_i_aw;_i_bq ^
2024-04-18 07:46:21 UTC	14031	IN	Data Raw: 74 3e 27 3b 5f 69 5f 64 6d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 5f 69 5f 64 6e 3b 5f 69 5f 64 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 5f 69 5f 64 6d 29 3b 74 68 69 73 2e 5f 69 5f 67 6d 3d 74 72 75 65 3b 7d 2c 72 65 61 64 79 53 74 61 74 65 43 68 61 6e 67 65 48 61 6e 64 6c 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 69 5f 64 6f 3d 77 69 6e 64 6f 77 2e 65 76 65 6e 74 2e 73 72 63 45 6c 65 6d 65 6e 74 3b 69 66 28 74 68 69 73 2e 5f 69 5f 67 6c 7c 7c 5f 69 5f 64 6f 2e 72 65 61 64 79 53 74 61 74 65 21 3d 34 29 72 65 74 75 72 6e 3b 74 72 79 7b 5f 69 5f 63 72 2e 5f 5f 69 66 5f 65 6a 28 5f 69 5f 64 6f 2e 69 6f 42 65 67 69 6e 28 29 29 3b 7d 63 61 74 63 68 28 63 6f 75 6c 64 4e 6f 74 55 73 65 41 78 45 78 63 65 70 74 69 6f 6e 29 7b 7d 74 68 69 73 2e 5f 69 5f Data Ascii: t>';_i_dm.innerHTML=_i_dn;_i_dl.appendChild(_i_dm);this._i_gm=true;},readyStateChangeHandler:function(){var _i_do=window.event.srcElement;if(this._i_gl\|\|_i_do.readyState!=4)return;try{_i_cr.__if_ej(_i_do.ioBegin());}catch(couldNotUseAxException){}this._i_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49716	3.161.150.100	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	477	OUT	GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=a37c HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:21 UTC	1482	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:46:20 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Hit from cloudfront Via: 1.1 cb93f4bc2082611069ebd0473885e074.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: xPS49iFKdpd9nuMYqv2DA6s7zHSVnNYzZlqFt7SBiibwyz8KffASRA== Age: 1 Vary: Origin
2024-04-18 07:46:21 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49715	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	756	OUT	GET /media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:21 UTC	733	IN	HTTP/1.1 200 OK Connection: close Content-Length: 285 x-amz-id-2: YIIjX3Agj378FLGMW1u/NVybB68Y4NN17MspWBUwMG9lf4m7jLg9cI5s5kS6WfvXqDZiUBZHbNk= x-amz-request-id: S283BZYBT6C2F3AW x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:28:55 GMT ETag: "c844bce31e7d2a9f3ead4cffcd8f4e93" x-amz-server-side-encryption: AES256 x-amz-version-id: gN6GQpxrAfSV3742oRstfm4TilqrvESP Content-Type: text/css Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:21 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130083-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426381.203665,VS0,VE113 Vary: Accept-Encoding Cache-Control: public,max-age=31536000
2024-04-18 07:46:21 UTC	285	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 44 53 47 53 61 6e 73 2d 42 6c 61 63 6b 27 3b 0a 20 20 73 72 63 3a 75 72 6c 28 2f 6d 65 64 69 61 2f 66 6f 6e 74 73 2f 44 49 43 4b 53 2f 44 53 47 53 61 6e 73 2d 42 6c 61 63 6b 2d 37 33 64 39 39 34 66 63 34 31 63 62 66 36 35 66 38 34 31 34 36 30 39 64 31 30 62 39 61 63 63 64 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 0a 20 20 75 72 6c 28 2f 6d 65 64 69 61 2f 66 6f 6e 74 73 2f 44 49 43 4b 53 2f 44 53 47 53 61 6e 73 2d 42 6c 61 63 6b 2d 38 64 31 63 30 65 65 34 33 32 33 63 30 62 30 35 61 32 39 66 61 66 63 30 34 61 31 39 30 63 31 63 2e 77 6f 66 66 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f Data Ascii: @font-face { font-family:'DSGSans-Black'; src:url(/media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2) format('woff2'), url(/media/fonts/DICKS/DSGSans-Black-8d1c0ee4323c0b05a29fafc04a190c1c.woff) format('woff'); font-weight: no

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49717	3.161.150.4	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	769	OUT	GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.2006570593677508&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:21 UTC	1475	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:46:21 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Miss from cloudfront Via: 1.1 837baeb3003427e58f2f96283f64c760.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: ALiij9e7Thks53DB1_wIcnuqzO9Nw7xBWDiT4yZ6twq4dUG6n8sxrg== Vary: Origin
2024-04-18 07:46:21 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49718	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	516	OUT	GET /media/webfont/DICKS.json HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:21 UTC	700	IN	HTTP/1.1 200 OK Connection: close Content-Length: 126 x-amz-id-2: 385ii2PYP1SkpQZP2wwz52bSUro0YIjTR/jaoYByXijDM7TEZS0uDnSPTMUHkq/Bs+0EzeducAk= x-amz-request-id: S284BGVCPG8Y9B1K x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:29:00 GMT ETag: "d87bb4b83caf10a10c1843ef3f55334a" x-amz-server-side-encryption: AES256 x-amz-version-id: g0gEP9eAho_1mtH6e6bY5aULae2qeOWw Content-Type: application/json Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:21 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130034-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426381.311187,VS0,VE28 Vary: Accept-Encoding
2024-04-18 07:46:21 UTC	126	IN	Data Raw: 7b 22 63 75 73 74 6f 6d 22 3a 7b 22 66 61 6d 69 6c 69 65 73 22 3a 5b 22 44 53 47 53 61 6e 73 2d 42 6c 61 63 6b 22 5d 2c 22 75 72 6c 73 22 3a 5b 22 3c 53 54 41 54 49 43 5f 4d 45 44 49 41 5f 55 52 4c 3e 2f 66 6f 6e 74 73 2f 44 49 43 4b 53 2f 66 6f 6e 74 73 2e 63 38 34 34 62 63 65 33 31 65 37 64 32 61 39 66 33 65 61 64 34 63 66 66 63 64 38 66 34 65 39 33 2e 63 73 73 22 5d 7d 7d Data Ascii: {"custom":{"families":["DSGSans-Black"],"urls":["<STATIC_MEDIA_URL>/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css"]}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49719	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	520	OUT	GET /media/images/DICKS/DICKS.png HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:21 UTC	673	IN	HTTP/1.1 200 OK Connection: close Content-Length: 160113 x-amz-id-2: +UibiJES5xqhMMCGPMfOrkR6t0V4vfFomAJkm7HuqekF5/Qr89g+guTuavWKhKh6F6G9kENDBUM= x-amz-request-id: NEAVY8PM27B0SF60 x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:30:18 GMT ETag: "970205d9dbae569e6b69a49d1b2459dc" x-amz-server-side-encryption: AES256 x-amz-version-id: PXdz_Ks9b2CZNKhi8IuKnrwiDitiVQ3h Content-Type: image/png Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 18 Apr 2024 07:46:21 GMT Via: 1.1 varnish Age: 165 X-Served-By: cache-pdk-kfty2130039-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1713426381.312089,VS0,VE1
