Edit tour

Windows Analysis Report
https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288

Overview

General Information

Sample URL:	https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288
Analysis ID:	1430829
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7125224678661500542,6660031049639082003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49750 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49750 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.202.57.177
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rinnovare-dominio?payinvoice=03288 HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/all-stylesheets.css HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sso.serverplan.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/style.css HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/assets/all-stylesheets.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/stacktable.css HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/assets/all-stylesheets.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/fonts.css HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/assets/all-stylesheets.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/font-awesome.css HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sso.serverplan.com/assets/all-stylesheets.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery-1.11.1.min.js HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.cookie.js HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_logo.png HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/images/login_bg.jpg HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/assets/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/header_bg.png HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/assets/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/after_bg.png HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/assets/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2837823766tsa6rf62r1fw6rt22e.png HTTP/1.1Host: duh28uhuyicedhgwuidfycg2789.guestplan.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recorder.js HTTP/1.1Host: rec.smartlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /monitor/stat.js HTTP/1.1Host: www.clickcease.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_logo.png HTTP/1.1Host: sso.serverplan.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /es6/init.9c2ef46a9a6368c3390e.js HTTP/1.1Host: rec.smartlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sso.serverplan.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lorem.gif HTTP/1.1Host: cdn876158d777364.intrepidsupport.itConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2837823766tsa6rf62r1fw6rt22e.png HTTP/1.1Host: duh28uhuyicedhgwuidfycg2789.guestplan.itConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/after_bg.png HTTP/1.1Host: sso.serverplan.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/header_bg.png HTTP/1.1Host: sso.serverplan.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/favicon.ico HTTP/1.1Host: sso.serverplan.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/images/login_bg.jpg HTTP/1.1Host: sso.serverplan.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lorem.gif HTTP/1.1Host: cdn876158d777364.intrepidsupport.itConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dist/favicon.ico HTTP/1.1Host: sso.serverplan.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rec/setup-recording/website HTTP/1.1Host: manager.eu.smartlook.cloudConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: sso.serverplan.com

Source: unknown

HTTP traffic detected: POST /rec/setup-recording/website HTTP/1.1Host: manager.eu.smartlook.cloudConnection: keep-aliveContent-Length: 122sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://sso.serverplan.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sso.serverplan.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 07:21:17 GMTServer: ApacheX-RateLimit-Limit: 0X-RateLimit-Remaining: 0X-RateLimit-Reset: 1970-01-01 01:00:00Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingAccess-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, AcceptAccess-Control-Allow-Method: POST, GET, OPTIONSX-Frame-Options: SAMEORIGINAccess-Control-Allow-Origin: *Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Apr 2024 07:21:29 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeStrict-Transport-Security: max-age=63072000; includeSubDomainsVary: Accept-Encodingsl-trace-id: sUYnwgPZxjDHrn8tjORO_

Source: chromecache_97.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_97.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_80.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_79.2.dr	String found in binary or memory: https://cdn876158d777364.intrepidsupport.it/lorem.gif
Source: chromecache_79.2.dr	String found in binary or memory: https://duh28uhuyicedhgwuidfycg2789.guestplan.it/2837823766tsa6rf62r1fw6rt22e.png
Source: chromecache_90.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_88.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_83.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chromecache_80.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_79.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_79.2.dr	String found in binary or memory: https://monitor.clickcease.com/stats/stats.aspx
Source: chromecache_79.2.dr	String found in binary or memory: https://rec.smartlook.com/recorder.js
Source: chromecache_79.2.dr	String found in binary or memory: https://www.clickcease.com
Source: chromecache_79.2.dr	String found in binary or memory: https://www.clickcease.com/monitor/stat.js

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.57.177:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/54@24/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7125224678661500542,6660031049639082003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7125224678661500542,6660031049639082003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288	0%	Avira URL Cloud	safe
https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://manager.eu.smartlook.cloud/rec/setup-recording/website	0%	Avira URL Cloud	safe
https://duh28uhuyicedhgwuidfycg2789.guestplan.it/2837823766tsa6rf62r1fw6rt22e.png	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://cdn876158d777364.intrepidsupport.it/lorem.gif	0%	Avira URL Cloud	safe
https://manager.eu.smartlook.cloud/rec/setup-recording/website	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d2no1x7oj2rkdb.cloudfront.net	18.65.25.14	true	false	high
sso.serverplan.com	185.13.254.146	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
1610534878.rsc.cdn77.org	143.244.51.206	true	false	unknown
cdn876158d777364.intrepidsupport.it	185.81.4.126	true	false	unknown
manager.eu.smartlook.cloud	18.196.89.120	true	false	unknown
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
www.google.com	142.250.141.103	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
duh28uhuyicedhgwuidfycg2789.guestplan.it	185.81.4.126	true	false	unknown
rec.smartlook.com	unknown	unknown	false	high
www.clickcease.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sso.serverplan.com/assets/all-stylesheets.css	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css	false		high
https://duh28uhuyicedhgwuidfycg2789.guestplan.it/2837823766tsa6rf62r1fw6rt22e.png	false	Avira URL Cloud: safe	unknown
https://rec.smartlook.com/recorder.js	false		high
https://sso.serverplan.com/assets/css/style.css	false		high
https://sso.serverplan.com/assets/images/login_logo.png	false		high
https://sso.serverplan.com/assets/css/stacktable.css	false		high
https://rec.smartlook.com/es6/init.9c2ef46a9a6368c3390e.js	false		high
https://sso.serverplan.com/assets/css/fonts.css	false		high
https://sso.serverplan.com/assets/images/after_bg.png	false		high
https://sso.serverplan.com/assets/js/jquery-1.11.1.min.js	false		high
https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288	false		high
https://sso.serverplan.com/dist/favicon.ico	false		high
https://sso.serverplan.com/assets/css/font-awesome.css	false		high
https://sso.serverplan.com/assets/js/jquery.cookie.js	false		high
https://sso.serverplan.com/assets/images/header_bg.png	false		high
https://sso.serverplan.com/assets/images/login_bg.jpg	false		high
https://www.clickcease.com/monitor/stat.js	false		high
https://cdn876158d777364.intrepidsupport.it/lorem.gif	false	Avira URL Cloud: safe	unknown
https://manager.eu.smartlook.cloud/rec/setup-recording/website	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_97.2.dr	false		high
https://github.com/carhartl/jquery-cookie	chromecache_83.2.dr	false		high
http://fontawesome.io/license	chromecache_97.2.dr	false		high
https://www.clickcease.com	chromecache_79.2.dr	false		high
http://getbootstrap.com)	chromecache_80.2.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_80.2.dr	false		high
https://monitor.clickcease.com/stats/stats.aspx	chromecache_79.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
143.244.51.206	1610534878.rsc.cdn77.org	United States	174	COGENT-174US	false
18.65.25.14	d2no1x7oj2rkdb.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
185.81.4.126	cdn876158d777364.intrepidsupport.it	Italy	52030	SERVERPLAN-ASIT	false
18.196.89.120	manager.eu.smartlook.cloud	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.13.254.146	sso.serverplan.com	Italy	52030	SERVERPLAN-ASIT	false
142.250.141.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430829
Start date and time:	2024-04-24 09:20:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/54@24/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.137.94, 142.251.2.101, 142.251.2.139, 142.251.2.100, 142.251.2.102, 142.251.2.138, 142.251.2.113, 142.251.2.84, 34.104.35.123, 142.250.141.95, 142.250.141.94, 20.114.59.183, 199.232.214.172, 192.229.211.108, 199.232.210.172, 52.165.164.15, 13.95.31.18, 142.251.2.94, 72.21.81.240
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, fonts.gstatic.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 06:21:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985003327892582
Encrypted:	false
SSDEEP:	48:8WdjjT/SwAfHJidAKZdA19ehwiZUklqehOy+3:8emw6Vy
MD5:	AE710C33AFB323E5B921A88833D5E484
SHA1:	81396830288B655595AE6C41A788AB71D89B537C
SHA-256:	668B1EE45C8337FDC7F43AD3E8C29A4A5765120750D695C73103B8F82615688E
SHA-512:	A22455D12E1929D633E34CE051A0A2C047EC2714EBA8779B9FA5EE2630CCAB247B4E3EAB8D4492D657B8124303DBBBA915D3BC80D8A23C05216533FE679FCD3E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 06:21:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.997211597608053
Encrypted:	false
SSDEEP:	48:8PgdjjT/SwAfHJidAKZdA1weh/iZUkAQkqehFy+2:8QmwQ9QMy
MD5:	94AD3703180639E519B7C2450F382213
SHA1:	34A9CBC7950830852568EF9F1B16698D9D29DF49
SHA-256:	FBD2CC92E57B892CCD28093291D4323481D7D59B344FD37AB0E2D579B0F52EEA
SHA-512:	1A16DC86FB05DFB9A0EA0EC7B03EDBCD7C3AC483C119144BC3297BE2C388AC2D1D3B88C13085D446A89190B65E3D8D560C4F67B3BED8C251CD69DC2C8B63BA04
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....S.......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005678370995614
Encrypted:	false
SSDEEP:	48:8xcdjjT/SwsHJidAKZdA14tseh7sFiZUkmgqeh7sTy+BX:8x8mwEnRy
MD5:	2C3F7889646D164CF52769695574B286
SHA1:	169895F34FB32A40A8046A715EE5A77CF77C62BE
SHA-256:	FF469B9A6F7EC97063F76016781AAA57A0D08AE2C2F93EC7F6423D4717A55DE8
SHA-512:	8AB8DBD178BAAF00B8F7FB0C771773DB5278722D68CB3539A44585589104C7E1DFF0ACCCB4705ECCE6FEF8CFBF7E7D3C4076764BAAF475A646F038A308287F8E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 06:21:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.996963277133019
Encrypted:	false
SSDEEP:	48:81djjT/SwAfHJidAKZdA1vehDiZUkwqeh5y+R:8vmw7by
MD5:	B05446201EBD64F39CBC5401725F6783
SHA1:	51C0A7299B5D9AD19920BDEDC9779FC5767A903B
SHA-256:	375E168DAEEEC8F5A5F63B33BAC57797E970665FACEAEE2DAB2A532934940C3E
SHA-512:	D029BD45D4A6BE13FEE15C64846F114646967EC99E0F635E6829BF641FEC15E17F5D459847E2555303ECB547A8725D26249E3F4972D286BEE87E5D4DA2261512
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....,@......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 06:21:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9845887443437267
Encrypted:	false
SSDEEP:	48:8PdjjT/SwAfHJidAKZdA1hehBiZUk1W1qeh/y+C:8Rmwb9fy
MD5:	1DBF0F9186B89C249DFC949C944A9E3E
SHA1:	E47CA1A601D40668DEE99471008E7797ED16C162
SHA-256:	BF2B3A19B1A7E99DE0BAD21C750177CA3003AA0140AC8A1AFEDFF91C6A26538F
SHA-512:	789B62262539E6D69D8CB03CF77AE09D2AEBF972DE37B25F754315A4596D50553D65A401D340CB878DB3AB76CCBFCC9A2A77361E6D5A42D8BA7D5411C0096F43
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....@O......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 06:21:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9972396787999696
Encrypted:	false
SSDEEP:	48:8kdjjT/SwAfHJidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbRy+yT+:8kmw7T/TbxWOvTbRy7T
MD5:	9C2B18FE6CAC5E8D878AD198BFB63507
SHA1:	C5A9D5ADF4836EDE76AC2A5C201885B852BD7325
SHA-256:	6D7A04FC968943013B130E8D801B310FD4DE6D94968100BC6EDDB79EDB737698
SHA-512:	8DE6527B7C11669363D85AD229457F6B554304A29E2CF8EC3172980C03296FE20011BC9347D8A2CE46F36B2346E57F7F6D8E5FC0CDB7A5FC79BB4BD3FD5A57AB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....T......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X.:....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7J.g.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 295 x 37, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6307
Entropy (8bit):	7.903914297061972
Encrypted:	false
SSDEEP:	192:6A2JvJZF2/DI6VtJu76YtMGfZE9eXFvy7rb1X+hRVC8i32pSZ:6A2JvJZF2/k6VXu7PuAy7rbJ+E32pSZ
MD5:	F386A804AD84EC2B4C6798FF79A8A46F
SHA1:	915ECC2D5DFE8AD7B3CB6F3690B9D151DD75E531
SHA-256:	3E8D8093A06D955531EA7856ACC4909358661BF63CDE91014A92F6C4EE5CCD58
SHA-512:	2271A9DD62C278D9119B919677867BC14C98DA02FFBEEF43E57C48658C4CBD7A3914B527938B0ECE1AF08FADD9E4A8147D8AB615477220CE6F86BBDFE52A5746
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/images/login_logo.png
Preview:	.PNG........IHDR...'...%......./.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1350C0C10A1611E7A9C5AFE9DE72EB17" xmpMM:DocumentID="xmp.did:1350C0C20A1611E7A9C5AFE9DE72EB17"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1350C0BF0A1611E7A9C5AFE9DE72EB17" stRef:documentID="xmp.did:1350C0C00A1611E7A9C5AFE9DE72EB17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.A......IDATx..]......=.3.....)".(HD.H..L..=."^......$..../1&$.EOO.<..DA....=M...h....!D...s.vw.......,..3=3=...<}...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	914
Entropy (8bit):	5.0813289063773945
Encrypted:	false
SSDEEP:	24:mA+KLal9yiK6Wkok/lAdj14JaF+K9MogQIv4sim8:mA+EQ9VmS/l6uJq+vog2d
MD5:	9DFD37516265D28F47E6B76302B00E44
SHA1:	1CDAFA5A55A72CB37B89129CFED93EF7F30301BB
SHA-256:	B28559823DC28866058425EA7FF1C06651D0EDFF34A041218A3AB88237825809
SHA-512:	C374A6E368AE2DA12D052763A0436E77C28C6F06EFE8BE9ECCFABD4D19DBA6411B2F096E988146AEC7049E9F5B22A19326EC7B2F98EE42CC4C93B222B721A413
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/css/stacktable.css
Preview:	.stacktable.large-only { display: table; }..stacktable.small-only { display: none; }...ssl_table thead th{..margin:0px;..padding:8px 20px;..font-size:16px;..line-height:20px;..color:#fff;..background:#4e9350;.}...ssl_table tbody td{..font-size:14px;..line-height:18px;..padding:11px 0;..border-bottom:1px solid #e0e0e0;.}..ssl_table tbody td:first-child{..text-align:left;..padding-left:10px;..font-family: 'MyriadProBold';.}..ssl_table{..float:left;..width:100%;..border:1px solid #d8d8d8;..padding:10px 10px;..background:#f9f9f9;.}..ssl_table tbody tr:last-child td{..border-bottom:none;.}.@media screen and (max-width: 750px) {. .stacktable.large-only { display: none; }. .stacktable.small-only { display: table; }..st-head-row{..padding:10px 2%;..background:#4e9250;..font-family: 'MyriadProBold';..margin:5px 0 0;..color:#fff;.}..st-head-row-main{..display:none;.}..ssl_table tbody td br{..display:none;.}.}