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 15 f0 00 00 02 d0 08 06 00 00 00 71 c7 95 04 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 04 f5 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 31 2d 63 30 30 31 20 37 39 2e 31 34 36 32 38 39 39 37 37 37 2c 20 32 30 32 33 2f 30 36 2f 32 35 2d 32 33 3a 35 37 3a 31 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 Data Ascii: PNGIHDRqpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rd
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: f2 4f 1c d4 a9 82 cf e5 81 b3 5f 4a 69 7b 0c 8a 55 b7 b5 9b 64 59 9a 2b 5c ed c6 a0 70 75 4f bb 71 96 9e 94 d2 e6 18 dc 5f 3b db 4d b2 ac 6c 8b 88 cf a4 94 7e 25 22 76 15 45 71 b0 e5 3c 00 00 0b 7a e8 c0 35 5b 63 f0 79 5f 15 ae 7b e5 e5 77 ee ab 68 17 2c 4b 3f fe 8e 9f 7c a2 ed 0c 4b c9 5c e9 dd fc d7 cd 15 e0 45 44 9c 2d 25 78 ef fa f9 eb 67 be fe c8 81 ad 4d 9f fb 8a 4b 2e df f7 ff fe ab 5f e9 34 7d 6e 5b 7e f6 7d 37 7f 70 e6 af fe e2 1f b4 71 f6 7f fa d0 7f b8 e0 4c 1f db d6 fd 71 36 19 fd 58 32 ff e3 c8 4d ef 79 ef ad ad 05 ab 48 ea bc a2 95 7f 9e f5 ee bf fb 53 bb 7f f5 e6 f7 67 6d 9c bd dc fd d3 9b fe 79 7e db 27 3e d6 54 21 db 09 8a 99 af 9f 95 5f 44 7c ff 6f 7c e0 4d 4f 3e fd d4 df 7a ec e0 13 7f e3 81 87 1e dc 76 cf d7 ee db f4 f0 93 4f b4 f6 77 Data Ascii: O_Ji{UdY+\puOq_;Ml~%"vEq<z5[cy_{wh,K?\|K\ED-%xgMK._4}n[~}7pqLq6X2MyHSgmy~'>T!_D\|o\|MO>zvOw
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 6d 8f 1b 36 d0 a7 fd 93 ce cd c2 9b 9b 05 fe f9 11 d0 ae f4 d6 5b 8a eb f9 af 1b ad a5 be ad 85 b9 ad 1d ba de f3 a4 db 7b 6a 5f c8 2b a5 1b ff db 79 0a 00 30 33 2f ba 75 5f 29 bb 39 01 03 93 05 ce c9 30 a3 e4 3f c7 20 a5 db b3 06 3a ae df 55 79 6f 73 c9 af bb 75 8d b6 d9 5b ce 97 90 12 38 78 4c e2 dd 2f 80 ab ae b9 06 53 a7 4d 83 c9 64 82 d9 64 42 5c 5c 1c c6 a4 f7 ee b5 96 91 66 33 46 0f 18 d8 a9 48 7d 68 bf 0c fc f0 b2 99 c8 48 ee 7c 3f 4d da 98 3b e5 26 14 e6 5e 8c 7e f1 f1 aa a3 10 51 df 56 a8 78 fd d5 52 ca 15 8a 33 90 7e 66 2b 5e bf 98 e5 d0 2d e6 a9 0e 00 f5 f7 37 44 44 44 a4 50 5d 7d 41 36 80 7b 54 e7 d0 50 71 5d 7d 81 45 75 08 22 52 67 d1 dd 0b 4a 66 5c 79 c3 b9 45 53 ae d9 a6 32 c7 ca 9a 75 16 95 eb 13 51 f0 0b a6 72 4e a2 9e 6c a9 dd 7e ad ea Data Ascii: m6[{j_+y03/u_)90? :Uyosu[8xL/SMddB\\f3FH}hH\|?M;&^~QVxR3~f+^-7DDDP]}A6{TPq]}Eu"RgJf\yES2uQrNl~
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 02 99 c0 5b 94 6b e4 e3 bd 0a 1f c7 d9 75 cc d0 95 0a 3f c6 da 75 ca 60 08 03 7e e6 0e 1f c7 d9 75 cc d0 51 ad 2c aa ae 09 70 8e 42 0d 72 f8 c3 61 f0 7a 44 a4 af 6b 8c 5e b0 3c 2f 7f 30 80 61 46 af ab 98 0b 40 e7 37 2b 10 11 11 11 05 9f 4b 35 98 63 12 00 5f 9e 67 ce d3 60 2d 22 0a cc 6d f0 ed f6 da 2c b6 e7 21 9a 98 59 66 b5 9d d3 d3 a0 32 ab 6d 18 80 35 30 ae bc 57 02 38 65 d0 5a 44 44 44 44 44 44 44 a4 31 16 f8 86 86 ec 5e ef 29 58 48 e6 0b 1e 0b ff f0 b8 b4 e2 f5 c4 83 b7 a1 ee f1 18 78 f4 74 f9 fb c5 c7 b7 8c 8d 8b 8a c1 b8 c1 23 15 a4 d4 c6 fe fd fb 51 55 b5 ae dd 36 b3 25 01 b1 e3 82 bb c0 d7 75 fa 0c 86 66 66 b6 64 16 42 e0 fb 3f fc 11 ae be f6 5a 44 7a 8b 71 87 0d 1b 8e c5 0f ff 12 e7 8d 1b 07 a7 d3 09 a7 d3 89 33 67 ce c0 e9 72 c1 e9 74 22 2d 3d Data Ascii: [ku?u`~uQ,pBrazDk^</0aF@7+K5c_g`-"m,!Yf2m50W8eZDDDDDDD1^)XHxt#QU6%uffdB?ZDzq3grt"-=
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 1d 46 44 9c 77 cd e5 57 be de b2 6e ed ed 3f ff d3 ac 9f 3a 9d a5 d8 d5 9e 78 fa e2 db a7 4c bd cc e9 1c 92 df c6 57 1c bb fa 96 c9 d7 5f e7 74 0e 11 33 5c 3f 71 72 78 e3 a6 8d 15 fa 1e 95 5f 2e ad 3e ff f6 eb 27 4e 0e 3b 9d 43 a4 00 55 db b8 d6 52 a3 b6 61 c9 5e 2e 0f da 94 23 1b d1 0c f6 09 5a 9c 61 57 af 1a b5 0d ab 73 9c 51 6d 42 8e 6c 44 33 dc 2f 68 61 86 b6 d6 74 50 ee da 96 95 a5 3c f5 c0 6a 8b 66 97 a6 ff 0c 5a 34 7f 87 68 86 fb 05 2d cc d0 56 b4 83 cb 83 36 64 c8 46 b6 e7 a4 48 21 38 dc a4 39 3d f7 f0 b1 39 c0 47 c0 30 93 d6 70 ca 68 e0 d9 0c f7 2d 63 cf 65 c6 d9 fa cf 5e 2e cb b7 02 df 0d 4e 07 10 11 11 29 40 3f 02 ee 70 3a 44 86 ba 00 3f 20 55 c8 fa 9d 50 32 fe 77 33 86 86 92 f1 55 61 af ff 1c 60 02 70 3d 70 b0 19 73 5d 66 1b b0 12 58 4e ea 71 Data Ascii: FDwWn?:xLW_t3\?qrx_.>'N;CURa^.#ZaWsQmBlD3/hatP<jfZ4h-V6dFH!89=9G0ph-ce^.N)@?p:D? UP2w3Ua`p=ps]fXNq
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 46 f7 62 7c 68 e4 e1 9e 73 27 ec f1 92 97 de 5d c8 e5 91 07 59 b3 69 23 b0 1d 4f fa 39 a1 85 7c ce 6e dd 7f 28 5b f7 1f 8a 11 6d e4 de 59 bf 67 f3 e6 cd dc 78 d3 4d 4e c7 2a 3a 3d ba 75 e7 5b c7 9e c4 d7 0e af e0 dc 07 7e cd 3b 79 5a e2 9b 6f cf ea 15 11 11 11 11 11 11 77 6a 6a ae 2a 25 55 ca 0b 3b 5f 74 1f 04 4a b1 b6 80 41 ac f7 6a 21 16 a5 96 97 cd 5d d2 d4 5c f5 2a 30 ce e9 2c 92 91 a3 d2 db d9 a4 8b 97 77 29 f6 5d cd ce 22 93 1d 7f 36 96 97 cd 5d 6d 63 3e 11 11 11 11 11 11 91 3d 09 da b8 56 bd 49 73 aa 4d 9a d3 91 a7 32 dc cf ce 9f dd 44 4d 98 51 6d c2 8c 4c cd cf a2 94 34 68 61 8e b6 ea b3 d8 37 68 51 86 1d a2 19 ee b7 04 77 fe 9c 30 a3 db d8 86 22 e4 b6 a2 26 cd 09 9a 34 a7 23 51 9b d6 11 c9 07 9d 2d de 6d ab 53 4f 3d ad 49 c4 5a 23 be c0 5f 81 2b Data Ascii: Fb\|hs']Yi#O9\|n([mYgxMN:=u[~;yZowjj%U;_tJAj!]\*0,w)]"6]mc>=VIsM2DMQmL4ha7hQw0"&4#Q-mSO=IZ#_+
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 4f 2d 83 02 f1 e8 f6 ba c2 a2 e7 01 fc d8 c4 2c b2 69 da 17 44 44 44 44 44 44 44 44 64 3d 7e 78 db e6 d2 fd 49 b1 5d 7f d2 4c d9 42 91 1d 80 c8 21 b2 e3 b1 12 6e 59 8f 33 8f 3b 16 eb b6 ac cf 98 02 df dc 11 23 f0 ed 11 a3 f0 34 3f b7 41 8e 97 1d cf 43 56 e3 7b 71 22 22 22 22 22 22 a2 8c d6 01 a0 da 82 75 f2 2d 58 43 2f 2b 32 55 43 3d e1 43 cf 09 ab 44 44 8e d1 b8 7a 55 ad ec 0c e9 4a 7e 0f a3 65 e7 a0 9e d5 37 ae c8 29 bb f7 8e a7 67 dd 71 ef 0f 64 67 21 ca 56 1b 3a db c4 8b 0d af 35 96 4d 9a 62 4a 99 f6 9a 4f 3e fe 95 19 f3 92 7c a1 b7 5e 1f 56 39 bb aa b4 7c ea f4 6a d9 59 88 1c a4 18 40 02 f6 ff 59 42 07 80 62 e5 a7 ef 86 64 07 f9 9a 12 57 05 e4 5d 50 49 ef 05 4e 5c 50 ef 73 7b 51 0b 90 6b 61 ff e3 10 28 71 3d 84 9a 44 a9 c9 ab 54 c3 da 62 6d e3 3f ae Data Ascii: O-,iDDDDDDDDd=~xI]LB!nY3;#4?ACV{q""""""u-XC/+2UC=CDDzUJ~e7)gqdg!V:5MbJO>\|^V9\|jY@YBbdW]PIN\Ps{Qka(q=DTbm?
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 84 c8 81 fa 21 e5 be 74 40 2d e9 ed 96 a2 28 b5 42 88 0a f4 7d 82 e2 10 a8 c7 40 8f 73 11 75 47 08 e1 82 f6 63 35 d4 cb d7 43 50 8f bf be 8a ec 86 08 21 8a 15 45 a9 d5 b0 a6 13 15 43 2d f4 d3 7a 52 71 48 08 e1 32 a3 b4 35 59 1e ab e7 b5 c4 67 e7 f2 58 45 51 12 c9 e7 43 ad a5 60 43 a0 9e 30 e4 35 29 52 af 92 8f ad 0a 1d 9b cc 57 14 25 64 4a 18 22 b2 52 71 5e 6e 43 42 76 88 83 f8 64 07 30 90 0f 26 9f 24 a7 55 5e 6e 43 a2 a5 75 5c 29 b4 5d bc 80 88 48 b7 a7 5e 5b 72 ab ec 0c 05 67 9d 5b ac 67 7c f9 d4 e9 d5 6f be f3 76 b9 ec e2 e1 37 df 79 bb 1c fc d9 88 63 3d 16 5a 34 63 d0 11 83 1a 6f 9f 52 56 27 3b 0b 91 91 f2 4e ce 9d 0f b5 a4 c0 31 a6 4d 9e fa c6 5b 8d b1 8d a1 b7 5e 1f 26 3b 0b 75 af be 71 45 4e 7d e3 8a 9b 9e 5f 5e 3f 71 7c a1 e7 cd d3 f2 47 4e 2c 9b Data Ascii: !t@-(B}@suGc5CP!EC-zRqH25YgXEQC`C05)RW%dJ"Rq^nCBvd0&$U^nCu\)]H^[rg[g\|ov7yc=Z4coRV';N1M[^&;uqEN}_^?q\|GN,
2024-04-18 07:46:21 UTC	16384	IN	Data Raw: 2b d5 38 ae da c4 0c 5a 55 03 28 d7 30 6e a2 10 a2 54 51 94 76 73 e3 c8 21 84 28 80 b1 f7 c7 18 21 44 b5 a2 28 a5 06 ce 99 89 8a 91 7e 39 62 71 a6 1e 97 44 19 2a 23 ca 7b 93 e5 ae e3 65 e7 b0 b1 f1 2d ad e3 0a 9c 7c 3f b3 c4 97 c8 f9 66 3e 3a 7b ec 9c 67 17 f1 b9 da 61 fe fe c2 93 93 86 9d 70 e2 3d 65 93 a6 34 cb ce e2 44 07 8a 37 9d 54 e2 1b 5d b3 6a 50 f3 c6 d6 85 bb 76 ef 2a b8 a7 ec f6 db 64 e7 21 e7 bb 6f ce ac 80 dd 1e 03 83 8f 3e 46 d3 2f a5 3f 59 df f2 3b 99 af 5d 13 0a 2e 6a 67 81 af ea f4 fc 51 5b 9b 5a 9b 87 c9 ce 41 44 19 ca fc c2 d1 43 85 7b fc 4a 89 ab 18 c0 e3 69 ce bf 2c cd ed 0f 55 8b 9a 44 6d af 23 ec b4 0f b5 f3 1a 30 87 56 cb 34 15 99 aa fb 31 dd 8b 2c ca e6 35 79 fe b0 8e b1 5e 93 32 d8 49 38 c5 ed 0a 0c cc d0 93 90 05 6b 10 11 11 11 Data Ascii: +8ZU(0nTQvs!(!D(~9bqD#{e-\|?f>:{gap=e4D7T]jPvd!o>F/?Y;].jgQ[ZADC{Ji,UDm#0V41,5y^2I8k
2024-04-18 07:46:21 UTC	12657	IN	Data Raw: fa 5f fc f7 73 4b 8e b5 aa 5c 3c 38 74 e2 b2 1f fb f1 7b 2f dc 5a f9 f7 ed f3 09 10 b1 ab 32 10 ad bf af ef 95 46 97 e6 d4 ba 34 67 29 8d 25 57 b4 ce 61 27 bf d4 71 a5 1a 5d 98 51 ed c2 8c bc a6 63 a2 d9 5c 72 55 f1 e7 b1 d1 e1 fa a9 e8 ed f3 9a 47 a3 83 b5 b5 82 32 64 69 f4 70 af 6e 1b ee e2 ac c9 2e ce 02 00 00 00 00 00 00 00 80 dc 7c b8 a1 cf 25 25 1f 0f 00 00 2c 8f f7 e2 40 5e f3 8a 7c 47 a3 55 ae b8 b9 bc 44 a7 98 8e d6 87 9f 26 db 59 8b 34 1a f9 1e fb 6c f8 40 56 44 eb 1c e4 2d ef 1c 0b e7 6c 29 07 d2 34 9d ca b9 76 34 e7 ba 59 c5 c9 11 d1 59 49 f9 68 e4 bc 56 db 45 ca f5 0e 72 1c 48 d3 74 ac 83 f5 7d 2d 4d d3 b1 24 49 6a 91 ff c3 fe 3b 92 24 69 b8 26 01 32 4d 46 c4 50 d9 21 58 b1 a1 68 bd ef 18 2d 37 06 50 94 7d b7 dd 3c da 2f e5 81 17 0f 0e 9d 50 Data Ascii: _sK\<8t{/Z2F4g)%Wa'q]Qc\rUG2dipn.\|%%,@^\|GUD&Y4l@VD-l)4v4YYIhVErHt}-M$Ij;$i&2MFP!Xh-7P}</P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49720	52.42.97.191	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	648	OUT	GET /script/logo.js HTTP/1.1 Host: mpsnare.iesnare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=
2024-04-18 07:46:22 UTC	653	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 07:46:21 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 96 Connection: close Last-Modified: Tue, 06 May 2014 00:01:40 GMT Expires: Fri, 18 Apr 2025 07:46:21 GMT Cache-Control: private p3p: CP="NON DSP COR CURa" Accept-CH: Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Bitness, Sec-CH-UA-WoW64, ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-04-18 07:46:22 UTC	96	IN	Data Raw: 69 66 28 69 6f 5f 64 70 29 7b 69 6f 5f 64 70 2e 43 54 4f 4b 45 4e 3d 22 68 2f 2f 76 6d 58 53 49 2f 75 49 36 74 55 4b 33 74 71 4c 57 5a 69 53 68 4a 30 76 33 31 66 75 2b 6b 4f 2f 39 44 5a 34 77 6b 75 34 3d 22 3b 69 6f 5f 64 70 2e 75 70 64 61 74 65 42 6c 61 63 6b 62 6f 78 65 73 28 29 3b 7d Data Ascii: if(io_dp){io_dp.CTOKEN="h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=";io_dp.updateBlackboxes();}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49722	3.161.150.100	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	518	OUT	GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.2006570593677508&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:21 UTC	1474	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:46:21 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Hit from cloudfront Via: 1.1 e9b0912bfb25a87d9798160f6315bd3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: rkk217dE3LT6iz-W4de4CHcLYk_dWePPdUwn9jGzHreAfeFR16-kXA== Vary: Origin
2024-04-18 07:46:21 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49721	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:21 UTC	699	OUT	GET /media/fonts/DICKS/DSGSans-Black-73d994fc41cbf65f8414609d10b9accd.woff2 HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dickssportinggoods.cashstar.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://s3static.cashstar.com/media/fonts/DICKS/fonts.c844bce31e7d2a9f3ead4cffcd8f4e93.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:21 UTC	713	IN	HTTP/1.1 200 OK Connection: close Content-Length: 14092 x-amz-id-2: olhfSNgARUXBvt9pAwiHDv1GYhT105fh4Cg1vFlg1AhHX4Qcu+QrT7KMeT+3PpX9KtIUi1fxTZc= x-amz-request-id: FEFYFZQHVHYAFZVE x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:28:55 GMT ETag: "73d994fc41cbf65f8414609d10b9accd" x-amz-server-side-encryption: AES256 x-amz-version-id: m5zR1h1WlXvCQkJhMIB_iAK6S6lesQI5 Content-Type: font/woff2 Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 18 Apr 2024 07:46:21 GMT Via: 1.1 varnish Age: 165 X-Served-By: cache-pdk-kpdk1780062-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1713426382.754149,VS0,VE1 Cache-Control: public,max-age=31536000
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 37 0c 00 0f 00 00 00 00 ce 24 00 00 36 ac 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 1e 1b 81 90 20 1c 9a 42 06 60 00 87 26 11 08 0a 81 b5 74 81 83 62 0b 86 0e 00 01 36 02 24 03 8c 18 04 20 05 8d 10 07 90 4e 1b fb b0 27 d0 db f7 e2 88 db 81 c9 f4 ad bc 2a 8a da c1 49 b9 8d 42 1a 46 39 9d 9d fc ff ff e7 a4 c7 70 f6 07 a8 ea 17 4a d4 8c b9 45 86 ac 08 6f 28 3a a2 02 13 9d b5 36 0a 99 d9 d8 86 95 28 31 d1 a2 f9 0a 1c 79 f9 37 4e d2 99 26 3e 83 bf 70 d9 51 ba 9d 2a 0e f3 75 71 d3 44 71 2b 5a 8f 5d fc 44 1f 38 df 5b 59 bb e3 97 13 c9 14 ca f2 85 f9 78 2e d1 e2 b4 d1 1c ef da b8 13 66 32 84 92 c2 82 92 a6 31 d0 3f 7c bc b9 75 b8 39 ea 19 d8 36 f2 27 39 79 e1 ff fb 69 ec dc f7 7e d2 Data Ascii: wOF27$6?FFTM B`&tb6$ N'IBF9pJEo(:6(1y7N&>pQuqDq+Z]D8[Yx.f21?\|u96'9yi~
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: 2b e8 50 eb 5e f9 84 8c f9 54 17 9a 6c ed eb c8 25 51 b5 30 5b 48 2a c0 86 54 a0 4b ac e2 a0 74 9d b2 64 55 8c db 25 ce d1 99 eb 37 cd a9 c2 1a cc 86 82 2d ca 85 1b 3a 3d 13 40 ca bd 67 71 cf b7 bf 3c dc 1b e8 a6 37 54 2e e3 42 4d bb 1a 92 79 e5 11 51 a2 1c d4 65 50 43 7a 25 e7 e4 78 73 e4 ca 52 d7 14 3f 91 43 93 cc 03 81 bb 2c 82 2c 6d 5a 91 4a 8e 56 53 33 bd 1f 58 47 c7 cd 0b 29 aa f9 6d ee cd 32 44 9e 52 c4 e9 2e 8d a3 00 c3 19 02 67 40 80 4a af a5 a9 5b 5c ed 6e a1 27 d8 b9 a8 6a b6 11 a5 6f 49 66 55 d6 61 30 83 e8 09 33 c8 bd 36 9c b6 98 c8 45 68 71 35 db a1 b0 84 41 3d 2d 4b 94 00 12 46 38 4c c3 10 26 17 ca 5f 2e d5 0c 38 8c c5 4e c4 5b f5 00 fc 72 2e 01 48 58 5e 03 9c b1 dd 30 db d1 9b ea 8a 50 b4 24 13 0d 62 c9 78 f2 a3 5c 05 95 e9 cf 2e ab d3 d9 Data Ascii: +P^Tl%Q0[H*TKtdU%7-:=@gq<7T.BMyQePCz%xsR?C,,mZJVS3XG)m2DR.g@J[\n'joIfUa036Ehq5A=-KF8L&_.8N[r.HX^0P$bx\.