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1500x1000, components 3
Category:	downloaded
Size (bytes):	132198
Entropy (8bit):	7.894849481211388
Encrypted:	false
SSDEEP:	3072:v7rya/+2NAR8nX9Sq/Z2FzbdoMQBhg/z5ySzJR:3BpN6QXd/EgMQTg/zJR
MD5:	06597DD5ACECBB6CA6E8AD54DF1682A6
SHA1:	116DA8A57CA2590E2330DE5AC97DF2D89D6E0254
SHA-256:	4F9F8EE2D62863D1D2453B2151DA866D57CF0D1250BD0B1BA6026EEF8BFCF567
SHA-512:	3208EA7ABB3CC3A20036FD49A302D9455783BFECF8D659EC5E44AC8515DC59DA06A2E43BD26901D18AC81CA9640955AEA28082CE67641CBB2840C9978C205F76
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/images/login_bg.jpg
Preview:	......Exif..II*.................Ducky.......<.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BF27341D0A1411E79562821A3E761625" xmpMM:DocumentID="xmp.did:BF27341E0A1411E79562821A3E761625"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF27341B0A1411E79562821A3E761625" stRef:documentID="xmp.did:BF27341C0A1411E79562821A3E761625"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................K..."..&....d....................................................................................................

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 36 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1489
Entropy (8bit):	6.9779965391850265
Encrypted:	false
SSDEEP:	24:l1he91Wwh82lYSKwItRVV+NDT3ouyJ3VDGIdEGV5ZCbsvBXG58sqDhdrV9Yk0V2:LqQvnLbeIJ31dEY5pvBXGHqVFvYzV2
MD5:	2899CBE01CA13FDC7CC4F2159D4365AD
SHA1:	87129F3A665B7D250B165AE70E2834D9C3B5A91C
SHA-256:	1B9159B4DFEB6743647B74D2ED1B6795F04131C2A511A2F6876F14C81199568B
SHA-512:	991BFDC629E26C696076D1825302D6DA4B2B482960F3D478FD982E90CDA609ABB22DFE3347999B47313376C83364F5F60D01EF51DD4DCFA613CDD11DE1D66790
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/images/after_bg.png
Preview:	.PNG........IHDR...$.........~..#....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9" xmpMM:DocumentID="xmp.did:EC73F1040A2011E781BEBD570285F7D4" xmpMM:InstanceID="xmp.iid:EC73F1030A2011E781BEBD570285F7D4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04AB050A37F4E6119CF8AC6C2AA8DC14" stRef:documentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.b....IDATx..T=O.A..........h. A(....:.....)l...

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Obn:Obn
MD5:	9D1EAD73E678FA2F51A70A933B0BF017
SHA1:	D205CBD6783332A212C5AE92D73C77178C2D2F28
SHA-256:	0019DFC4B32D63C1392AA264AED2253C1E0C2FB09216F8E2CC269BBFB8BB49B5
SHA-512:	935B3D516E996F6D25948BA8A54C1B7F70F7F0E3F517E36481FDF0196C2C5CFC2841F86E891F3DF9517746B7FB605DB47CDDED1B8FF78D9482DDAA621DB43A34
Malicious:	false
Reputation:	low
Preview:	Not Found

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 55x49, 32 bits/pixel
Category:	downloaded
Size (bytes):	11234
Entropy (8bit):	2.8401204677080116
Encrypted:	false
SSDEEP:	48:gvl2zH3DqC3P3iCrE79TvoGerBi+vyOdoT6tdsQ56HGMPyuQPS1HFoLSqfjhlQ+y:ihOrSToiQ56DXqtlQYuV5oN7EZ
MD5:	72C2252AE86B380CD0D766B436190AAF
SHA1:	BEC2ECF758802D984ADF2981F896DE25ACE0E960
SHA-256:	A5F84A64F246FFDB0B140EB519C1FF61BD6B2436F65BAC8030B0B30C6D110E89
SHA-512:	842F2F9DA2F91A6F16BDB754F33A830D5D95C16B267C92958B566685E80BDE69B8E5ECAC3D3E1A271A6626FFA3E6B2DEF6E45F0680AC4BF2A8F627B067674236
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/dist/favicon.ico
Preview:	......71.... ..+......(...7...b..... .............................................(]..(]..(]..(]..(]..(]..(]..(]..(]..(]......................................................................................................(]..(]..(]..(]..(]..(]..(]..(]..(]..(]..........................................(]..(]..(]..(]..(]..(]..(]..(]......................................................................................................................(]..(]..(]..(]..(]..(]..(]..(]..(]..................................(]..(]..(]..(]..(]..(]..(]......................................................................................................................................(]..(]..(]..(]..(]..(]..(]..............................(]..(]..(]..(]..(]..(]......................................................................................................................................................(]..(]..(]..(]..(]..(]......................(]..(]..(]..(]..(]................................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
URL:	https://cdn876158d777364.intrepidsupport.it/lorem.gif
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2065
Entropy (8bit):	4.802406561176832
Encrypted:	false
SSDEEP:	48:ztvYCHv3vMVNOjeOui1/pQUb9QU0QUTeQUM0dCk9aafKvRgi4:ztvBHvUVwui1/5bl64M0dCk9LfKvRh4
MD5:	148B3043EFC9F301629AFF494951A44F
SHA1:	577A9FA4BB15777F6984C1F5FD7537FE7E8AC9DC
SHA-256:	45FC1FCE3FE89F6DD7B4238E7A0D4041D58A85D266B0DF3E74E6E83C73320D3F
SHA-512:	1159D53591ED7048DF4F0B8AE20E2B4C2C474139020D573187FB8F0178CB94FE80CD887A90AF107026A28A30F9DEAFAE8EB4EABA657D24DFD269A56B71AD8C33
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/css/fonts.css
Preview:	@font-face {. font-family: 'MyriadProBold';. src: url('/assets/fonts/myriadpro-bold.eot');. src: url('/assets/fonts/myriadpro-bold.eot') format('embedded-opentype'),. url('/assets/fonts/myriadpro-bold.woff') format('woff'),. url('/assets/fonts/myriadpro-bold.ttf') format('truetype'),. url('/assets/fonts/myriadpro-bold.svg#MyriadProBold') format('svg');.}.@font-face {. font-family: 'myriad_pro_blackbold';. src: url('/assets/fonts/myriadpro-black-webfont.eot');. src: url('/assets/fonts/myriadpro-black-webfont.eot?#iefix') format('embedded-opentype'),. url('/assets/fonts/myriadpro-black-webfont.woff') format('woff'),. url('/assets/fonts/myriadpro-black-webfont.ttf') format('truetype'),. url('/assets/fonts/myriadpro-black-webfont.svg#myriad_pro_blackbold') format('svg');..}.@font-face {..font-family: 'MyriadPro-Light';..src: url('/assets/fonts/MyriadPro-Light.eot?') format('eot'),.. url('/assets/fonts/MyriadPro-Light.otf

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	2766
Entropy (8bit):	5.208477522412255
Encrypted:	false
SSDEEP:	48:fHlXXI6dEKcNUiwsRtLx8sTog/aGgz4UH4UGHDD5ywtwZ+eKz:29U6R5eW/1gz4a4ZDT+Z+eKz
MD5:	42667F3807CA7D00D48EDADA518CFCDE
SHA1:	9AA627638AF8E00CAA32E5025911910CB61B626B
SHA-256:	D57D756E53DA27A453471877E6734EC5BB5B5B922B9E5F6876DC14B46A187CBF
SHA-512:	EB41012D00C271D0A39AF77F3720B88EFAEC61133F399ACD315F73CACABC9895CE179DF84549A8DE12E6C4CB971BC31E755F06DA2DC84532D4C77BFC02D9AE32
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288
Preview:	<!DOCTYPE HTML>.<html>.<head>. <base href="/">. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"/>. <meta charset="utf-8">. <title>Server Plan - Accedi ai nostri servizi</title>. <link rel="icon" type="image/x-icon" href="/dist/favicon.ico">. <link href="assets/all-stylesheets.css" rel="stylesheet" type="text/css">. <script type="text/javascript" src="assets/js/jquery-1.11.1.min.js"></script>. <script type="text/javascript" src="assets/js/jquery.cookie.js"></script>.. [if lt IE 9]>. <script src="/assets/js/html5.js" type="text/javascript"></script>. <![endif]-->. <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css". integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">.. . .</head>.<body>.. Clickcease.com tracking-->.<script type='text/javascript'>var script = document.creat

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65371)
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
Reputation:	low
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 4 x 112, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	6.420941332409717
Encrypted:	false
SSDEEP:	24:81he91Wwh82lYSKwIttVsLT3ouyJ3VDGIdEGLtUU9zbjGA0fN:iqQvnLV+LIJ31dEAtUmzOA0V
MD5:	49A6072F46213B9313518271FB569D05
SHA1:	E72009D133D85F060518E0E12E37329397AA08A1
SHA-256:	49596142233E9B03FBA0DD7410BB974EC590226424795B65E586A1BB6DE7B7CA
SHA-512:	64896CAF50AC3E9F035EFB0299B3A06E7C4D978559D6E25D4B04DE289FE58FB90A453A68EF6210362EEF36FE4FE8D7ADB3AC7C29AD948B14677BDA02EB5DFD09
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......p...... F.....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9" xmpMM:DocumentID="xmp.did:4157C18E0A1811E79C788F389B308BBB" xmpMM:InstanceID="xmp.iid:4157C18D0A1811E79C788F389B308BBB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04AB050A37F4E6119CF8AC6C2AA8DC14" stRef:documentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...D....IDATx.....0..P.g.-........v.%.h..t_....B...