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: 58 67 f7 cf 26 8e 95 b1 ff bd fb eb 8c df fc bc 1f 90 b4 b1 60 7d c8 6d 9d 5a f0 93 8a 0f 38 e9 86 f3 43 64 e4 a7 80 78 f6 c5 a7 b0 f8 1c 44 c5 74 74 df a9 7f dc 1a 5b ca b8 6e 16 cf 52 48 ca 45 0b ac 61 57 ba cd 19 85 5b 1d 79 bc 6a 75 ab e3 a6 f4 a8 38 fd 17 46 37 88 2b b9 eb 81 74 ee c7 ff 4b 5d 94 17 b2 a2 41 17 6b 48 63 40 82 7e b0 09 bc 21 38 74 47 ef d8 f2 61 6e 42 a9 2c c6 f2 22 62 be 3b c9 2a 1b 53 b3 b3 23 a5 7c 9f 82 ed 3e b4 08 f6 39 dc 81 be 51 ee 6b cc aa 8c c3 bd 23 58 60 66 34 4b 27 92 f7 b0 60 b7 bc 8d 7c 9c d2 66 86 40 5e f3 2f 55 db f5 76 5a 18 cd 1c 5c a6 98 60 ac 82 18 01 b9 ea f8 73 e9 15 47 61 01 46 ce a0 13 8d ed a5 ca d3 34 ce 75 da 20 43 df 41 d6 52 6b 8d 40 56 4a 61 b7 32 31 e3 58 11 b5 d4 ce 11 66 5e 56 91 ab c7 72 86 a9 20 2b Data Ascii: Xg&`}mZ8CdxDtt[nRHEaW[yju8F7+tK]AkHc@~!8tGanB,"b;*S#\|>9Qk#X`f4K'`\|f@^/UvZ\`sGaF4u CARk@VJa21Xf^Vr +
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: f7 2d cb f9 e8 13 67 0f f3 e4 d7 10 f2 7f eb 07 b5 b6 eb cd 8e c1 77 df 8d 40 57 4d 75 03 bd 88 1b 72 a2 90 26 e0 0c 5c d9 79 39 9d 72 15 93 19 5d 07 d8 34 08 3e 85 cf 97 89 1a 70 1e 96 1f bc 8a e2 09 d3 ea 0c 16 4c 45 00 65 21 4b d6 61 30 86 e4 aa 10 66 a8 59 26 14 9a ff e3 ef c3 57 25 43 a7 eb 2c 67 a4 f7 24 23 8f fb ab be 21 14 89 96 82 f4 17 3e d8 f0 f6 3c 60 86 6f aa 6d b2 4c ec ce da 1d ac 5c 80 c1 0b 1d b4 e6 84 b4 13 b4 76 85 85 f9 98 bf 27 5f bb c2 78 cd eb a6 af cf 7a ac c5 42 0c bd 09 b1 c5 26 33 83 6b 96 03 95 19 51 d9 a0 48 b1 df eb 92 c7 71 cd 34 09 c3 d9 ce 92 4f 87 90 a6 43 ff 82 8a 1e 05 07 41 0b 92 1a 64 f9 54 ab 97 2b 7e f7 c0 8c 13 e0 99 76 c0 ae 02 60 55 0b 77 7e 82 74 bf ce b6 5a 88 63 32 c8 92 41 12 4b 88 08 10 34 16 4d cc ff 6d bd Data Ascii: -gw@WMur&\y9r]4>pLEe!Ka0fY&W%C,g$#!><`omL\v'_xzB&3kQHq4OCAdT+~v`Uw~tZc2AK4Mm
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: fc a8 22 44 57 aa 56 89 3a d5 1a 34 6a 52 af 95 04 f0 52 b7 75 ba cc e4 ca a3 ac 88 48 dc 12 e7 c9 dd ca 00 2d 18 40 1b 01 f8 4e c0 7e 02 5b 0e 4f 60 e7 05 00 00 4e 03 c0 00 80 31 46 12 46 af cd c6 32 2b bb 0a 96 48 95 73 4c 60 59 6f e5 ca 50 bd 1c 1a d2 c0 20 d2 2e c2 99 83 a6 d0 5f 59 20 f8 39 4b e5 5a 49 98 96 0e e6 3e c7 0c c8 98 84 48 e9 2b 91 e6 65 59 3c 02 dc a7 3a bf b1 60 78 6d 2d 15 ea 06 37 8e 25 55 d3 d7 89 13 44 a4 73 48 4a bb 21 ec f4 91 9a 76 e9 ee 41 41 1f 71 27 29 6a da 28 91 e8 a0 46 f4 66 67 fa 8d 60 33 9f 4d 17 1a ad 15 6f 0f 41 ff df a9 d9 23 83 2d f1 d8 1c ff d9 4d cb b5 f3 d4 b9 11 7a c6 25 73 77 d7 6a a4 37 19 2d 6d a6 32 03 0d 79 90 35 cb be 53 43 7a 4d 16 45 59 0c 96 19 99 cb 36 45 26 fd 30 b2 74 bb d7 ac 23 85 76 3a 9c a6 5c 16 Data Ascii: "DWV:4jRRuH-@N~[O`N1FF2+HsL`YoP ._Y 9KZI>H+eY<:`xm-7%UDsHJ!vAAq')j(Ffg`3MoA#-Mz%swj7-m2y5SCzMEY6E&0t#v:\
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: c6 84 76 24 d8 79 97 c8 89 ad 33 ef a1 f3 52 12 1d 39 dc 26 42 fd f0 3b f9 16 64 d7 8b 5b 5a ce 2b 8b 15 48 64 a1 c6 b6 39 1a 0d a9 fd 69 94 a2 2c 10 eb 1f a4 11 d0 56 b3 d0 8b d2 c3 3a ce de 02 56 54 40 40 f0 eb 2e 28 5d 6c ce b5 b8 d5 a2 77 2a bf e7 10 37 64 02 48 17 df 91 e9 40 ac 7f 4a 84 07 a9 85 00 ef 13 c2 4f a4 91 c7 6a dc 4c 89 4a 64 bb b5 01 37 58 c7 eb 5f be f7 66 3c fc ad 2f de 7e 23 f0 a9 c3 2d 28 0f 0a 0a 6e 41 f9 5e c1 3b 04 14 51 ae fe f6 d6 76 51 a8 93 30 ae 46 89 6c a5 e5 5d e9 88 df da fb 22 04 c7 e2 32 0f bf 07 df b4 4a d5 87 73 ec 5c 85 ad 7d 79 09 1d 45 e6 48 cd 9b a9 d4 f1 b0 47 f4 d0 9e d0 3d fa 76 84 a1 57 0b ef 5f 8b 38 32 0c 27 a6 16 c3 bc 34 13 e6 fc 89 e6 0b 51 da bf e3 1b 54 eb ce e3 9a 96 8a 43 f4 81 0f a1 e1 b6 5c c5 0d b6 Data Ascii: v$y3R9&B;d[Z+Hd9i,V:VT@@.(]lw*7dH@JOjLJd7X_f</~#-(nA^;QvQ0Fl]"2Js\}yEHG=vW_82'4QTC\
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: 3f 73 0f 9d c8 05 8e 58 48 7b 77 c8 1b 08 3e 0a 96 c9 76 6e 6a fe 36 7c aa 19 45 83 e1 2c f3 50 e3 c9 7c aa 2d 32 71 ca d3 1b 6b 51 54 65 c1 b9 9f 02 f3 bd fd 82 7f 9a 9b 8a a0 88 c9 9c d2 ad af ee 43 5f 8f 63 c1 b3 0f 8f 8b 0e 8a e6 45 e7 44 30 da 9f 72 21 65 5f 66 ab ec b7 5a 1c 93 a6 53 b0 f1 55 4b 79 4b 19 f3 a1 5e 6d 74 48 37 e1 66 68 3b b3 6d cd 78 80 96 24 18 2f 20 96 33 41 5a 60 7c 93 cb 19 0b f9 b0 6c 4c b6 d1 23 3e c9 bd 99 57 22 db c5 64 2a da 01 b7 dc e3 39 ee a4 61 f6 ea 75 ad 13 07 0f 06 18 f7 f5 7d 4d 4b 5b a5 14 1d fd 51 3b d0 25 30 17 45 9d f4 63 ab f0 fe 3a fe 9d 2b 77 50 bd 67 8e 89 c5 a4 a1 fc fc 4e e3 63 d1 78 87 68 f8 68 bb f4 47 24 16 51 5b 93 9e e2 c2 e6 0a c5 ec 81 60 33 8f b2 58 d7 6d d3 93 36 37 78 f4 a0 e0 20 df 63 4c 30 06 e9 Data Ascii: ?sXH{w>vnj6\|E,P\|-2qkQTeC_cED0r!e_fZSUKyK^mtH7fh;mx$/ 3AZ`\|lL#>W"d*9au}MK[Q;%0Ec:+wPgNcxhhG$Q[`3Xm67x cL0
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: 32 8f 0d f0 1a 69 c0 bc 47 ac 8d df 88 d0 7c f0 a3 e6 b7 a5 26 d4 30 5d 23 b1 6d 66 a6 d4 79 18 c6 44 ac a2 84 2e 5c bd a6 bf 69 7e 1e d1 c1 54 86 cf 28 33 5e 83 57 18 24 8c 10 ea 45 86 08 02 bd 03 01 9f 4b 26 87 04 e6 ed 10 e0 6e 4b fa 14 cf a6 93 f9 9f 70 26 9f 12 04 0c ef a9 67 5d 49 2f 3f 55 ed 75 b6 d3 1d 55 b5 75 36 d3 bd 53 33 b6 12 61 46 3d 1f 3d 5e 9e aa 4a 44 bd 2e a7 aa 1a d8 20 de a7 11 4d b8 3d a3 c2 6b 62 fb 3c 94 6e 9d 63 6d 3f 51 1e a5 b6 5c 70 7e aa 7d be 39 be 97 ad 56 67 3b 54 7f 19 8b b0 0d 08 0c 3b 63 e5 18 03 34 7a 58 0a 86 ea c8 f4 fb 9c 15 ed 4b 46 07 83 7f 38 b1 17 ed b7 6c 36 6b 4d 80 ff 9a 35 f6 6a fe fe 6c b6 f0 ef f7 96 c4 86 89 34 db 94 39 9f 37 76 2f 7d be b9 93 af a5 5c 3b dd ac c7 af 90 4b 63 f4 67 bf 0b 64 7b 4d e3 93 57 Data Ascii: 2iG\|&0]#mfyD.\i~T(3^W$EK&nKp&g]I/?UuUu6S3aF==^JD. M=kb<ncm?Q\p~}9Vg;T;c4zXKF8l6kM5jl497v/}\;Kcgd{MW
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: b8 34 0d 00 3f 51 fe 35 ab 8f 49 d8 93 95 df 52 9a d8 56 93 74 66 d5 78 8d e8 30 eb e2 be f4 a8 66 30 33 79 01 9a dd 55 53 2b 3b 2d e5 a9 5b 6c 0a ad 34 6f 5a af 69 25 8b 7e a7 55 f6 93 95 11 54 21 35 2d 1c af a5 9d ef 6d 1b e6 6d f6 a6 95 46 a3 f5 69 e6 c7 a8 ae 8e 72 ae 12 e5 98 9d 2c 17 a3 74 c3 d1 34 c6 90 ea d6 72 4e be ec c2 7e 1a d1 c8 92 0b a9 01 85 2f 37 15 c4 d2 2f b4 fe 20 e9 23 cd 5b b7 e1 d4 df a3 9a 5a 36 7b 53 4b 6d 3b b8 da ab 2d fe d8 6d 30 8f ff 8e fe 2b 30 80 f2 b5 dc 97 a2 13 6b 4d 64 79 55 bd de 02 52 32 97 53 2a 69 57 b2 46 22 cd de fe 4f 56 2d fe c8 a4 09 83 5a 75 16 98 ac 6e 3a 9b b0 51 82 ac 2b 4f 25 c3 ad 2d b2 a2 62 ed c2 51 86 83 a0 9b 35 d1 7b 4b 81 4e 61 1e 75 e2 79 75 8a ad 30 e8 ef 24 cd db 7c 09 df fc 6c ef 25 ef c1 fc 77 Data Ascii: 4?Q5IRVtfx0f03yUS+;-[l4oZi%~UT!5-mmFir,t4rN~/7/ #[Z6{SKm;-m0+0kMdyUR2S*iWF"OV-Zun:Q+O%-bQ5{KNauyu0$\|l%w
2024-04-18 07:46:21 UTC	1379	IN	Data Raw: d9 3c 7b 82 71 9d bd 85 d8 d5 11 18 4b 18 cf 3a 82 e3 6b 24 2e 0d 80 d0 83 ff a7 83 c0 98 84 71 01 80 e0 8d 4d 1c 1f 5a 76 68 6b 5a 31 8b 71 a3 c3 80 e3 31 7e 05 bf 64 27 98 17 e3 b1 18 36 99 fb e2 9b d3 b2 3c 7c 1c 87 4b f6 e2 06 d0 ab b4 46 4d 6d 6f 59 b8 c5 a8 6d 4a d0 7e ba ed 33 e9 3b 16 ab 7d 19 a5 0a 55 aa b0 c2 59 58 56 14 b6 cf 68 cd f2 cc c7 28 dd 48 69 c5 cb 24 e5 05 7a 69 0f c6 f5 b6 d1 85 8a 1e 96 59 a9 01 9d 85 31 bd 79 65 05 80 94 7d 21 6e b2 49 d6 df bc c3 e5 7d 13 32 32 44 b3 e5 19 e4 84 b5 a0 d4 fd 73 37 ce 35 a3 34 a0 cc 3b c3 fa 74 c8 7e 24 10 68 23 5b aa 00 0c 88 c0 75 2f d7 b1 bd c6 10 c3 a7 a5 13 5b 1a 9f 6d 93 f9 63 bb 3e 13 3b 68 8a b0 13 e7 ba 66 a7 26 83 b3 33 87 a6 d1 ce 55 73 c5 2e 94 33 67 57 96 2b 3c ab 2d 81 3d f1 70 ed 60 Data Ascii: <{qK:k$.qMZvhkZ1q1~d'6<\|KFMmoYmJ~3;}UYXVh(Hi$ziY1ye}!nI}22Ds754;t~$h#[u/[mc>;hf&3Us.3gW+<-=p`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49723	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:22 UTC	772	OUT	GET /media/images/DICKS/favicon.ico HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:22 UTC	711	IN	HTTP/1.1 200 OK Connection: close Content-Length: 33310 x-amz-id-2: iMsJm0ds5lbTMqnimhArQjFxl5M4DDfC6lv8I73w9RhRXVEYiMrpj3h+vGY4qPDh2h4Q8m6fBdw= x-amz-request-id: Q8B8TT1HTPANH0JG x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:30:18 GMT ETag: "6959e85c8ef11925e3f909e7bd21e06f" x-amz-server-side-encryption: AES256 x-amz-version-id: uFV.0dZo.oCIGAgy_25PDgs6ToBfZ_uy Content-Type: image/vnd.microsoft.icon Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Age: 0 Date: Thu, 18 Apr 2024 07:46:22 GMT Via: 1.1 varnish X-Served-By: cache-pdk-kfty2130046-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1713426382.388436,VS0,VE139 Vary: Accept-Encoding
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 00 00 01 00 05 00 10 10 00 00 01 00 20 00 28 04 00 00 56 00 00 00 18 18 00 00 01 00 20 00 28 09 00 00 7e 04 00 00 20 20 00 00 01 00 20 00 28 10 00 00 a6 0d 00 00 30 30 00 00 01 00 20 00 28 24 00 00 ce 1d 00 00 40 40 00 00 01 00 20 00 28 40 00 00 f6 41 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 7d 85 5e ff 7c 83 61 ff 7c 83 61 ff 7c 83 61 ff 74 7b 58 ff 4d 5c 10 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 Data Ascii: (V (~ (00 ($@@ (@A( TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe}^\|a\|a\|at{XM\TeTeTeTeTeT
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 74 7f 47 ff 8f 90 89 ff 8f 90 89 ff 8f 90 89 ff 8f 91 89 ff 8f 90 89 ff 8f 90 89 ff 7b 7d 75 ff 44 51 12 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a1 a1 9e ff 44 51 12 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: eTeTeTeTeTeTeTetG{}uDQTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe~DQTeTeTeTeTeTeTeTeTeTeTeTeTeTe~
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff 8d 8f 86 ff 9a 9c 92 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5e 67 37 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f7 f7 f4 ff 5f 6d 27 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 f4 ef ff 76 83 42 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f Data Ascii: ^g7TeTeTeTeTeTeTeTeTeTeTeTeTe~_m'TeTeTeTeTeTeTeTeTeTeTeTeTe~vBTeTeTeTeTeTeTe
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a5 a5 a5 ff 37 3f 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a1 a0 Data Ascii: TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRc7?TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRc
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 10 ff 51 63 0e ff f1 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff de dc df ff 4a 57 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff d6 d6 d8 ff 4b 5a 10 ff 51 63 0e ff f1 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff de dc df ff 4a 57 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff d6 d6 d8 ff 4b Data Ascii: QcJWTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRcKZQcJWTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRcK
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 65 0f ff 52 63 0f ff d6 da c9 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff de e2 d3 ff ae b6 91 ff 52 64 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 52 63 0d ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff Data Ascii: eRcRdTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTePaPaPaPaPaPaPaPaPaRcTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 56 67 0f ff 57 69 0f ff 57 68 0f ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 69 0f ff 57 68 0f ff 57 68 0f ff 57 69 0f ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 68 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 55 66 0e ff 3d 47 18 ff 22 25 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 Data Ascii: TeTeTeTeTeTeTeTeVgWiWhWiWiWiWiWhWhWiWiWiWiWiWhTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeUf=G"%#&#&#&#&#&#&
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 6c 6d 63 ff 53 64 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff 82 85 7a ff 7c 89 4d ff 77 84 4a ff ad b5 95 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: lmcSdTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQbz\|MwJ
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5d 61 50 ff 56 68 0d ff 53 64 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 Data Ascii: nij`ScTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQb]aPVhSdnij`ScTeTeTeTeT
2024-04-18 07:46:22 UTC	1379	IN	Data Raw: ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5d 61 50 ff 56 68 0d ff 53 64 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff Data Ascii: ij`ScTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQb]aPVhSdnij`ScTeTeTeTeTeTeTeTeTeTeTeTeTe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49724	3.22.134.95	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:22 UTC	1057	OUT	GET /assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20= HTTP/1.1 Host: ht.blackhawknetwork.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:46:22 UTC	336	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:46:22 GMT Content-Type: application/javascript Content-Length: 876 Connection: close x-amzn-RequestId: 585b35ea-61c2-46b8-b838-d75ba1e22578 x-amz-apigw-id: WaVoUH8OiYcEeZw= X-Amzn-Trace-Id: Root=1-6620cfce-46e421ab014d8de053c1d5b3;Parent=677dbbb4d28b7c5f;Sampled=0;lineage=13ba6a0f:0
2024-04-18 07:46:22 UTC	876	IN	Data Raw: 76 61 72 20 78 20 3d 20 61 74 6f 62 28 22 5a 47 56 73 64 47 45 75 59 32 39 74 4c 47 31 35 59 32 6c 75 5a 57 31 68 5a 32 6c 6d 64 47 4e 68 63 6d 52 7a 4c 6d 4e 76 4c 6e 56 72 4c 47 39 73 62 47 6c 6c 63 79 35 6a 62 32 30 73 63 47 46 75 5a 47 46 6c 65 48 42 79 5a 58 4e 7a 4c 6d 4e 76 62 53 78 68 63 6d 6c 30 65 6d 6c 68 4c 6d 4e 76 62 53 78 74 65 57 4e 70 62 6d 56 74 59 57 64 70 5a 6e 52 6a 59 58 4a 6b 63 79 35 6a 62 32 30 73 61 33 4a 76 5a 32 56 79 4c 6d 4e 76 62 53 78 77 59 57 6c 75 64 47 35 70 64 47 55 75 59 32 39 74 4c 47 4e 6d 61 57 4e 70 63 32 52 31 62 57 31 35 4c 6d 4e 76 62 53 78 6f 62 32 31 6c 59 32 68 6c 5a 69 35 6a 62 32 30 73 5a 47 39 73 62 47 46 79 63 32 68 68 64 6d 56 6a 62 48 56 69 4c 6d 4e 76 62 53 78 73 62 47 4a 6c 59 57 34 75 59 32 39 74 4c Data Ascii: var x = atob("ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49725	151.101.0.138	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:22 UTC	522	OUT	GET /media/images/DICKS/favicon.ico HTTP/1.1 Host: s3static.cashstar.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G
2024-04-18 07:46:23 UTC	708	IN	HTTP/1.1 200 OK Connection: close Content-Length: 33310 x-amz-id-2: iMsJm0ds5lbTMqnimhArQjFxl5M4DDfC6lv8I73w9RhRXVEYiMrpj3h+vGY4qPDh2h4Q8m6fBdw= x-amz-request-id: Q8B8TT1HTPANH0JG x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 10:30:18 GMT ETag: "6959e85c8ef11925e3f909e7bd21e06f" x-amz-server-side-encryption: AES256 x-amz-version-id: uFV.0dZo.oCIGAgy_25PDgs6ToBfZ_uy Content-Type: image/vnd.microsoft.icon Server: AmazonS3 Access-Control-Allow-Origin: * Accept-Ranges: bytes Date: Thu, 18 Apr 2024 07:46:22 GMT Via: 1.1 varnish Age: 0 X-Served-By: cache-pdk-kfty2130084-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1713426383.989885,VS0,VE1 Vary: Accept-Encoding
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 00 00 01 00 05 00 10 10 00 00 01 00 20 00 28 04 00 00 56 00 00 00 18 18 00 00 01 00 20 00 28 09 00 00 7e 04 00 00 20 20 00 00 01 00 20 00 28 10 00 00 a6 0d 00 00 30 30 00 00 01 00 20 00 28 24 00 00 ce 1d 00 00 40 40 00 00 01 00 20 00 28 40 00 00 f6 41 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 7d 85 5e ff 7c 83 61 ff 7c 83 61 ff 7c 83 61 ff 74 7b 58 ff 4d 5c 10 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 Data Ascii: (V (~ (00 ($@@ (@A( TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe}^\|a\|a\|at{XM\TeTeTeTeTeT
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 74 7f 47 ff 8f 90 89 ff 8f 90 89 ff 8f 90 89 ff 8f 91 89 ff 8f 90 89 ff 8f 90 89 ff 7b 7d 75 ff 44 51 12 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a1 a1 9e ff 44 51 12 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: eTeTeTeTeTeTeTetG{}uDQTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe~DQTeTeTeTeTeTeTeTeTeTeTeTeTeTe~
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff 8d 8f 86 ff 9a 9c 92 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5e 67 37 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f7 f7 f4 ff 5f 6d 27 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff a1 aa 7e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 f4 ef ff 76 83 42 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f Data Ascii: ^g7TeTeTeTeTeTeTeTeTeTeTeTeTe~_m'TeTeTeTeTeTeTeTeTeTeTeTeTe~vBTeTeTeTeTeTeTe
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a5 a5 a5 ff 37 3f 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff a1 a0 Data Ascii: TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRc7?TeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRc
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 10 ff 51 63 0e ff f1 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff de dc df ff 4a 57 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff d6 d6 d8 ff 4b 5a 10 ff 51 63 0e ff f1 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff de dc df ff 4a 57 14 ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 52 63 0f ff f6 f7 f4 ff ff ff ff ff ff ff ff ff ff ff ff ff d6 d6 d8 ff 4b Data Ascii: QcJWTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRcKZQcJWTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeRcK