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
URL:	https://duh28uhuyicedhgwuidfycg2789.guestplan.it/2837823766tsa6rf62r1fw6rt22e.png
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3727
Entropy (8bit):	4.4666390503800795
Encrypted:	false
SSDEEP:	48:NkGK4EVJLIbyLTvBekpI29gXoEgXjk0uh/5uRECggPyB/ys9k4v5:GN/VJ4yLTvckpI2OXo3jk0WMEZTBqikU
MD5:	451FBE0072D5DC9AC3FE5D1AA8218F50
SHA1:	11816ABC334D60B103D323AB151CC2F8CCE9D645
SHA-256:	4C3900AD528497C7F05E1BFAE35D0B424D4493DC5C24578112B5469F9F413BE8
SHA-512:	F4C13529259A377A89F135593D61B66E1B56B487ECD26A5039B14356C6BEFA1D2C9DB436DB23F3C29B822D9C5470901DFDDC6A3ECE16C74311291135D8BDA4C8
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/js/jquery.cookie.js
Preview:	/!. jQuery Cookie Plugin v1.4.1. * https://github.com/carhartl/jquery-cookie. . Copyright 2006, 2014 Klaus Hartl. * Released under the MIT license. */.(function (factory) {. if (typeof define === 'function' && define.amd) {. // AMD (Register as an anonymous module). define(['jquery'], factory);. } else if (typeof exports === 'object') {. // Node/CommonJS. module.exports = factory(require('jquery'));. } else {. // Browser globals. factory(jQuery);. }.}(function ($) {.. var pluses = /\+/g;.. function encode(s) {. return config.raw ? s : encodeURIComponent(s);. }.. function decode(s) {. return config.raw ? s : decodeURIComponent(s);. }.. function stringifyCookieValue(value) {. return encode(config.json ? JSON.stringify(value) : String(value));. }.. function parseCookieValue(s) {. if (s.indexOf('"') === 0) {. // This is a quoted cookie as according to RFC2068, unescape

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 295 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6307
Entropy (8bit):	7.903914297061972
Encrypted:	false
SSDEEP:	192:6A2JvJZF2/DI6VtJu76YtMGfZE9eXFvy7rb1X+hRVC8i32pSZ:6A2JvJZF2/k6VXu7PuAy7rbJ+E32pSZ
MD5:	F386A804AD84EC2B4C6798FF79A8A46F
SHA1:	915ECC2D5DFE8AD7B3CB6F3690B9D151DD75E531
SHA-256:	3E8D8093A06D955531EA7856ACC4909358661BF63CDE91014A92F6C4EE5CCD58
SHA-512:	2271A9DD62C278D9119B919677867BC14C98DA02FFBEEF43E57C48658C4CBD7A3914B527938B0ECE1AF08FADD9E4A8147D8AB615477220CE6F86BBDFE52A5746
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...'...%......./.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1350C0C10A1611E7A9C5AFE9DE72EB17" xmpMM:DocumentID="xmp.did:1350C0C20A1611E7A9C5AFE9DE72EB17"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1350C0BF0A1611E7A9C5AFE9DE72EB17" stRef:documentID="xmp.did:1350C0C00A1611E7A9C5AFE9DE72EB17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.A......IDATx..]......=.3.....)".(HD.H..L..=."^......$..../1&$.EOO.<..DA....=M...h....!D...s.vw.......,..3=3=...<}...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	145222
Entropy (8bit):	5.2670517262784315
Encrypted:	false
SSDEEP:	3072:2qDBtbotYFCFFhwaBCs5wEuIVoz8mAyfPYiHF:2qDBdot1rhTCsaSVCAiHF
MD5:	E112B8BF96F23BC2970347A3C98E37FC
SHA1:	CE2408E32AEA3F8323ECEE9B7E4338A943667950
SHA-256:	889794FD02992011C4B843A05190531656D4C6148E6D4375BE6BAB3432B580D0
SHA-512:	AA43C0276A8E03B9C45479D7B7D286EA4648C355977D9742F14E8CCB22CF301ED7890330B39DAFB2D9EC26B6B233F4BCEFC6D231430F3CBA924DEDD13431CEF4
Malicious:	false
Reputation:	low
URL:	https://www.clickcease.com/monitor/stat.js
Preview:	!function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asyncIterator",o=t.toStringTag\|\|"@@toStringTag";function i(e,t,n){return Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}),e[t]}try{i({},"")}catch(c){i=function(e,t,n){return e[t]=n}}function s(e,t,n,r){var o,i,a,s,t=t&&t.prototype instanceof y?t:y,t=Object.create(t.prototype),r=new C(r\|\|[]);return u(t,"_invoke",{value:(o=e,i=n,a=r,s=f,function(e,t){if(s===h)throw new Error("Generator is already running");if(s===m){if("throw"===e)throw t;return{value:c,done:!0}}for(a.method=e,a.arg=t;;){var n=a.delegate;if(n){n=function e(t,n){var r=n.method,o=t.iterator[r];if(o===c)return n.delegate=null,"throw"===r&&t.iterator.return&&(n.method="return",n.arg=c,e(t,n),"throw"===n.method)\|\|"return"!==r&&(n.method="throw",n.ar

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 36 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1489
Entropy (8bit):	6.9779965391850265
Encrypted:	false
SSDEEP:	24:l1he91Wwh82lYSKwItRVV+NDT3ouyJ3VDGIdEGV5ZCbsvBXG58sqDhdrV9Yk0V2:LqQvnLbeIJ31dEY5pvBXGHqVFvYzV2
MD5:	2899CBE01CA13FDC7CC4F2159D4365AD
SHA1:	87129F3A665B7D250B165AE70E2834D9C3B5A91C
SHA-256:	1B9159B4DFEB6743647B74D2ED1B6795F04131C2A511A2F6876F14C81199568B
SHA-512:	991BFDC629E26C696076D1825302D6DA4B2B482960F3D478FD982E90CDA609ABB22DFE3347999B47313376C83364F5F60D01EF51DD4DCFA613CDD11DE1D66790
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...$.........~..#....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9" xmpMM:DocumentID="xmp.did:EC73F1040A2011E781BEBD570285F7D4" xmpMM:InstanceID="xmp.iid:EC73F1030A2011E781BEBD570285F7D4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04AB050A37F4E6119CF8AC6C2AA8DC14" stRef:documentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.b....IDATx..T=O.A..........h. A(....:.....)l...

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32086)
Category:	downloaded
Size (bytes):	95786
Entropy (8bit):	5.393689635062045
Encrypted:	false
SSDEEP:	1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB
MD5:	8101D596B2B8FA35FE3A634EA342D7C3
SHA1:	D6C1F41972DE07B09BFA63D2E50F9AB41EC372BD
SHA-256:	540BC6DEC1DD4B92EA4D3FB903F69EABF6D919AFD48F4E312B163C28CFF0F441
SHA-512:	9E1634EB02AB6ACDFD95BF6544EEFA278DFDEC21F55E94522DF2C949FB537A8DFEAB6BCFECF69E6C82C7F53A87F864699CE85F0068EE60C56655339927EEBCDB
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/js/jquery-1.11.1.min.js
Preview:	/! jQuery v1.11.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	16791
Entropy (8bit):	5.340651755522299
Encrypted:	false
SSDEEP:	192:N/dB0q4e6uyfrbqGIwYMH17o/A85q1H6uy2rbqGIwYRe1qh/ZFgqsC6uyrrbqGIA:ZFuq9PUhq915Cq9C
MD5:	91AC03E451A4BAAE0CF9B1704A46298E
SHA1:	89F3C96528C24B8CFAAD5B25EB6D7B650944EB7F
SHA-256:	3309A12DA2ED18DB77A65BFD52B4FB97A0DFD77E4F22889BD708A010FFD2F9C3
SHA-512:	D78D4569B84F52CF05D081D0999B8FB7A140A9F253AD3ABC1A91121CF93431247003A79D47CC2E090594EC53EC85948383EBBAB22CA950043D53226BB9F7B227
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:300,400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 55x49, 32 bits/pixel
Category:	dropped
Size (bytes):	11234
Entropy (8bit):	2.8401204677080116
Encrypted:	false
SSDEEP:	48:gvl2zH3DqC3P3iCrE79TvoGerBi+vyOdoT6tdsQ56HGMPyuQPS1HFoLSqfjhlQ+y:ihOrSToiQ56DXqtlQYuV5oN7EZ
MD5:	72C2252AE86B380CD0D766B436190AAF
SHA1:	BEC2ECF758802D984ADF2981F896DE25ACE0E960
SHA-256:	A5F84A64F246FFDB0B140EB519C1FF61BD6B2436F65BAC8030B0B30C6D110E89
SHA-512:	842F2F9DA2F91A6F16BDB754F33A830D5D95C16B267C92958B566685E80BDE69B8E5ECAC3D3E1A271A6626FFA3E6B2DEF6E45F0680AC4BF2A8F627B067674236
Malicious:	false
Reputation:	low
Preview:	......71.... ..+......(...7...b..... .............................................(]..(]..(]..(]..(]..(]..(]..(]..(]..(]......................................................................................................(]..(]..(]..(]..(]..(]..(]..(]..(]..(]..........................................(]..(]..(]..(]..(]..(]..(]..(]......................................................................................................................(]..(]..(]..(]..(]..(]..(]..(]..(]..................................(]..(]..(]..(]..(]..(]..(]......................................................................................................................................(]..(]..(]..(]..(]..(]..(]..............................(]..(]..(]..(]..(]..(]......................................................................................................................................................(]..(]..(]..(]..(]..(]......................(]..(]..(]..(]..(]................................

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	233
Entropy (8bit):	4.906808223690217
Encrypted:	false
SSDEEP:	3:f6hmHRWWaDaSHyE1V9j4SP8LM65NlzACN6Z/sNicHtsYKP/sYKqKiHf3n:RHRSa+Fnaw2lzAY6Ei2sKqPHP
MD5:	FF54C64CE246A683B94200E0B2D0B4CA
SHA1:	F6B82212948CED059E04AC9039460584474A9EE4
SHA-256:	F1134D1045465AFE852EA37A9F98137FF86893B061237C5886147C968D119B26
SHA-512:	CE3B99D94B9B6492F01D3A15A79988272DD4AE5F5C07BC93A1249A2E6F914D8105553CADB11E22ADDC6DDF4A55AFB7B306ACDFF5A1E74104CEED9D4BB584D9D1
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/all-stylesheets.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Open+Sans:300,400,700);../* Main Stylesheet */..@import url("css/style.css");.@import url("css/stacktable.css");.@import url("css/fonts.css");.@import url("css/font-awesome.css");..

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text
Category:	downloaded
Size (bytes):	16935
Entropy (8bit):	5.1917294125021165
Encrypted:	false
SSDEEP:	384:cYRT3i6OIcPNmYAwxWoCRzt0cOBq63EGuIxLxfT:cYRjiiclmYjCx4YUR
MD5:	F948AD220C8778CD4C6DC2202BBD0924
SHA1:	46B0798BC453075FD3AACCF836F58EE9F411B377
SHA-256:	5F2CD57B49C2B1BE3A62D2A10E16B5BB4B310ACC58FB7D645B630E2EA4C41A61
SHA-512:	83CE845217F21A521399DABF1308D7D43F0031F469CFD7444AC17F902E49EE1590A752B49DBA7EFF319FC9DE12153657821864593659548CD8D033A9FA9A3113
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/css/style.css
Preview:	/@import url('//fonts.googleapis.com/css?family=Droid+Sans:400,700');/..login_section select[disabled] {. background-color: #DDD;. -webkit-appearance: none;. opacity: 0.5;. filter: alpha(opacity=50);.}...sp-loader {. border: 4px solid #f3f3f3; /* Light grey /. border-top: 4px solid #7777; / Blue */. border-radius: 50%;. width: 27px;. height: 27px;. animation: spin 2s linear infinite;. margin-left:10px;. margin-bottom: 10px;..}..@keyframes spin {. 0% { transform: rotate(0deg); }. 100% { transform: rotate(360deg); }.}..#provincia_cmd, #citta_cmd, #cap_cmd{. width:100%;.}...location-label {. width:20% !important;.}..body {..margin:0 auto;..padding:0;..background:#fff;.}.body, select, input, div {..color:#777;..font-size:16px;..font-weight:300;..line-height:24px;..text-rendering: optimizelegibility;.}.img {..border:none;.}.::-moz-selection {. color: #fff;. background:#000;.}.::selection {. color: #fff;. background:#000;.}.figure{..margin:0;.}..group:after {