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 65 0f ff 52 63 0f ff d6 da c9 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff dd e0 d0 ff de e2 d3 ff ae b6 91 ff 52 64 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 50 61 0a ff 52 63 0d ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff Data Ascii: eRcRdTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTePaPaPaPaPaPaPaPaPaRcTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTe
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 56 67 0f ff 57 69 0f ff 57 68 0f ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 69 0f ff 57 68 0f ff 57 68 0f ff 57 69 0f ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 69 10 ff 57 68 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 55 66 0e ff 3d 47 18 ff 22 25 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 ff 23 26 18 Data Ascii: TeTeTeTeTeTeTeTeVgWiWhWiWiWiWiWhWhWiWiWiWiWiWhTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeUf=G"%#&#&#&#&#&#&
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 6c 6d 63 ff 53 64 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fe fe ff 82 85 7a ff 7c 89 4d ff 77 84 4a ff ad b5 95 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: lmcSdTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQbz\|MwJ
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5d 61 50 ff 56 68 0d ff 53 64 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 Data Ascii: nij`ScTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQb]aPVhSdnij`ScTeTeTeTeT
2024-04-18 07:46:23 UTC	1379	IN	Data Raw: ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 51 62 0f ff f2 f3 ee ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 5d 61 50 ff 56 68 0d ff 53 64 0e ff 93 9e 6e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 69 6a 60 ff 53 63 0e ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff 54 65 0f ff Data Ascii: ij`ScTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeQb]aPVhSdnij`ScTeTeTeTeTeTeTeTeTeTeTeTeTe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49731	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1Cx3NFWRXNwfr1r&MD=x6RZyozK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 07:46:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2a1db136-cd61-4d83-8ace-c23fc7fb4964 MS-RequestId: dd5df310-fbde-4b5a-8f26-5a0101786715 MS-CV: rUr6mJocGUW++Rjy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 07:46:33 GMT Connection: close Content-Length: 24490
2024-04-18 07:46:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-18 07:46:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49732	23.55.253.34	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:33 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 07:46:33 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=256623 Date: Thu, 18 Apr 2024 07:46:33 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49733	23.55.253.34	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:46:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-18 07:46:34 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=256557 Date: Thu, 18 Apr 2024 07:46:34 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-18 07:46:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49734	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1Cx3NFWRXNwfr1r&MD=x6RZyozK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 07:47:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 7c9a981f-0ee5-45be-b69a-4c5d73545089 MS-RequestId: 32f068c2-36b7-42cf-8387-2a526929c509 MS-CV: kVi2vvJntEmOLFM4.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 07:47:10 GMT Connection: close Content-Length: 25457
2024-04-18 07:47:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-18 07:47:11 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49739	151.101.1.24	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:57 UTC	1272	OUT	POST /gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/ HTTP/1.1 Host: dickssportinggoods.cashstar.com Connection: keep-alive Content-Length: 1703 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://dickssportinggoods.cashstar.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: csrftoken=1rBlDrTaOJdqOPfof7ZoC8pkIiwCDA1C3e4Oc0mE1y7yLvF4MiyMyNyQshP6Oxh5; rexsessionid=6ue59m5mhae1a2w5tpdt8ji989zmiksc; datadome=_mwMk9pnhLtBsQW5L4EcKqpjqRMeFaPtGs15cJfOGMrKtQX2wn_nZKIXp6f3fg29rYjncI_UX~eAwQEc0ApB03WD5sGwTKVxkoQvfoWd9XoTxCn~DvibZmpCcYzbDJ0G; TAsessionID=e58a22a8-87de-4dc3-94bc-522b41d24f38\|NEW; notice_behavior=implied,us
2024-04-18 07:47:57 UTC	1703	OUT	Data Raw: 63 73 72 66 6d 69 64 64 6c 65 77 61 72 65 74 6f 6b 65 6e 3d 79 6f 42 63 63 73 57 44 31 52 47 77 72 63 71 45 45 30 66 41 49 37 43 44 4d 37 46 64 4d 76 69 77 41 62 34 46 4c 31 70 37 65 47 41 45 6f 53 51 6b 62 62 4f 59 45 4d 4c 39 77 36 59 48 58 73 79 5a 26 72 65 61 63 74 5f 75 69 3d 74 72 75 65 26 76 61 6c 75 65 3d 67 65 78 65 78 33 38 38 35 25 34 30 65 72 79 65 64 2e 63 6f 6d 26 69 6f 76 61 74 69 6f 6e 5f 62 6c 61 63 6b 62 6f 78 3d 30 34 30 30 43 49 66 65 41 65 31 35 43 78 38 4e 66 39 34 6c 69 73 31 7a 74 6b 37 64 52 63 7a 30 66 41 4f 55 45 38 51 78 68 6d 58 37 4d 66 4f 46 56 4d 72 72 6c 58 64 53 71 56 4f 6e 6a 69 78 61 70 58 4e 5a 6b 4d 32 68 35 4b 31 37 38 58 52 34 42 64 57 59 49 4b 68 50 32 36 58 49 38 79 4f 51 79 74 73 62 39 6e 33 4e 59 44 79 4e 4b 4a Data Ascii: csrfmiddlewaretoken=yoBccsWD1RGwrcqEE0fAI7CDM7FdMviwAb4FL1p7eGAEoSQkbbOYEML9w6YHXsyZ&react_ui=true&value=gexex3885%40eryed.com&iovation_blackbox=0400CIfeAe15Cx8Nf94lis1ztk7dRcz0fAOUE8QxhmX7MfOFVMrrlXdSqVOnjixapXNZkM2h5K178XR4BdWYIKhP26XI8yOQytsb9n3NYDyNKJ
2024-04-18 07:47:58 UTC	1338	IN	HTTP/1.1 200 OK Connection: close Content-Length: 28069 Content-Type: text/html; charset=utf-8 Server: nginx Content-Security-Policy: upgrade-insecure-requests; frame-ancestors 'self' X-Robots-Tag: noindex, nofollow Content-Language: en-us Referrer-Policy: origin Set-Cookie: csrftoken=1rBlDrTaOJdqOPfof7ZoC8pkIiwCDA1C3e4Oc0mE1y7yLvF4MiyMyNyQshP6Oxh5; expires=Thu, 17 Apr 2025 07:47:58 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure Set-Cookie: rexsessionid=6ue59m5mhae1a2w5tpdt8ji989zmiksc; expires=Fri, 19 Apr 2024 07:47:58 GMT; HttpOnly; Max-Age=86400; Path=/; SameSite=Lax; Secure Strict-Transport-Security: max-age=16070400; preload; includeSubDomains; Access-Control-Allow-Origin: https://dickssportinggoods.cashstar.com X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-UA-Compatible: IE=edge Fastly-Restarts: 1 Accept-Ranges: bytes Via: 1.1 varnish, 1.1 varnish x-datadome: protected set-cookie: datadome=djcDevivRdxW3hZnrJ8LPRzMvcMdmBSpX_6eiXQdn1TH7k3NooKIA~3zHjuUH2rTCIVhlUKNix3H6k4ELECY4vt3ut36t4uZvuB5bAitnMdWamuh69Td0UB2Yp9PptAp; Max-Age=31536000; Domain=.cashstar.com; Path=/; Secure; SameSite=Lax Date: Thu, 18 Apr 2024 07:47:58 GMT X-Served-By: cache-pdk-kfty2130041-PDK, cache-pdk-kfty2130041-PDK X-Cache: MISS, MISS X-Cache-Hits: 0, 0 X-Timer: S1713426478.967208,VS0,VE850
2024-04-18 07:47:58 UTC	85	IN	Data Raw: 56 61 72 79 3a 20 43 6f 6f 6b 69 65 2c 20 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 2c 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 66 61 73 74 6c 79 2d 73 65 72 76 69 63 65 3a 20 50 72 6f 64 20 2d 20 43 6f 6e 73 75 6d 65 72 0d 0a 0d 0a Data Ascii: Vary: Cookie, Accept-Language, Accept-EncodingX-fastly-service: Prod - Consumer
2024-04-18 07:47:58 UTC	1371	IN	Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 Data Ascii: <!doctype html><html lang="en-us"><head> <meta charset="utf-8"> <meta name="robots" content="noindex, nofollow"> <meta name="viewport" content="width=device-width,initial-scale=1"> <meta http-equiv="X-UA-Compatible"
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6c 69 63 6b 20 74 6f 20 76 69 65 77 20 79 6f 75 72 20 44 49 43 4b 26 23 33 39 3b 53 20 53 70 6f 72 74 69 6e 67 20 47 6f 6f 64 73 20 65 47 69 66 74 20 63 61 72 64 21 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 66 70 73 74 61 74 69 63 2e 63 61 73 68 73 74 61 72 2e 63 6f 6d 2f 66 61 63 65 70 6c 61 74 65 73 2f 44 41 42 43 50 59 55 38 36 2f 4d 41 53 54 45 52 2d 31 2e 6a 70 67 22 20 2f 3e 0a 20 20 20 20 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 Data Ascii: a name="twitter:description" content="Click to view your DICK'S Sporting Goods eGift card!" /> <meta name="twitter:image" content="https://fpstatic.cashstar.com/faceplates/DABCPYU86/MASTER-1.jpg" /> <link rel="stylesheet" href="https://s
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 6c 6f 77 41 6c 6c 43 6f 6f 6b 69 65 73 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 64 6f 4c 6f 61 64 4e 52 20 3d 20 28 29 20 3d 3e 20 7b 0a 20 20 20 20 20 20 20 20 3b 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 3b 4e 52 45 55 4d 2e 69 6e 69 74 3d 7b 70 72 69 76 61 63 79 3a 7b 63 6f 6f 6b 69 65 73 5f 65 6e 61 62 6c 65 64 3a 74 72 75 65 7d 7d 3b 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 4e 52 45 55 4d 7c 7c 28 4e 52 45 55 4d 3d 7b 7d 29 2c 5f 5f 6e 72 5f 72 65 Data Ascii: { allowAllCookies = true; } </script> <script type="text/javascript"> const doLoadNR = () => { ;window.NREUM\|\|(NREUM={});NREUM.init={privacy:{cookies_enabled:true}}; window.NREUM\|\|(NREUM={}),__nr_re
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 73 2c 74 68 69 73 2c 74 5d 2c 6e 29 2c 74 7d 66 69 6e 61 6c 6c 79 7b 63 2e 65 6d 69 74 28 22 66 6e 2d 65 6e 64 22 2c 5b 75 2e 6e 6f 77 28 29 5d 2c 6e 29 7d 7d 7d 7d 3b 61 28 22 61 63 74 69 6f 6e 54 65 78 74 2c 73 65 74 4e 61 6d 65 2c 73 65 74 41 74 74 72 69 62 75 74 65 2c 73 61 76 65 2c 69 67 6e 6f 72 65 2c 6f 6e 45 6e 64 2c 67 65 74 43 6f 6e 74 65 78 74 2c 65 6e 64 2c 67 65 74 22 2e 73 70 6c 69 74 28 22 2c 22 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 6d 5b 65 5d 3d 69 28 6c 2b 65 29 7d 29 2c 6e 65 77 72 65 6c 69 63 2e 6e 6f 74 69 63 65 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 6e 65 77 20 45 72 72 6f 72 28 74 29 29 2c 6f 28 22 65 72 72 22 2c 5b 74 2c 75 2e 6e 6f Data Ascii: s,this,t],n),t}finally{c.emit("fn-end",[u.now()],n)}}}};a("actionText,setName,setAttribute,save,ignore,onEnd,getContext,end,get".split(","),function(t,e){m[e]=i(l+e)}),newrelic.noticeError=function(t,e){"string"==typeof t&&(t=new Error(t)),o("err",[t,u.no
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 2d 65 29 3a 65 3d 70 2e 6e 6f 77 28 29 2c 67 3d 21 30 2c 64 28 22 74 69 6d 69 6e 67 22 2c 5b 22 66 69 22 2c 65 2c 6e 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 74 29 7b 22 68 69 64 64 65 6e 22 3d 3d 3d 74 26 26 64 28 22 70 61 67 65 48 69 64 65 22 2c 5b 70 2e 6e 6f 77 28 29 5d 29 7d 69 66 28 21 28 22 69 6e 69 74 22 69 6e 20 4e 52 45 55 4d 26 26 22 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 22 69 6e 20 4e 52 45 55 4d 2e 69 6e 69 74 26 26 22 65 6e 61 62 6c 65 64 22 69 6e 20 4e 52 45 55 4d 2e 69 6e 69 74 2e 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 26 26 4e 52 45 55 4d 2e 69 6e 69 74 2e 70 61 67 65 5f 76 69 65 77 5f 74 69 6d 69 6e 67 2e 65 6e 61 62 6c 65 64 3d 3d 3d 21 31 29 29 7b 76 61 72 20 63 2c 75 2c 73 2c 64 3d 74 28 22 68 61 6e 64 6c 65 22 Data Ascii: -e):e=p.now(),g=!0,d("timing",["fi",e,n])}}function f(t){"hidden"===t&&d("pageHide",[p.now()])}if(!("init"in NREUM&&"page_view_timing"in NREUM.init&&"enabled"in NREUM.init.page_view_timing&&NREUM.init.page_view_timing.enabled===!1)){var c,u,s,d=t("handle"
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6f 2c 65 2c 21 31 29 7d 65 2e 65 78 70 6f 72 74 73 3d 72 3b 76 61 72 20 69 2c 6f 2c 61 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 3f 28 69 3d 22 68 69 64 64 65 6e 22 2c 6f 3d 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 61 3d 22 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 22 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 6d 73 48 69 64 64 65 6e 3f 28 69 3d 22 6d 73 48 69 64 64 65 6e 22 2c 6f 3d 22 6d 73 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 77 65 62 6b 69 74 48 69 64 64 65 6e 26 26 28 69 3d Data Ascii: ventListener(o,e,!1)}e.exports=r;var i,o,a;"undefined"!=typeof document.hidden?(i="hidden",o="visibilitychange",a="visibilityState"):"undefined"!=typeof document.msHidden?(i="msHidden",o="msvisibilitychange"):"undefined"!=typeof document.webkitHidden&&(i=
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 65 5d 3d 5b 5d 29 7d 29 7d 76 61 72 20 79 3d 7b 7d 2c 77 3d 7b 7d 2c 62 3d 7b 6f 6e 3a 6f 2c 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 6f 2c 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3a 6d 2c 65 6d 69 74 3a 6e 2c 67 65 74 3a 67 2c 6c 69 73 74 65 6e 65 72 73 3a 76 2c 63 6f 6e 74 65 78 74 3a 65 2c 62 75 66 66 65 72 3a 68 2c 61 62 6f 72 74 3a 66 2c 61 62 6f 72 74 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 72 65 74 75 72 6e 20 75 28 74 2c 63 2c 61 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 72 7d 66 75 6e 63 74 69 6f 6e 20 66 28 29 7b 28 64 2e 61 70 69 7c 7c 64 2e 66 65 61 74 75 72 65 29 26 26 28 6c 2e 61 62 6f 72 74 65 64 3d 21 30 2c 64 3d 6c 2e 62 61 63 Data Ascii: e]=[])})}var y={},w={},b={on:o,addEventListener:o,removeEventListener:m,emit:n,get:g,listeners:v,context:e,buffer:h,abort:f,aborted:!1};return b}function o(t){return u(t,c,a)}function a(){return new r}function f(){(d.api\|\|d.feature)&&(l.aborted=!0,d=l.bac
2024-04-18 07:47:58 UTC	1379	IN	Data Raw: 65 6e 74 2c 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 72 2c 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 76 2e 72 65 61 64 79 53 74 61 74 65 26 26 6f 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 66 28 22 6d 61 72 6b 22 2c 5b 22 64 6f 6d 43 6f 6e 74 65 6e 74 22 2c 61 28 29 2b 4d 2e 6f 66 66 73 65 74 5d 2c 6e 75 6c 6c 2c 22 61 70 69 22 29 7d 76 61 72 20 61 3d 74 28 33 29 2c 66 3d 74 28 22 68 61 6e 64 6c 65 22 29 2c 63 3d 74 28 38 29 2c 75 3d 74 28 22 65 65 22 29 2c 73 3d 74 28 36 29 2c 64 3d 74 28 34 29 2c 70 3d 74 28 32 29 2c 6c 3d 70 2e 67 65 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 28 22 73 73 6c 22 29 3d 3d 3d 21 31 3f 22 68 74 74 70 22 3a 22 68 74 74 70 73 22 2c 6d 3d Data Ascii: ent,e.parentNode.insertBefore(r,e)}}function i(){"complete"===v.readyState&&o()}function o(){f("mark",["domContent",a()+M.offset],null,"api")}var a=t(3),f=t("handle"),c=t(8),u=t("ee"),s=t(6),d=t(4),p=t(2),l=p.getConfiguration("ssl")===!1?"http":"https",m=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49740	3.161.150.25	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:59 UTC	728	OUT	GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=6e38 HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:47:59 UTC	1475	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:47:59 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Miss from cloudfront Via: 1.1 ec13c3d37b9631316c1317d4f9c05e1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: UKimvQWdMKwrM1XSLaAfdK8QL70Ye4gpLJu44PXM9biARSecd17ClA== Vary: Origin
2024-04-18 07:47:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49741	3.161.150.25	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:59 UTC	770	OUT	GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.13047567448616437&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:47:59 UTC	1475	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:47:59 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Miss from cloudfront Via: 1.1 57e6ef65d699199d9881c4002445b1b2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: 0ssSqiAwM_NiIsPsJh0pEpemV2MvSSuv1c5UsaGhiK4txT6qbwz8uw== Vary: Origin
2024-04-18 07:47:59 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.16	49742	23.21.145.8	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:59 UTC	642	OUT	GET /snare.js HTTP/1.1 Host: mpsnare.iesnare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=
2024-04-18 07:47:59 UTC	511	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 18 Apr 2024 07:47:59 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 38567 Connection: close Set-Cookie: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef=h//vmXSI/uI6tUK3tqLWZiShJ0v31fu+kO/9DZ4wku4=;Path=/;Expires=Fri, 18-Apr-2025 07:47:59 GMT;Max-Age=31536000;Secure;HttpOnly;SameSite=None Cache-Control: no-cache, private Pragma: no-cache Expires: 0 p3p: CP="NON DSP COR CURa" Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-04-18 07:47:59 UTC	15873	IN	Data Raw: 2f 2a 20 43 6f 70 79 72 69 67 68 74 28 63 29 20 32 30 31 36 2c 20 69 6f 76 61 74 69 6f 6e 2c 20 69 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 20 2a 2f 20 77 69 6e 64 6f 77 2e 69 6f 5f 6c 61 73 74 5f 65 72 72 6f 72 3d 22 22 3b 76 61 72 20 5f 69 5f 61 3d 28 77 69 6e 64 6f 77 2e 69 6f 5f 67 6c 6f 62 61 6c 5f 6f 62 6a 65 63 74 5f 6e 61 6d 65 7c 7c 22 49 47 4c 4f 4f 22 29 2c 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 3d 22 69 6f 22 3b 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 3d 28 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 7c 7c 7b 7d 29 3b 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 5b 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 5d 3d 28 77 69 6e 64 6f 77 5b 5f 69 5f 61 5d 5b 6c 6f 63 61 6c 4f 62 6a 65 63 74 4e 61 6d 65 5d 7c 7c 7b 7d 29 3b 66 75 6e Data Ascii: /* Copyright(c) 2016, iovation, inc. All rights reserved */ window.io_last_error="";var _i_a=(window.io_global_object_name\|\|"IGLOO"),localObjectName="io";window[_i_a]=(window[_i_a]\|\|{});window[_i_a][localObjectName]=(window[_i_a][localObjectName]\|\|{});fun