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.9889835948335506
Encrypted:	false
SSDEEP:	3:CUkxl7/lHh/:slf/
MD5:	B4491705564909DA7F9EAF749DBBFBB1
SHA1:	279315D507855C6A4351E1E2C2F39DD9CD2FCCD8
SHA-256:	4E0705327480AD2323CB03D9C450FFCAE4A98BF3A5382FA0C7882145ED620E49
SHA-512:	B8D82D64EC656C63570B82215564929ADAD167E61643FD72283B94F3E448EF8AB0AD42202F3537A0DA89960BBDC69498608FC6EC89502C6C338B6226C8BF5E14
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (63814)
Category:	downloaded
Size (bytes):	63897
Entropy (8bit):	5.372243269038527
Encrypted:	false
SSDEEP:	768:YuUKgQEPuFC52CCv//dgD46LEP9dHY2K9P5yUE3Kty2beVDj6l0AT00QY9uKp7zH:OApK9T5IixBpK5+zRv/iXO4RqRGY
MD5:	10427DDE3E476A271E66D878CCE475EF
SHA1:	04ECA3376099C5C681CD051811913EDE9B4A8686
SHA-256:	57321B2DE71525A42212A47A5719BD1B1C66846C4C487D0945C51CB13BC3453E
SHA-512:	464664260CD359D682685A0AB5F9D413C8242B102868E58EACD7713D571C479C69479711961E6C7985D7DC347D31F1FE79952AF16445777B6AD91D53F86C0B22
Malicious:	false
Reputation:	low
URL:	https://rec.smartlook.com/es6/init.9c2ef46a9a6368c3390e.js
Preview:	/! For license information please see init.9c2ef46a9a6368c3390e.js.LICENSE.txt /.(()=>{"use strict";var e,t,o={487:(e,t,o)=>{o.d(t,{f:()=>r});class r extends Error{constructor(e,{additionalData:t={},originalError:o,shouldReport:n=!0}={}){super(e),Object.setPrototypeOf(this,r.prototype),this.name="WebSDKError",this.additionalData=t,this.shouldReport=n,o&&(this.originalName=o.name,this.originalStack=o.stack,this.originalMessage=o.message,this.originalError=o),o instanceof r&&(this.originalAdditionalData=o.additionalData)}toJSON(){return{name:this.name,additionalData:this.additionalData,message:this.message,originalAdditionalData:this.originalAdditionalData,originalError:this.originalError,originalMessage:this.originalMessage,originalName:this.originalName,originalStack:this.originalStack,shouldReport:this.shouldReport,stack:this.stack}}}},92:(e,t,o)=>{var r;o.d(t,{$b:()=>r,FU:()=>n,Vy:()=>i}),function(e){e[e.DEBUG=0]="DEBUG",e[e.INFO=1]="INFO",e[e.WARN=2]="WARN",e[e.ERROR=3]="ERROR"}(r

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1500x1000, components 3
Category:	dropped
Size (bytes):	132198
Entropy (8bit):	7.894849481211388
Encrypted:	false
SSDEEP:	3072:v7rya/+2NAR8nX9Sq/Z2FzbdoMQBhg/z5ySzJR:3BpN6QXd/EgMQTg/zJR
MD5:	06597DD5ACECBB6CA6E8AD54DF1682A6
SHA1:	116DA8A57CA2590E2330DE5AC97DF2D89D6E0254
SHA-256:	4F9F8EE2D62863D1D2453B2151DA866D57CF0D1250BD0B1BA6026EEF8BFCF567
SHA-512:	3208EA7ABB3CC3A20036FD49A302D9455783BFECF8D659EC5E44AC8515DC59DA06A2E43BD26901D18AC81CA9640955AEA28082CE67641CBB2840C9978C205F76
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......<.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BF27341D0A1411E79562821A3E761625" xmpMM:DocumentID="xmp.did:BF27341E0A1411E79562821A3E761625"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BF27341B0A1411E79562821A3E761625" stRef:documentID="xmp.did:BF27341C0A1411E79562821A3E761625"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................K..."..&....d....................................................................................................

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6097), with no line terminators
Category:	downloaded
Size (bytes):	6097
Entropy (8bit):	5.176360788151725
Encrypted:	false
SSDEEP:	96:oqeBHMscxp06EhTJhx5BlM2KseSGNlkamjKWQo:FexMlY6EhTJhx5BlM2reSGNCnj99
MD5:	DF2C664BC207735C2B4A72EA24FDEC35
SHA1:	5B0DAB46FAF67669E0BA89FBB2FA95CCDCE04130
SHA-256:	83DF7460C7E6E2C4EF5573E00CCEF570588CDB34E4286B72B777480098933CAB
SHA-512:	D89668ED6D8E5F2AEA0BB6253DC4D15CA5FA76AAEE740847BA3DE2487B2B969A3AAEDBE9258288658756257F3760425CD2A1E7E664E27C8162B091AF6FE4C3C7
Malicious:	false
Reputation:	low
URL:	https://rec.smartlook.com/recorder.js
Preview:	!function(){"use strict";var o,e,t,n=function(o){var e=null;try{e=window.localStorage.getItem(o)}catch(o){}return e},r=function(o){var e=null;try{e=window.sessionStorage.getItem(o)}catch(o){}return e},d=function(o,e){try{return window.sessionStorage.setItem(o,e),!0}catch(o){return!1}},i="smartlook_events_picker",l=(null===(o=document.currentScript)\|\|void 0===o?void 0:o.src.replace("recorder.js","picker.b30e15f43b03adad19f8.js"))\|\|"",a=new(function(){function o(){}return o.prototype.load=function(){var o=document.createElement("script");o.src=l,document.head.append(o),d(i,"1")},o.prototype.shouldLoad=function(){return!(!r(i)&&!n(i))\|\|document.referrer.indexOf("picker/4f249306-efd5-4127-b768-79a6750a7c5d-ca97caf7-335a-4e1f-b047-be42cb6098f9")>-1},o}()),c="smartlook_live_heatmaps",s=(null===(e=document.currentScript)\|\|void 0===e?void 0:e.src.replace("recorder.js","live-heatmaps.62a43386de67a3a0cf47.js"))\|\|"",u=new(function(){function o(){}return o.prototype.load=function(){var o=document.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 4 x 112, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	1186
Entropy (8bit):	6.420941332409717
Encrypted:	false
SSDEEP:	24:81he91Wwh82lYSKwIttVsLT3ouyJ3VDGIdEGLtUU9zbjGA0fN:iqQvnLV+LIJ31dEAtUmzOA0V
MD5:	49A6072F46213B9313518271FB569D05
SHA1:	E72009D133D85F060518E0E12E37329397AA08A1
SHA-256:	49596142233E9B03FBA0DD7410BB974EC590226424795B65E586A1BB6DE7B7CA
SHA-512:	64896CAF50AC3E9F035EFB0299B3A06E7C4D978559D6E25D4B04DE289FE58FB90A453A68EF6210362EEF36FE4FE8D7ADB3AC7C29AD948B14677BDA02EB5DFD09
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/images/header_bg.png
Preview:	.PNG........IHDR.......p...... F.....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9" xmpMM:DocumentID="xmp.did:4157C18E0A1811E79C788F389B308BBB" xmpMM:InstanceID="xmp.iid:4157C18D0A1811E79C788F389B308BBB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04AB050A37F4E6119CF8AC6C2AA8DC14" stRef:documentID="xmp.did:D251FCA8DDA4E611A30CE705A37508B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...D....IDATx.....0..P.g.-........v.%.h..t_....B...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (310)
Category:	downloaded
Size (bytes):	26661
Entropy (8bit):	4.826441267166352
Encrypted:	false
SSDEEP:	384:Injj++ArEVSIDqvnIDyYTnBrlkPvVYaJYa:uj++A4VSIDqvnI+YTBr6PvV5JD
MD5:	249E8AD52F7B62F89B4503A0ECD39D48
SHA1:	803B5CCDFF542CF7160DDE78C6ACBDA90ED77F8C
SHA-256:	A4CEE47621C1F178C3C96B435A2289C088607FDE22CBC54F27AD8F2ED196FBEE
SHA-512:	4793C80672F0123A7B70B78ECEF7554D01D5FE43DEAECA8B8CAFBC898EE9EFD5BFCB28D85683CD06E68D95CFC51B4F68B83A4F8BE27CC7DBA7611C5756964B10
Malicious:	false
Reputation:	low
URL:	https://sso.serverplan.com/assets/css/font-awesome.css
Preview:	/!. Font Awesome 4.2.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('/assets/fonts/fontawesome-webfont.eot?v=4.2.0');. src: url('/assets/fonts/fontawesome-webfont.eot?#iefix&v=4.2.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff?v=4.2.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.2.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.2.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..fa-lg {. font-size: 1.33333333em;. line-height: 0.75em;

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:21:11.033987999 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:11.052932024 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:11.174555063 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:16.703309059 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.703365088 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:16.703445911 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.703957081 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.703993082 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:16.704194069 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.704221010 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.704237938 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:16.704435110 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:16.704446077 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.349684954 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.350960016 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.350974083 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.351999998 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.352072001 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.359077930 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.359199047 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.359263897 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.359273911 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.361671925 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.361917973 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.361943007 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.363436937 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.363497019 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.364897966 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.364979982 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.400096893 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.416121006 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:17.416140079 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:17.463140011 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.035598993 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.035665035 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.035789967 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.035824060 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.035953999 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.036120892 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.039555073 CEST	49710	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.039585114 CEST	443	49710	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.058033943 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.058382988 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.058429956 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.058527946 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.058793068 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.058835030 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.058896065 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.059622049 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.059655905 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.059802055 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.059827089 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.104130030 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.213603020 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.213651896 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.213756084 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.213975906 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.213999033 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.385710001 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.385891914 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.385946989 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.393048048 CEST	49711	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.393065929 CEST	443	49711	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.421014071 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.421101093 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.421174049 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.422144890 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.422199965 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.422276020 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.423224926 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.423302889 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.423368931 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.424345016 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.424388885 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.424453020 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.424967051 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.424998999 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.425980091 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.426012993 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.426671982 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.426707029 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.427764893 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.427800894 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.542756081 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.544825077 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.544858932 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.546482086 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.546550989 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.548579931 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.548681021 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.549650908 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.549676895 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.593780994 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.660773039 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:18.660871029 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:18.660959959 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:18.661770105 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:18.661802053 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:18.704123974 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.704838037 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.704869986 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.705120087 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.705363989 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.705571890 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.705605984 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.706532955 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.706633091 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.706717968 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.706934929 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.707648039 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.707740068 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.708168030 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:18.748131037 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.756123066 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:18.903124094 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903297901 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903348923 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.903373003 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903459072 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903506994 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.903517008 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903616905 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903660059 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.903669119 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903776884 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903827906 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.903836012 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903940916 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.903985023 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.903994083 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.904337883 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.904388905 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.904397011 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.904700994 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.904757023 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.904764891 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.905459881 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.905509949 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.905518055 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.905632973 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.905680895 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.905688047 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.906105995 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.906147003 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.906155109 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.906322002 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.906367064 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.906374931 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.906999111 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.907047987 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.907056093 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.907159090 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.907205105 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.907213926 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.907995939 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.908049107 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.908056974 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.908225060 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.908273935 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.908282995 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.908898115 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.908947945 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.908957005 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.909045935 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.909089088 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.909096956 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.909828901 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.909878016 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.909885883 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.910471916 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.910516024 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.910523891 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.910960913 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.911009073 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.911015987 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.911555052 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.911617041 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.911623955 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.911642075 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.911684036 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:18.911690950 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:18.962625980 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.031932116 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:19.032841921 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:19.032922983 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:19.034410000 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:19.034485102 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:19.036756992 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:19.036849976 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:19.056982040 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.056994915 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.057050943 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.057390928 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.057440996 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.057454109 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.057497025 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.058202028 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.058259010 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.058366060 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.058415890 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.059194088 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.059250116 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.060020924 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.060075998 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.060947895 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.061000109 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.061583996 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.061646938 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.061830997 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.061885118 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.062592983 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.062655926 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.063513041 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.063585997 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.064326048 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.064376116 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.065068960 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.065126896 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.066930056 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.066989899 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.067051888 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.067095041 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.067101955 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.067194939 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.067249060 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.068217039 CEST	49716	443	192.168.2.5	104.18.10.207
Apr 24, 2024 09:21:19.068233013 CEST	443	49716	104.18.10.207	192.168.2.5
Apr 24, 2024 09:21:19.068383932 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.069634914 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.072367907 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.072401047 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.072818041 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.072937012 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.072990894 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.073407888 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.073412895 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.073419094 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.073904037 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.073937893 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.073960066 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.073983908 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.074546099 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.074635029 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.074654102 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.074716091 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.074862003 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.074914932 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.075337887 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.075350046 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.076236963 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.076319933 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.077732086 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.077807903 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.078308105 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.078455925 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.079441071 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.079451084 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.079739094 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.079761028 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.080723047 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.080811024 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.081075907 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.081091881 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.087325096 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:19.087340117 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:19.124214888 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.124228954 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.124296904 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.124304056 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.139703989 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:19.350094080 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.350167036 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.350241899 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.350284100 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.350869894 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.351057053 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.351131916 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.358901978 CEST	49715	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.358923912 CEST	443	49715	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.399861097 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.668562889 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.668580055 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.668654919 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.668694973 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.668711901 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.668764114 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.670250893 CEST	49714	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.670268059 CEST	443	49714	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714473963 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714499950 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714585066 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714596033 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.714662075 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.714725971 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714787960 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714807987 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714840889 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.714873075 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.714889050 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.715207100 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715266943 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715276957 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715292931 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715317011 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.715337038 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715348005 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715353012 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.715421915 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.715445995 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715496063 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.715511084 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.715545893 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.718377113 CEST	49718	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.718420029 CEST	443	49718	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.719089985 CEST	49719	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.719110012 CEST	443	49719	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.723566055 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.723607063 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.723696947 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.723951101 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.723964930 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:19.759166002 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.759172916 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:19.918605089 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:19.918653965 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:19.918750048 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:19.920730114 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:19.920754910 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.032836914 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.032874107 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033032894 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033030987 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033030987 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033054113 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033087969 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033127069 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033159018 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033196926 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033196926 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033499956 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033577919 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033593893 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033716917 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033734083 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033782005 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.033790112 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.033840895 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.034025908 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.034034967 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.034084082 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.034094095 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.034141064 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.034153938 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.034185886 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.034197092 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.034229040 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.037172079 CEST	49720	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.037199974 CEST	443	49720	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.088013887 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.274162054 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.274225950 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.287710905 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.287745953 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.288759947 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.338937998 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.352482080 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.352500916 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.352598906 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.352644920 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.352686882 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.352804899 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.352817059 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.352854967 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.352883101 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.353277922 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.353288889 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.353352070 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.353804111 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.353812933 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.353899956 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.354089022 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.354098082 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.354154110 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.354183912 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.366914988 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.383150101 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.383249998 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.384440899 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.384527922 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.411894083 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.411936045 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.413167953 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.436892986 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.438340902 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.438698053 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.442960024 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.484121084 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.484123945 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.502562046 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:20.502630949 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:20.502707958 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:20.503247023 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:20.503278017 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:20.610070944 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.610163927 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.610232115 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.610502958 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.610526085 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.610542059 CEST	49724	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.610548973 CEST	443	49724	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.634325027 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:20.654845953 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:20.670797110 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.670815945 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.670897961 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.670918941 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.670947075 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.671016932 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.674252033 CEST	49717	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.674267054 CEST	443	49717	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.782883883 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:20.802913904 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.803006887 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.803091049 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.803575039 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.803627968 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.803759098 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.804073095 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.804111958 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.804209948 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.804570913 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.804605007 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.805088043 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.805114031 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.805609941 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:20.805627108 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:20.813365936 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.813435078 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:20.813505888 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.813817024 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:20.813862085 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.007608891 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.007652044 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.007785082 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.008126974 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.008171082 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.008301020 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.008588076 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.008610010 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.008745909 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.008760929 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.013526917 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.013581991 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.013602018 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.013660908 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.013685942 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.013729095 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.013729095 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.013853073 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.013902903 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.023118973 CEST	49723	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.023148060 CEST	443	49723	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.147372007 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.147676945 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.147720098 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.148720026 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.148797035 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.155210018 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.155296087 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.156747103 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.156764030 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.157130957 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.158204079 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.202779055 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.202866077 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.202954054 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.203192949 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.203226089 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.204132080 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.341607094 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.342032909 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.342060089 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.343139887 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.343215942 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.351233959 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.351485014 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.351524115 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.353194952 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.353282928 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.449861050 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.450176954 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.450197935 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.451576948 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.451653004 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.451735973 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.451777935 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.451808929 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.452198982 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.452337027 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.452361107 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.452445984 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.452454090 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.452755928 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.452833891 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.452892065 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.456131935 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.456334114 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.456367970 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.456939936 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.457335949 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.457405090 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.457465887 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.491086960 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.491415977 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.491478920 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.492014885 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.492036104 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.492052078 CEST	49730	443	192.168.2.5	23.202.57.177
Apr 24, 2024 09:21:21.492058992 CEST	443	49730	23.202.57.177	192.168.2.5
Apr 24, 2024 09:21:21.496131897 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.500118971 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.501151085 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.501164913 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.513036966 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.513153076 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.513657093 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.513820887 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.514373064 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.514453888 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.515038967 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.515068054 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.515795946 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.515819073 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.516127110 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.516139984 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.558598042 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.558629990 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.558726072 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.606880903 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.606956959 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.607036114 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.607779026 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.607810974 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.680006981 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.680068970 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.680119991 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.680145025 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.680182934 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.680423021 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.687259912 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.687361002 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.687616110 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.709052086 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.711950064 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.711976051 CEST	443	49731	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.712013960 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.712034941 CEST	49731	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.731606960 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.731616974 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.731630087 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.731791019 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.731815100 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.731879950 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.741848946 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.741879940 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.742032051 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.742647886 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:21.742670059 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:21.758434057 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.758444071 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.758476973 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.758517981 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.758534908 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.758562088 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.807585955 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.835916996 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.835979939 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.836242914 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.842801094 CEST	49726	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:21.842860937 CEST	443	49726	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:21.851748943 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.852416039 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.852447033 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.855959892 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.856031895 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.856766939 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.856848001 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.857247114 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.857255936 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:21.885859013 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.885869026 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.885898113 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.885951042 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.885988951 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.886010885 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.886037111 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.886055946 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.901231050 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:21.912578106 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.912667990 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.912688017 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.912758112 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.939532042 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.939547062 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.939606905 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.939616919 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.939652920 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.970865965 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.970890999 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.970956087 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:21.970963955 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:21.971004009 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.013397932 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.043020010 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.043040991 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.043072939 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.043102026 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.043126106 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.043139935 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.043189049 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.068295002 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.068303108 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.068332911 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.068375111 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.068418026 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.068437099 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.068490028 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.071964979 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.072638988 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.072665930 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.073982954 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.074052095 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.075351954 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.075401068 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.075776100 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.075781107 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.088340044 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.088382959 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.088407040 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.088414907 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.088426113 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.088455915 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.088478088 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.089154005 CEST	49732	443	192.168.2.5	18.65.25.14
Apr 24, 2024 09:21:22.089186907 CEST	443	49732	18.65.25.14	192.168.2.5
Apr 24, 2024 09:21:22.094345093 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.094377041 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.094386101 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.097723007 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.097805977 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.099343061 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.099348068 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.099396944 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.102827072 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.102854967 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.102912903 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.102929115 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.102961063 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.103019953 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.117588043 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.117661953 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.117743969 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.118499041 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.118531942 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.119077921 CEST	49728	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.119117022 CEST	443	49728	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.121817112 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.122488022 CEST	49727	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.122514009 CEST	443	49727	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.132198095 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.132251024 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.132469893 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.132958889 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.132992983 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.139380932 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.142898083 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.142961979 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.143028021 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.143650055 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.143678904 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.161550045 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:22.161640882 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:22.249522924 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.249893904 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.249937057 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.251396894 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.251503944 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.253355980 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.253458977 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.253853083 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.253870964 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.293490887 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.412295103 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.412313938 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.412396908 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.412453890 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.412570000 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.412580013 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.412627935 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.412661076 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.412945986 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.412955046 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.413022995 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.462204933 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462236881 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462246895 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462320089 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.462347984 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462388992 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462416887 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.462444067 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.462444067 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.462477922 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.495239973 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.495311975 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.495351076 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.495407104 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.495430946 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.495479107 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.495481968 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.495878935 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.498516083 CEST	49733	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.498528957 CEST	443	49733	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.627845049 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.627898932 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.627933979 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.627986908 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.628015995 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.628036976 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.693731070 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.693763018 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.693886995 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.693886995 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.693917990 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.693974018 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.733026028 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.733059883 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.733156919 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.733223915 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.733287096 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.733365059 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.733814955 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.733899117 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.734154940 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.734230995 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.734653950 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.734736919 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.735105991 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.735182047 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.753103018 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.753165007 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.753215075 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.753242016 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.753273010 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.753303051 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.753370047 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.753555059 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.753654957 CEST	49735	443	192.168.2.5	143.244.51.206
Apr 24, 2024 09:21:22.753684998 CEST	443	49735	143.244.51.206	192.168.2.5
Apr 24, 2024 09:21:22.762645006 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.762897015 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.762933969 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.763254881 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.763350010 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.766505957 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.766588926 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.766961098 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.767046928 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.767122984 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.767138004 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.776879072 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.777091026 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.777105093 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.777616024 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.777929068 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.778040886 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.778098106 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.783371925 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.783572912 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.783596039 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.783932924 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.784383059 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.784441948 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.784491062 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.812899113 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.820168972 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.828116894 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:22.828804970 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:22.888094902 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.888283014 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:22.888355017 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.889111996 CEST	49734	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:22.889153004 CEST	443	49734	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:23.051513910 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.051539898 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.051640034 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.051820040 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.051901102 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.052189112 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.052272081 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.052459002 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.052526951 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.052777052 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.052843094 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.053061962 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.053129911 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.053153992 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.053184986 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.053236961 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.053289890 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.053289890 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.053327084 CEST	443	49729	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.053401947 CEST	49729	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.400438070 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:23.400623083 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:23.400768042 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:23.422576904 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.422605991 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.422687054 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.422698021 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.422765970 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.426306009 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.426491022 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.426546097 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.697812080 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.697863102 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.697916985 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.698323011 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.698338032 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.700138092 CEST	49738	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.700185061 CEST	443	49738	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.701168060 CEST	49737	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.701217890 CEST	443	49737	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.702138901 CEST	49736	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:23.702161074 CEST	443	49736	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:23.768969059 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.768996954 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.769202948 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.770235062 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:23.770247936 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:23.930231094 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:23.930262089 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:23.931049109 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:23.931549072 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:23.931565046 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.345432043 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.345801115 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.345824003 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.346863985 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.347265959 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.347345114 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.347435951 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.388127089 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.412859917 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.426659107 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.426688910 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.428644896 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.429414034 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.429747105 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.429836035 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.477971077 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.578109980 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.578453064 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:24.578500986 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.579462051 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.579526901 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:24.580039024 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:24.580108881 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.580250025 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:24.580260038 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:24.634255886 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:24.993902922 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.993985891 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.994062901 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.994081974 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.994113922 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.994182110 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.994187117 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.994223118 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.994261980 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:24.994306087 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.995644093 CEST	49739	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:24.995656967 CEST	443	49739	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.001441002 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.001543045 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.001614094 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.001914978 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.001950979 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.057923079 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.057981968 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.058002949 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.058027029 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.058043957 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.058074951 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.058090925 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.102977037 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.217994928 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:25.218214989 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:25.218415022 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:25.218960047 CEST	49743	443	192.168.2.5	185.81.4.126
Apr 24, 2024 09:21:25.218975067 CEST	443	49743	185.81.4.126	192.168.2.5
Apr 24, 2024 09:21:25.375682116 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375711918 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375729084 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375875950 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375895023 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375917912 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.375976086 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.375983953 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.376009941 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.376176119 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.376221895 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.376235008 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.376266003 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.376682043 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.645765066 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.646325111 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.646384001 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.646883011 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.647773027 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.647866011 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.648685932 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694016933 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694048882 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694214106 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694243908 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694243908 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694258928 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694273949 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694300890 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694550037 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694601059 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694607973 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694634914 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694925070 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.694977999 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.694983959 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.695014000 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.695485115 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.695528984 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.695533991 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.695564032 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.696116924 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.696158886 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.727086067 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.727365017 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.727416992 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.727425098 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:25.727457047 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:25.728224039 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.012269974 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.012283087 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.012480021 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.012720108 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.013071060 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.013207912 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.013293982 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.013613939 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.013966084 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.014000893 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014008999 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.014049053 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014187098 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014297009 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.014389038 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.014421940 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014456034 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014558077 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014558077 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.014571905 CEST	443	49740	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.016334057 CEST	49740	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.291821957 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.291881084 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.292017937 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.292105913 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.292107105 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.292175055 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.292221069 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.292296886 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.801067114 CEST	49744	443	192.168.2.5	185.13.254.146
Apr 24, 2024 09:21:26.801126003 CEST	443	49744	185.13.254.146	192.168.2.5
Apr 24, 2024 09:21:26.977406025 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:26.977484941 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:26.977583885 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:26.977948904 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:26.977986097 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.600840092 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.601723909 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:27.601783037 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.602971077 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.603041887 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:27.605839014 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:27.605916977 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.606445074 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:27.606462002 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:27.650621891 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.213157892 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.213361979 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.213726997 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.220669031 CEST	49745	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.220707893 CEST	443	49745	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.381340027 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.381371975 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.381644964 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.381829023 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.381844044 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.991964102 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.992609978 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.992628098 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.996506929 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.996849060 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.997721910 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:28.997813940 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:28.998193979 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:29.041585922 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:29.041595936 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:29.074887991 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:29.075030088 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:29.075110912 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:29.088443041 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:29.217135906 CEST	49722	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:21:29.217195034 CEST	443	49722	142.250.141.103	192.168.2.5
Apr 24, 2024 09:21:29.589711905 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:29.589791059 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:29.589854002 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:29.595211029 CEST	49746	443	192.168.2.5	18.196.89.120
Apr 24, 2024 09:21:29.595230103 CEST	443	49746	18.196.89.120	192.168.2.5
Apr 24, 2024 09:21:32.925318003 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:32.925502062 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:32.926043034 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:32.926085949 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:32.926151991 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:32.926667929 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:32.926683903 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.085036039 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.085074902 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.271507978 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.271586895 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.518699884 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.518779039 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.519949913 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.520175934 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.521215916 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.521469116 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.521503925 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.521574974 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.896214962 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.896337986 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.896513939 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.896570921 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:33.896631956 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:33.896683931 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:34.141740084 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:34.141740084 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:21:34.141809940 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 24, 2024 09:21:34.141875982 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 24, 2024 09:22:18.548053026 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:18.548091888 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.548317909 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:18.548840046 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:18.548855066 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.912092924 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.912707090 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:18.912733078 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.913908958 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.915108919 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:18.915287018 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:18.962379932 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:28.905752897 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:28.905926943 CEST	443	49756	142.250.141.103	192.168.2.5
Apr 24, 2024 09:22:28.906019926 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:29.217566013 CEST	49756	443	192.168.2.5	142.250.141.103
Apr 24, 2024 09:22:29.217597961 CEST	443	49756	142.250.141.103	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 09:21:15.181555986 CEST	53	58038	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:15.192666054 CEST	53	53478	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:16.209388018 CEST	52685	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:16.209537983 CEST	63607	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:16.283967972 CEST	53	58367	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:16.702250004 CEST	53	52685	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:16.702299118 CEST	53	63607	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:18.059241056 CEST	61932	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:18.059385061 CEST	62474	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:18.212704897 CEST	53	61932	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:18.212812901 CEST	53	62474	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:18.502315044 CEST	62075	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:18.502990007 CEST	64119	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:18.570373058 CEST	53	59471	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:18.658216000 CEST	53	62075	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:18.658232927 CEST	53	64119	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:19.722448111 CEST	53076	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:19.722896099 CEST	51051	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.121057034 CEST	53	60231	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.499026060 CEST	53	51051	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.499102116 CEST	53	53076	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.798909903 CEST	54618	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.799273014 CEST	57931	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.800142050 CEST	57732	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.800398111 CEST	60163	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.801441908 CEST	63308	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.801723957 CEST	50840	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:20.963754892 CEST	53	63308	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.964021921 CEST	53	50840	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.971894026 CEST	53	57732	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:20.972419024 CEST	53	60163	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:21.047161102 CEST	62851	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:21.048007965 CEST	58764	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:21.201057911 CEST	53	62851	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:21.202171087 CEST	53	58764	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:21.577140093 CEST	53	54618	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:21.577517986 CEST	53	57931	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:21.959121943 CEST	59797	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:21.959606886 CEST	49584	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:22.113380909 CEST	53	59797	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:22.114454031 CEST	53	49584	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:23.771426916 CEST	64364	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:23.771641016 CEST	51151	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:23.925988913 CEST	53	51151	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:23.926171064 CEST	53	64364	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:26.796076059 CEST	58077	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:26.796412945 CEST	56255	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:26.950668097 CEST	53	56255	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:26.957392931 CEST	53	58077	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:28.226490974 CEST	55586	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:28.226490974 CEST	54524	53	192.168.2.5	1.1.1.1
Apr 24, 2024 09:21:28.380430937 CEST	53	54524	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:28.380495071 CEST	53	55586	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:34.240261078 CEST	53	53829	1.1.1.1	192.168.2.5
Apr 24, 2024 09:21:53.216530085 CEST	53	60038	1.1.1.1	192.168.2.5
Apr 24, 2024 09:22:14.357678890 CEST	53	59499	1.1.1.1	192.168.2.5
Apr 24, 2024 09:22:16.180852890 CEST	53	51437	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 09:21:16.209388018 CEST	192.168.2.5	1.1.1.1	0xcce7	Standard query (0)	sso.serverplan.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:16.209537983 CEST	192.168.2.5	1.1.1.1	0x3896	Standard query (0)	sso.serverplan.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:18.059241056 CEST	192.168.2.5	1.1.1.1	0x3e5f	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.059385061 CEST	192.168.2.5	1.1.1.1	0x3fb3	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:18.502315044 CEST	192.168.2.5	1.1.1.1	0xb341	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.502990007 CEST	192.168.2.5	1.1.1.1	0xd365	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:19.722448111 CEST	192.168.2.5	1.1.1.1	0xf69c	Standard query (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:19.722896099 CEST	192.168.2.5	1.1.1.1	0xbcfd	Standard query (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it	65	IN (0x0001)	false
Apr 24, 2024 09:21:20.798909903 CEST	192.168.2.5	1.1.1.1	0x87c8	Standard query (0)	cdn876158d777364.intrepidsupport.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.799273014 CEST	192.168.2.5	1.1.1.1	0xf014	Standard query (0)	cdn876158d777364.intrepidsupport.it	65	IN (0x0001)	false
Apr 24, 2024 09:21:20.800142050 CEST	192.168.2.5	1.1.1.1	0x9481	Standard query (0)	www.clickcease.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.800398111 CEST	192.168.2.5	1.1.1.1	0x6de1	Standard query (0)	www.clickcease.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:20.801441908 CEST	192.168.2.5	1.1.1.1	0xe57	Standard query (0)	rec.smartlook.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.801723957 CEST	192.168.2.5	1.1.1.1	0xfcb0	Standard query (0)	rec.smartlook.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:21.047161102 CEST	192.168.2.5	1.1.1.1	0xe194	Standard query (0)	sso.serverplan.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:21.048007965 CEST	192.168.2.5	1.1.1.1	0x461b	Standard query (0)	sso.serverplan.com	65	IN (0x0001)	false
Apr 24, 2024 09:21:21.959121943 CEST	192.168.2.5	1.1.1.1	0x4c23	Standard query (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:21.959606886 CEST	192.168.2.5	1.1.1.1	0x411b	Standard query (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it	65	IN (0x0001)	false
Apr 24, 2024 09:21:23.771426916 CEST	192.168.2.5	1.1.1.1	0x370b	Standard query (0)	cdn876158d777364.intrepidsupport.it	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:23.771641016 CEST	192.168.2.5	1.1.1.1	0x1601	Standard query (0)	cdn876158d777364.intrepidsupport.it	65	IN (0x0001)	false
Apr 24, 2024 09:21:26.796076059 CEST	192.168.2.5	1.1.1.1	0x847	Standard query (0)	manager.eu.smartlook.cloud	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:26.796412945 CEST	192.168.2.5	1.1.1.1	0xdef6	Standard query (0)	manager.eu.smartlook.cloud	65	IN (0x0001)	false
Apr 24, 2024 09:21:28.226490974 CEST	192.168.2.5	1.1.1.1	0x393b	Standard query (0)	manager.eu.smartlook.cloud	65	IN (0x0001)	false
Apr 24, 2024 09:21:28.226490974 CEST	192.168.2.5	1.1.1.1	0x4902	Standard query (0)	manager.eu.smartlook.cloud	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 09:21:16.702250004 CEST	1.1.1.1	192.168.2.5	0xcce7	No error (0)	sso.serverplan.com		185.13.254.146	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.212704897 CEST	1.1.1.1	192.168.2.5	0x3e5f	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.212704897 CEST	1.1.1.1	192.168.2.5	0x3e5f	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.212812901 CEST	1.1.1.1	192.168.2.5	0x3fb3	No error (0)	maxcdn.bootstrapcdn.com			65	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.103	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.147	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.99	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.104	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.105	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658216000 CEST	1.1.1.1	192.168.2.5	0xb341	No error (0)	www.google.com		142.250.141.106	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:18.658232927 CEST	1.1.1.1	192.168.2.5	0xd365	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 24, 2024 09:21:20.499102116 CEST	1.1.1.1	192.168.2.5	0xf69c	No error (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it		185.81.4.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	rec.smartlook.com	1610534878.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	1610534878.rsc.cdn77.org		143.244.51.206	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	1610534878.rsc.cdn77.org		89.187.187.19	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	1610534878.rsc.cdn77.org		89.187.187.12	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	1610534878.rsc.cdn77.org		143.244.51.201	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.963754892 CEST	1.1.1.1	192.168.2.5	0xe57	No error (0)	1610534878.rsc.cdn77.org		89.187.187.15	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.964021921 CEST	1.1.1.1	192.168.2.5	0xfcb0	No error (0)	rec.smartlook.com	1610534878.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:21:20.971894026 CEST	1.1.1.1	192.168.2.5	0x9481	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:21:20.971894026 CEST	1.1.1.1	192.168.2.5	0x9481	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.65.25.14	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.971894026 CEST	1.1.1.1	192.168.2.5	0x9481	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.65.25.116	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.971894026 CEST	1.1.1.1	192.168.2.5	0x9481	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.65.25.57	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.971894026 CEST	1.1.1.1	192.168.2.5	0x9481	No error (0)	d2no1x7oj2rkdb.cloudfront.net		18.65.25.6	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:20.972419024 CEST	1.1.1.1	192.168.2.5	0x6de1	No error (0)	www.clickcease.com	d2no1x7oj2rkdb.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:21:21.201057911 CEST	1.1.1.1	192.168.2.5	0xe194	No error (0)	sso.serverplan.com		185.13.254.146	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:21.577140093 CEST	1.1.1.1	192.168.2.5	0x87c8	No error (0)	cdn876158d777364.intrepidsupport.it		185.81.4.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:22.113380909 CEST	1.1.1.1	192.168.2.5	0x4c23	No error (0)	duh28uhuyicedhgwuidfycg2789.guestplan.it		185.81.4.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:23.926171064 CEST	1.1.1.1	192.168.2.5	0x370b	No error (0)	cdn876158d777364.intrepidsupport.it		185.81.4.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:26.957392931 CEST	1.1.1.1	192.168.2.5	0x847	No error (0)	manager.eu.smartlook.cloud		18.196.89.120	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:26.957392931 CEST	1.1.1.1	192.168.2.5	0x847	No error (0)	manager.eu.smartlook.cloud		3.68.161.96	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:26.957392931 CEST	1.1.1.1	192.168.2.5	0x847	No error (0)	manager.eu.smartlook.cloud		3.126.65.57	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:28.380430937 CEST	1.1.1.1	192.168.2.5	0x4902	No error (0)	manager.eu.smartlook.cloud		18.196.89.120	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:28.380430937 CEST	1.1.1.1	192.168.2.5	0x4902	No error (0)	manager.eu.smartlook.cloud		3.68.161.96	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:28.380430937 CEST	1.1.1.1	192.168.2.5	0x4902	No error (0)	manager.eu.smartlook.cloud		3.126.65.57	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:31.975888968 CEST	1.1.1.1	192.168.2.5	0xb5ff	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 09:21:31.975888968 CEST	1.1.1.1	192.168.2.5	0xb5ff	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:33.068572998 CEST	1.1.1.1	192.168.2.5	0x652c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:33.068572998 CEST	1.1.1.1	192.168.2.5	0x652c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:46.900269985 CEST	1.1.1.1	192.168.2.5	0xd7ca	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:21:46.900269985 CEST	1.1.1.1	192.168.2.5	0xd7ca	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:22:08.289721012 CEST	1.1.1.1	192.168.2.5	0x5c73	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:22:08.289721012 CEST	1.1.1.1	192.168.2.5	0x5c73	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:22:33.839704037 CEST	1.1.1.1	192.168.2.5	0x21af	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 24, 2024 09:22:33.839704037 CEST	1.1.1.1	192.168.2.5	0x21af	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sso.serverplan.com