2024-04-18 07:47:59 UTC	1024	IN	Data Raw: 34 30 30 30 30 2c 30 78 32 2c 30 78 34 30 30 30 32 2c 30 78 32 2c 30 78 34 30 30 30 32 2c 30 78 32 30 30 30 30 30 30 2c 30 78 32 30 34 30 30 30 30 2c 30 78 32 30 30 30 30 30 30 2c 30 78 32 30 34 30 30 30 30 2c 30 78 32 30 30 30 30 30 32 2c 30 78 32 30 34 30 30 30 32 2c 30 78 32 30 30 30 30 30 32 2c 30 78 32 30 34 30 30 30 32 5d 3b 76 61 72 20 5f 69 5f 63 6a 3d 5b 30 2c 30 78 31 30 30 30 30 30 30 30 2c 30 78 38 2c 30 78 31 30 30 30 30 30 30 38 2c 30 2c 30 78 31 30 30 30 30 30 30 30 2c 30 78 38 2c 30 78 31 30 30 30 30 30 30 38 2c 30 78 34 30 30 2c 30 78 31 30 30 30 30 34 30 30 2c 30 78 34 30 38 2c 30 78 31 30 30 30 30 34 30 38 2c 30 78 34 30 30 2c 30 78 31 30 30 30 30 34 30 30 2c 30 78 34 30 38 2c 30 78 31 30 30 30 30 34 30 38 5d 3b 76 61 72 20 5f 69 5f 63 Data Ascii: 40000,0x2,0x40002,0x2,0x40002,0x2000000,0x2040000,0x2000000,0x2040000,0x2000002,0x2040002,0x2000002,0x2040002];var _i_cj=[0,0x10000000,0x8,0x10000008,0,0x10000000,0x8,0x10000008,0x400,0x10000400,0x408,0x10000408,0x400,0x10000400,0x408,0x10000408];var _i_c
2024-04-18 07:47:59 UTC	7639	IN	Data Raw: 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 32 34 29 7c 28 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 31 36 29 7c 28 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3c 3c 38 29 7c 5f 69 66 5f 68 62 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 69 5f 62 69 2b 2b 29 3b 5f 69 5f 61 77 3d 28 28 5f 69 5f 62 70 3e 3e 3e 34 29 5e 20 5f 69 5f 62 71 29 26 30 78 30 66 30 66 30 66 30 66 3b 5f 69 5f 62 71 20 5e 3d 5f 69 5f 61 77 3b 5f 69 5f 62 70 20 5e 3d 28 5f 69 5f 61 77 3c 3c 34 29 3b 5f 69 5f 61 77 3d 28 28 5f 69 5f 62 71 3e 3e 3e 2d 31 36 29 5e 20 5f 69 5f 62 70 29 26 30 78 30 30 30 30 66 66 66 66 3b 5f 69 5f 62 70 20 5e 3d 5f 69 5f 61 77 3b 5f 69 5f 62 71 20 5e Data Ascii: if_hb.charCodeAt(_i_bi++)<<24)\|(_if_hb.charCodeAt(_i_bi++)<<16)\|(_if_hb.charCodeAt(_i_bi++)<<8)\|_if_hb.charCodeAt(_i_bi++);_i_aw=((_i_bp>>>4)^ _i_bq)&0x0f0f0f0f;_i_bq ^=_i_aw;_i_bp ^=(_i_aw<<4);_i_aw=((_i_bq>>>-16)^ _i_bp)&0x0000ffff;_i_bp ^=_i_aw;_i_bq ^
2024-04-18 07:47:59 UTC	14031	IN	Data Raw: 74 3e 27 3b 5f 69 5f 64 6d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 5f 69 5f 64 6e 3b 5f 69 5f 64 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 5f 69 5f 64 6d 29 3b 74 68 69 73 2e 5f 69 5f 67 6d 3d 74 72 75 65 3b 7d 2c 72 65 61 64 79 53 74 61 74 65 43 68 61 6e 67 65 48 61 6e 64 6c 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 69 5f 64 6f 3d 77 69 6e 64 6f 77 2e 65 76 65 6e 74 2e 73 72 63 45 6c 65 6d 65 6e 74 3b 69 66 28 74 68 69 73 2e 5f 69 5f 67 6c 7c 7c 5f 69 5f 64 6f 2e 72 65 61 64 79 53 74 61 74 65 21 3d 34 29 72 65 74 75 72 6e 3b 74 72 79 7b 5f 69 5f 63 72 2e 5f 5f 69 66 5f 65 6a 28 5f 69 5f 64 6f 2e 69 6f 42 65 67 69 6e 28 29 29 3b 7d 63 61 74 63 68 28 63 6f 75 6c 64 4e 6f 74 55 73 65 41 78 45 78 63 65 70 74 69 6f 6e 29 7b 7d 74 68 69 73 2e 5f 69 5f Data Ascii: t>';_i_dm.innerHTML=_i_dn;_i_dl.appendChild(_i_dm);this._i_gm=true;},readyStateChangeHandler:function(){var _i_do=window.event.srcElement;if(this._i_gl\|\|_i_do.readyState!=4)return;try{_i_cr.__if_ej(_i_do.ioBegin());}catch(couldNotUseAxException){}this._i_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49743	3.161.150.25	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:59 UTC	477	OUT	GET /log?domain=blackhawk-cashstar.com&country=us&state=&behavior=implied&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW&c=6e38 HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:48:00 UTC	1482	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:47:59 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Hit from cloudfront Via: 1.1 85d554a60ac318933f765b1c3e116f30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: AL8Sim54abBm9rLdUJZz4SnH8vNPWJjvgfwURqLIvuwrZ3JXW2o5KQ== Age: 1 Vary: Origin
2024-04-18 07:48:00 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49744	3.161.150.25	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:47:59 UTC	519	OUT	GET /bannermsg?action=views&domain=blackhawk-cashstar.com&behavior=implied&country=us&language=en&rand=0.13047567448616437&session=e58a22a8-87de-4dc3-94bc-522b41d24f38&userType=NEW HTTP/1.1 Host: consent.trustarc.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:48:00 UTC	1482	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 43 Connection: close Date: Thu, 18 Apr 2024 07:47:59 GMT Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Security-Policy: object-src 'none'; frame-ancestors https://.trustarc.com https://.prod.internal.trustarc.com https://.trustarc.eu https://.prod.internal.trustarc.eu https://.staging.internal.trustarc.com https://.trustarc-svc.net https://.truste-svc.net https://.qa.truste-svc.net https://.dev.truste-svc.net http://localhost: https://.nymity.com https://.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report Cross-Origin-Embedder-Policy: unsafe-none Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: cross-origin Expect-CT: enforce, max-age=60 Permissions-Policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=() Referrer-Policy: strict-origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Cache: Hit from cloudfront Via: 1.1 7eb3891837ed645c9a5dc4d21a9412fc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: Nq93hD8EWdPn8pO50njJhTpuS9dTmWS_2pv5N3PtQ8AKy7sc8ur8bA== Age: 1 Vary: Origin
2024-04-18 07:48:00 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 db df ef 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49745	3.136.252.66	443	6576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 07:48:00 UTC	1057	OUT	GET /assets/ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tLHN0YXJidWNrcy5jby5qcCxjYXNoc3Rhci5jb20sbWFpbmV2ZW50LmNvbSxxd2VyLmNvbSxub3Jkc3Ryb20uY29tLGV4eG9ubW9iaWwuY29tLHdhbG1hcnQuY29tLGR1bmtpbmRvbnV0cy5jb20sdHJ1bmtjbHViLmNvbSxnaWZ0Y2FyZG1peC5jb20sV0VOREVMTEdDLmNvbSx0ZXNjb2ZvcmJ1c2luZXNzLmNvbSxjYXNleXMuY29tLGhhcnJpc3RlZXRlci5jb20= HTTP/1.1 Host: ht.blackhawknetwork.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dickssportinggoods.cashstar.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 07:48:00 UTC	336	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 07:48:00 GMT Content-Type: application/javascript Content-Length: 876 Connection: close x-amzn-RequestId: 89fd87d3-9df9-40fb-88ca-61a0db9121dc x-amz-apigw-id: WaV3lF09iYcEXbQ= X-Amzn-Trace-Id: Root=1-6620d030-2dfc66d843062fff2dc248ab;Parent=4bdb659779aa7688;Sampled=0;lineage=13ba6a0f:0
2024-04-18 07:48:00 UTC	876	IN	Data Raw: 76 61 72 20 78 20 3d 20 61 74 6f 62 28 22 5a 47 56 73 64 47 45 75 59 32 39 74 4c 47 31 35 59 32 6c 75 5a 57 31 68 5a 32 6c 6d 64 47 4e 68 63 6d 52 7a 4c 6d 4e 76 4c 6e 56 72 4c 47 39 73 62 47 6c 6c 63 79 35 6a 62 32 30 73 63 47 46 75 5a 47 46 6c 65 48 42 79 5a 58 4e 7a 4c 6d 4e 76 62 53 78 68 63 6d 6c 30 65 6d 6c 68 4c 6d 4e 76 62 53 78 74 65 57 4e 70 62 6d 56 74 59 57 64 70 5a 6e 52 6a 59 58 4a 6b 63 79 35 6a 62 32 30 73 61 33 4a 76 5a 32 56 79 4c 6d 4e 76 62 53 78 77 59 57 6c 75 64 47 35 70 64 47 55 75 59 32 39 74 4c 47 4e 6d 61 57 4e 70 63 32 52 31 62 57 31 35 4c 6d 4e 76 62 53 78 6f 62 32 31 6c 59 32 68 6c 5a 69 35 6a 62 32 30 73 5a 47 39 73 62 47 46 79 63 32 68 68 64 6d 56 6a 62 48 56 69 4c 6d 4e 76 62 53 78 73 62 47 4a 6c 59 57 34 75 59 32 39 74 4c Data Ascii: var x = atob("ZGVsdGEuY29tLG15Y2luZW1hZ2lmdGNhcmRzLmNvLnVrLG9sbGllcy5jb20scGFuZGFleHByZXNzLmNvbSxhcml0emlhLmNvbSxteWNpbmVtYWdpZnRjYXJkcy5jb20sa3JvZ2VyLmNvbSxwYWludG5pdGUuY29tLGNmaWNpc2R1bW15LmNvbSxob21lY2hlZi5jb20sZG9sbGFyc2hhdmVjbHViLmNvbSxsbGJlYW4uY29tL

Target ID:	0
Start time:	09:46:16
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:46:16
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1956,i,2780004439923109171,16103955136008577627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
https://dickssportinggoods.cashstar.com/gift-card/view/mUCKtSrpC6CeYefBmCmzbGAco/