https:

maxcdn.bootstrapcdn.com

duh28uhuyicedhgwuidfycg2789.guestplan.it

rec.smartlook.com

www.clickcease.com

cdn876158d777364.intrepidsupport.it

manager.eu.smartlook.cloud

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:17 UTC	695	OUT	GET /rinnovare-dominio?payinvoice=03288 HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:18 UTC	491	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 07:21:17 GMT Server: Apache X-RateLimit-Limit: 0 X-RateLimit-Remaining: 0 X-RateLimit-Reset: 1970-01-01 01:00:00 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-24 07:21:18 UTC	2778	IN	Data Raw: 61 63 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 72 76 65 72 20 50 6c 61 6e 20 2d 20 41 63 63 65 64 69 20 61 69 20 6e 6f 73 74 72 69 20 73 65 72 76 69 7a 69 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 Data Ascii: ace<!DOCTYPE HTML><html><head> <base href="/"> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"/> <meta charset="utf-8"> <title>Server Plan - Accedi ai nostri servizi</title> <li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:18 UTC	595	OUT	GET /assets/all-stylesheets.css HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:18 UTC	474	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:18 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f32-e9-55552f420ec44" Accept-Ranges: bytes Content-Length: 233 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: text/css
2024-04-24 07:21:18 UTC	233	IN	Data Raw: 40 69 6d 70 6f 72 74 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 34 30 30 2c 37 30 30 29 3b 0a 0a 2f 2a 20 4d 61 69 6e 20 53 74 79 6c 65 73 68 65 65 74 20 2a 2f 0a 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 22 29 3b 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 63 73 73 2f 73 74 61 63 6b 74 61 62 6c 65 2e 63 73 73 22 29 3b 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 63 73 73 2f 66 6f 6e 74 73 2e 63 73 73 22 29 3b 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 63 73 73 22 29 3b 0a 0a Data Ascii: @import url(https://fonts.googleapis.com/css?family=Open+Sans:300,400,700);/* Main Stylesheet */@import url("css/style.css");@import url("css/stacktable.css");@import url("css/fonts.css");@import url("css/font-awesome.css");

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	104.18.10.207	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:18 UTC	609	OUT	GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sso.serverplan.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:18 UTC	919	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:18 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"ec3bb52a00e176a7181d454dffaea219" Last-Modified: Mon, 25 Jan 2021 22:03:59 GMT CDN-CachedAt: 03/18/2024 12:26:29 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 1108 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestId: d447f8f68c312b262d8e0d98a9602458 CDN-Cache: HIT CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 879455f4898d09f1-LAS alt-svc: h3=":443"; ma=86400
2024-04-24 07:21:18 UTC	450	IN	Data Raw: 37 63 31 64 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 33 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b Data Ascii: 7c1d/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 64 6f 74 74 65 64 7d 62 2c 73 74 72 6f 6e 67 7b Data Ascii: ck}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 2e 33 35 65 6d 20 2e 36 32 Data Ascii: webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}fieldset{padding:.35em .62
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6c 79 70 68 69 63 6f 6e 73 20 48 61 6c 66 6c 69 6e 67 73 27 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f Data Ascii: face{font-family:'Glyphicons Halflings';src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format('embedded-opentype'),url(../fonts/glyphicons-halflings-regular.woff2) format('woff2'),url(../fonts/
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 6e 74 3a 22 5c 65 30 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 6f 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 37 22 7d 2e Data Ascii: nt:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-off:before{content:"\e017"}.
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 69 74 61 6c 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 65 78 74 2d 68 65 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 35 30 22 7d 2e 67 6c 79 70 68 Data Ascii: 4"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:before{content:"\e050"}.glyph
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 74 3a 22 5c 65 30 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 65 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 6c 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 69 6e 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 2d 73 69 67 Data Ascii: t:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\e082"}.glyphicon-remove-sig
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 6e 74 3a 22 5c 65 31 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 74 77 65 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6c 64 65 72 2d 63 6c 6f Data Ascii: nt:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\e116"}.glyphicon-folder-clo
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 63 6f 6e 2d 70 61 70 65 72 63 6c 69 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 68 65 61 72 74 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 69 6e 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 68 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 75 73 68 70 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 75 73 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 67 62 Data Ascii: con-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{content:"\e148"}.glyphicon-gb
2024-04-24 07:21:18 UTC	1369	IN	Data Raw: 70 70 79 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 73 61 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 6f 70 65 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 72 65 64 69 74 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 72 61 6e 73 66 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 75 74 6c 65 72 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 39 Data Ascii: ppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cutlery:before{content:"\e179

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:18 UTC	581	OUT	GET /assets/css/style.css HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/assets/all-stylesheets.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	478	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 06 Mar 2019 08:55:10 GMT ETag: "1404bd-4227-5836925a735a7" Accept-Ranges: bytes Content-Length: 16935 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: text/css
2024-04-24 07:21:19 UTC	7714	IN	Data Raw: 2f 2a 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 44 72 6f 69 64 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 27 29 3b 2a 2f 0a 2e 6c 6f 67 69 6e 5f 73 65 63 74 69 6f 6e 20 73 65 6c 65 63 74 5b 64 69 73 61 62 6c 65 64 5d 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 44 44 44 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 20 6e 6f 6e 65 3b 0a 20 20 6f 70 61 63 69 74 79 3a 20 30 2e 35 3b 0a 20 20 66 69 6c 74 65 72 3a 20 61 6c 70 68 61 28 6f 70 61 63 69 74 79 3d 35 30 29 3b 0a 7d 0a 0a 2e 73 70 2d 6c 6f 61 64 65 72 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 34 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 2f 2a 20 4c Data Ascii: /@import url('//fonts.googleapis.com/css?family=Droid+Sans:400,700');/.login_section select[disabled] { background-color: #DDD; -webkit-appearance: none; opacity: 0.5; filter: alpha(opacity=50);}.sp-loader { border: 4px solid #f3f3f3; /* L
2024-04-24 07:21:19 UTC	8000	IN	Data Raw: 76 65 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 69 6d 61 67 65 73 2f 68 65 61 64 65 72 5f 62 67 2e 70 6e 67 29 20 72 65 70 65 61 74 20 6c 65 66 74 20 74 6f 70 3b 0a 7d 0a 2e 6c 6f 67 6f 5f 62 6f 78 3a 3a 61 66 74 65 72 7b 0a 09 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 0a 09 6c 65 66 74 3a 30 70 78 3b 0a 09 72 69 67 68 74 3a 30 70 78 3b 0a 09 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 0a 09 62 6f 74 74 6f 6d 3a 2d 31 35 70 78 3b 0a 09 63 6f 6e 74 65 6e 74 3a 22 22 3b 0a 09 77 69 64 74 68 3a 33 36 70 78 3b 0a 09 68 65 69 67 68 74 3a 31 36 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 69 6d 61 67 65 73 2f 61 66 74 65 72 5f 62 67 2e 70 Data Ascii: ve;width:100%;background:url(/assets/images/header_bg.png) repeat left top;}.logo_box::after{position:absolute;left:0px;right:0px;margin:0 auto;bottom:-15px;content:"";width:36px;height:16px;background:url(/assets/images/after_bg.p
2024-04-24 07:21:19 UTC	1221	IN	Data Raw: 30 70 78 3b 0a 09 68 65 69 67 68 74 3a 35 30 70 78 3b 0a 7d 0a 20 20 2e 6c 6f 67 69 6e 5f 66 6f 72 6d 20 75 6c 20 6c 69 20 2e 72 65 67 5f 66 69 65 6c 64 7b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 37 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 33 37 70 78 3b 0a 20 20 7d 0a 0a 2e 6c 6f 67 69 6e 5f 66 6f 72 6d 20 75 6c 20 6c 69 20 2e 6c 6f 67 69 6e 5f 62 74 6e 2c 20 2e 6c 6f 67 69 6e 5f 66 6f 72 6d 20 75 6c 20 6c 69 20 2e 61 63 63 6f 75 6e 74 5f 62 74 6e 7b 0a 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 35 30 70 78 3b 0a 7d 0a 2e 6c 6f 67 69 6e 5f 66 6f 72 6d 7b 0a 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 0a 7d 0a 2e 6c 6f 67 6f 5f 62 6f 78 7b 0a 09 68 65 69 67 68 74 3a 31 30 30 70 78 3b 0a 7d 0a 2e 6c 6f 67 69 6e 5f 62 6f 78 Data Ascii: 0px;height:50px;} .login_form ul li .reg_field{ line-height:37px; height:37px; }.login_form ul li .login_btn, .login_form ul li .account_btn{line-height:50px;}.login_form{padding-bottom:20px;}.logo_box{height:100px;}.login_box

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:18 UTC	586	OUT	GET /assets/css/stacktable.css HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/assets/all-stylesheets.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	475	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f3d-392-55552f420f7f4" Accept-Ranges: bytes Content-Length: 914 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: text/css
2024-04-24 07:21:19 UTC	914	IN	Data Raw: 2e 73 74 61 63 6b 74 61 62 6c 65 2e 6c 61 72 67 65 2d 6f 6e 6c 79 20 7b 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 20 7d 0a 2e 73 74 61 63 6b 74 61 62 6c 65 2e 73 6d 61 6c 6c 2d 6f 6e 6c 79 20 7b 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 7d 0a 0a 2e 73 73 6c 5f 74 61 62 6c 65 20 74 68 65 61 64 20 74 68 7b 0a 09 6d 61 72 67 69 6e 3a 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 38 70 78 20 32 30 70 78 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 0a 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 0a 09 63 6f 6c 6f 72 3a 23 66 66 66 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 23 34 65 39 33 35 30 3b 0a 7d 0a 0a 2e 73 73 6c 5f 74 61 62 6c 65 20 74 62 6f 64 79 20 74 64 7b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 09 6c 69 6e 65 Data Ascii: .stacktable.large-only { display: table; }.stacktable.small-only { display: none; }.ssl_table thead th{margin:0px;padding:8px 20px;font-size:16px;line-height:20px;color:#fff;background:#4e9350;}.ssl_table tbody td{font-size:14px;line

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:19 UTC	581	OUT	GET /assets/css/fonts.css HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/assets/all-stylesheets.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	476	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f3c-811-55552f420f7f4" Accept-Ranges: bytes Content-Length: 2065 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: text/css
2024-04-24 07:21:19 UTC	2065	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4d 79 72 69 61 64 50 72 6f 42 6f 6c 64 27 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 6d 79 72 69 61 64 70 72 6f 2d 62 6f 6c 64 2e 65 6f 74 27 29 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 6d 79 72 69 61 64 70 72 6f 2d 62 6f 6c 64 2e 65 6f 74 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 0a 20 20 20 20 20 20 20 20 20 75 72 6c 28 27 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 6d 79 72 69 61 64 70 72 6f 2d 62 6f 6c 64 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 0a 20 20 20 20 20 20 20 20 20 75 72 6c 28 27 Data Ascii: @font-face { font-family: 'MyriadProBold'; src: url('/assets/fonts/myriadpro-bold.eot'); src: url('/assets/fonts/myriadpro-bold.eot') format('embedded-opentype'), url('/assets/fonts/myriadpro-bold.woff') format('woff'), url('

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:19 UTC	588	OUT	GET /assets/css/font-awesome.css HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sso.serverplan.com/assets/all-stylesheets.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	478	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f3b-6825-55552f420f7f4" Accept-Ranges: bytes Content-Length: 26661 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: text/css
2024-04-24 07:21:19 UTC	7714	IN	Data Raw: 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 32 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 0a Data Ascii: /! Font Awesome 4.2.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwesome';
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 72 6f 73 73 68 61 69 72 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 35 62 22 3b 0a 7d 0a 2e 66 61 2d 74 69 6d 65 73 2d 63 69 72 63 6c 65 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 35 63 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 2d 63 69 72 63 6c 65 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 35 64 22 3b 0a 7d 0a 2e 66 61 2d 62 61 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 35 65 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 30 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f Data Ascii: rosshairs:before { content: "\f05b";}.fa-times-circle-o:before { content: "\f05c";}.fa-check-circle-o:before { content: "\f05d";}.fa-ban:before { content: "\f05e";}.fa-arrow-left:before { content: "\f060";}.fa-arrow-right:before { co
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 31 65 22 3b 0a 7d 0a 2e 66 61 2d 74 65 72 6d 69 6e 61 6c 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 30 22 3b 0a 7d 0a 2e 66 61 2d 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 31 22 3b 0a 7d 0a 2e 66 61 2d 6d 61 69 6c 2d 72 65 70 6c 79 2d 61 6c 6c 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 72 65 70 6c 79 2d 61 6c 6c 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 32 32 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 66 75 6c 6c 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 2d 6f 3a 62 65 66 6f Data Ascii: { content: "\f11e";}.fa-terminal:before { content: "\f120";}.fa-code:before { content: "\f121";}.fa-mail-reply-all:before,.fa-reply-all:before { content: "\f122";}.fa-star-half-empty:before,.fa-star-half-full:before,.fa-star-half-o:befo
2024-04-24 07:21:20 UTC	2947	IN	Data Raw: 20 22 5c 66 31 63 62 22 3b 0a 7d 0a 2e 66 61 2d 6a 73 66 69 64 64 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 63 63 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 66 65 2d 62 6f 75 79 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 6c 69 66 65 2d 62 75 6f 79 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 6c 69 66 65 2d 73 61 76 65 72 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 73 75 70 70 6f 72 74 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 6c 69 66 65 2d 72 69 6e 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 63 64 22 3b 0a 7d 0a 2e 66 61 2d 63 69 72 63 6c 65 2d 6f 2d 6e 6f 74 63 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 31 63 65 22 3b 0a 7d 0a 2e 66 61 2d 72 61 3a 62 65 66 6f 72 65 2c 0a 2e 66 Data Ascii: "\f1cb";}.fa-jsfiddle:before { content: "\f1cc";}.fa-life-bouy:before,.fa-life-buoy:before,.fa-life-saver:before,.fa-support:before,.fa-life-ring:before { content: "\f1cd";}.fa-circle-o-notch:before { content: "\f1ce";}.fa-ra:before,.f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:19 UTC	585	OUT	GET /assets/js/jquery-1.11.1.min.js HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	493	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f7f-1762a-55552f4214dad" Accept-Ranges: bytes Content-Length: 95786 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: application/javascript
2024-04-24 07:21:19 UTC	7699	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 31 31 2e 31 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e Data Ascii: /! jQuery v1.11.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a win
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 2c 62 3d 6e 75 6c 6c 7d 7d 66 75 6e 63 74 69 6f 6e 20 6a 62 28 61 2c 62 29 7b 76 61 72 20 63 3d 61 2e 73 70 6c 69 74 28 22 7c 22 29 2c 65 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 65 2d 2d 29 64 2e 61 74 74 72 48 61 6e 64 6c 65 5b 63 5b 65 5d 5d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 6b 62 28 61 2c 62 29 7b 76 61 72 20 63 3d 62 26 26 61 2c 64 3d 63 26 26 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 62 2e 6e 6f 64 65 54 79 70 65 26 26 28 7e 62 2e 73 6f 75 72 63 65 49 6e 64 65 78 7c 7c 44 29 2d 28 7e 61 2e 73 6f 75 72 63 65 49 6e 64 65 78 7c 7c 44 29 3b 69 66 28 64 29 72 65 74 75 72 6e 20 64 3b 69 66 28 63 29 77 68 69 6c 65 28 Data Ascii: arentNode&&b.parentNode.removeChild(b),b=null}}function jb(a,b){var c=a.split("\|"),e=a.length;while(e--)d.attrHandle[c[e]]=b}function kb(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&(~b.sourceIndex\|\|D)-(~a.sourceIndex\|\|D);if(d)return d;if(c)while(
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 65 72 73 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 66 62 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 61 29 3b 72 65 74 75 72 6e 20 65 5b 75 5d 3f 65 28 62 29 3a 65 2e 6c 65 6e 67 74 68 3e 31 3f 28 63 3d 5b 61 2c 61 2c 22 22 2c 62 5d 2c 64 2e 73 65 74 46 69 6c 74 65 72 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 68 62 28 66 75 6e 63 74 69 6f 6e 28 61 2c 63 29 7b 76 61 72 20 64 2c 66 3d 65 28 61 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 64 3d 4b 2e 63 61 6c 6c 28 61 2c 66 5b 67 5d 29 2c 61 5b 64 5d 3d 21 28 63 5b 64 5d 3d 66 5b 67 5d 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 65 28 Data Ascii: ers[a.toLowerCase()]\|\|fb.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?hb(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=K.call(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 20 63 3d 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 65 3e 31 3f 6d 2e 75 6e 69 71 75 65 28 63 29 3a 63 29 2c 63 2e 73 65 6c 65 63 74 6f 72 3d 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 3f 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 2b 22 20 22 2b 61 3a 61 2c 63 7d 2c 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 77 28 74 68 69 73 2c 61 7c 7c 5b 5d 2c 21 31 29 29 7d 2c 6e 6f 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 77 28 74 68 69 73 2c 61 7c 7c 5b 5d 2c 21 30 29 29 7d 2c 69 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 77 28 74 68 69 73 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 74 Data Ascii: c=this.pushStack(e>1?m.unique(c):c),c.selector=this.selector?this.selector+" "+a:a,c},filter:function(a){return this.pushStack(w(this,a\|\|[],!1))},not:function(a){return this.pushStack(w(this,a\|\|[],!0))},is:function(a){return!!w(this,"string"==typeof a&&t
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 62 2c 63 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 63 26 26 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 64 3d 22 64 61 74 61 2d 22 2b 62 2e 72 65 70 6c 61 63 65 28 4e 2c 22 2d 24 31 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 63 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 64 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 63 29 7b 74 72 79 7b 63 3d 22 74 72 75 65 22 3d 3d 3d 63 3f 21 30 3a 22 66 61 6c 73 65 22 3d 3d 3d 63 3f 21 31 3a 22 6e 75 6c 6c 22 3d 3d 3d 63 3f 6e 75 6c 6c 3a 2b 63 2b 22 22 3d 3d 3d 63 3f 2b 63 3a 4d 2e 74 65 73 74 28 63 29 3f 6d 2e 70 61 72 73 65 4a 53 4f 4e 28 63 29 3a 63 7d 63 61 74 63 68 28 65 29 7b 7d 6d 2e 64 61 74 61 28 61 2c 62 2c 63 29 7d 65 6c 73 65 20 63 3d 76 6f 69 64 20 30 7d Data Ascii: b,c){if(void 0===c&&1===a.nodeType){var d="data-"+b.replace(N,"-$1").toLowerCase();if(c=a.getAttribute(d),"string"==typeof c){try{c="true"===c?!0:"false"===c?!1:"null"===c?null:+c+""===c?+c:M.test(c)?m.parseJSON(c):c}catch(e){}m.data(a,b,c)}else c=void 0}
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 22 29 2c 66 26 26 66 2e 61 70 70 6c 79 28 68 2c 63 29 2c 66 3d 67 26 26 68 5b 67 5d 2c 66 26 26 66 2e 61 70 70 6c 79 26 26 6d 2e 61 63 63 65 70 74 44 61 74 61 28 68 29 26 26 28 62 2e 72 65 73 75 6c 74 3d 66 2e 61 70 70 6c 79 28 68 2c 63 29 2c 62 2e 72 65 73 75 6c 74 3d 3d 3d 21 31 26 26 62 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 29 3b 69 66 28 62 2e 74 79 70 65 3d 70 2c 21 65 26 26 21 62 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 28 29 26 26 28 21 6b 2e 5f 64 65 66 61 75 6c 74 7c 7c 6b 2e 5f 64 65 66 61 75 6c 74 2e 61 70 70 6c 79 28 6f 2e 70 6f 70 28 29 2c 63 29 3d 3d 3d 21 31 29 26 26 6d 2e 61 63 63 65 70 74 44 61 74 61 28 64 29 26 26 67 26 26 64 5b 70 5d 26 26 21 6d 2e 69 73 57 69 6e 64 6f 77 28 64 29 29 7b 6c 3d 64 5b 67 5d 2c Data Ascii: "),f&&f.apply(h,c),f=g&&h[g],f&&f.apply&&m.acceptData(h)&&(b.result=f.apply(h,c),b.result===!1&&b.preventDefault());if(b.type=p,!e&&!b.isDefaultPrevented()&&(!k._default\|\|k._default.apply(o.pop(),c)===!1)&&m.acceptData(d)&&g&&d[p]&&!m.isWindow(d)){l=d[g],
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 61 72 20 62 3d 65 62 2e 73 70 6c 69 74 28 22 7c 22 29 2c 63 3d 61 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 28 29 3b 69 66 28 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 29 77 68 69 6c 65 28 62 2e 6c 65 6e 67 74 68 29 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2e 70 6f 70 28 29 29 3b 72 65 74 75 72 6e 20 63 7d 76 61 72 20 65 62 3d 22 61 62 62 72 7c 61 72 74 69 63 6c 65 7c 61 73 69 64 65 7c 61 75 64 69 6f 7c 62 64 69 7c 63 61 6e 76 61 73 7c 64 61 74 61 7c 64 61 74 61 6c 69 73 74 7c 64 65 74 61 69 6c 73 7c 66 69 67 63 61 70 74 69 6f 6e 7c 66 69 67 75 72 65 7c 66 6f 6f 74 65 72 7c 68 65 61 64 65 72 7c 68 67 72 6f 75 70 7c 6d 61 72 6b 7c 6d 65 74 65 72 7c 6e 61 76 7c 6f 75 74 70 75 74 7c 70 72 6f 67 72 65 73 73 7c 73 65 63 Data Ascii: ar b=eb.split("\|"),c=a.createDocumentFragment();if(c.createElement)while(b.length)c.createElement(b.pop());return c}var eb="abbr\|article\|aside\|audio\|bdi\|canvas\|data\|datalist\|details\|figcaption\|figure\|footer\|header\|hgroup\|mark\|meter\|nav\|output\|progress\|sec
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 28 65 5b 30 5d 2c 22 64 69 73 70 6c 61 79 22 29 3b 72 65 74 75 72 6e 20 65 2e 64 65 74 61 63 68 28 29 2c 66 7d 66 75 6e 63 74 69 6f 6e 20 46 62 28 61 29 7b 76 61 72 20 62 3d 79 2c 63 3d 44 62 5b 61 5d 3b 72 65 74 75 72 6e 20 63 7c 7c 28 63 3d 45 62 28 61 2c 62 29 2c 22 6e 6f 6e 65 22 21 3d 3d 63 26 26 63 7c 7c 28 43 62 3d 28 43 62 7c 7c 6d 28 22 3c 69 66 72 61 6d 65 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 27 30 27 20 77 69 64 74 68 3d 27 30 27 20 68 65 69 67 68 74 3d 27 30 27 2f 3e 22 29 29 2e 61 70 70 65 6e 64 54 6f 28 62 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 29 2c 62 3d 28 43 62 5b 30 5d 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 7c 7c 43 62 5b 30 5d 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 29 2e 64 6f 63 75 6d 65 6e 74 2c 62 2e 77 72 69 Data Ascii: (e[0],"display");return e.detach(),f}function Fb(a){var b=y,c=Db[a];return c\|\|(c=Eb(a,b),"none"!==c&&c\|\|(Cb=(Cb\|\|m("<iframe frameborder='0' width='0' height='0'/>")).appendTo(b.documentElement),b=(Cb[0].contentWindow\|\|Cb[0].contentDocument).document,b.wri
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 69 64 20 30 21 3d 3d 63 3f 6d 2e 73 74 79 6c 65 28 61 2c 62 2c 63 29 3a 6d 2e 63 73 73 28 61 2c 62 29 7d 2c 61 2c 62 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 29 7d 2c 73 68 6f 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 56 62 28 74 68 69 73 2c 21 30 29 7d 2c 68 69 64 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 56 62 28 74 68 69 73 29 7d 2c 74 6f 67 67 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 3f 61 3f 74 68 69 73 2e 73 68 6f 77 28 29 3a 74 68 69 73 2e 68 69 64 65 28 29 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 55 28 74 68 69 73 29 3f 6d 28 74 68 69 73 29 2e 73 68 6f 77 28 29 3a 6d 28 74 68 69 73 29 2e 68 69 Data Ascii: id 0!==c?m.style(a,b,c):m.css(a,b)},a,b,arguments.length>1)},show:function(){return Vb(this,!0)},hide:function(){return Vb(this)},toggle:function(a){return"boolean"==typeof a?a?this.show():this.hide():this.each(function(){U(this)?m(this).show():m(this).hi
2024-04-24 07:21:20 UTC	8000	IN	Data Raw: 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 4e 61 6d 65 22 2c 22 74 22 29 2c 62 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 20 20 3c 6c 69 6e 6b 2f 3e 3c 74 61 62 6c 65 3e 3c 2f 74 61 62 6c 65 3e 3c 61 20 68 72 65 66 3d 27 2f 61 27 3e 61 3c 2f 61 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 27 63 68 65 63 6b 62 6f 78 27 2f 3e 22 2c 64 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 61 22 29 5b 30 5d 2c 63 3d 79 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2c 65 3d 63 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 79 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 61 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 69 6e 70 75 74 22 29 5b 30 5d 2c 64 2e 73 Data Ascii: setAttribute("className","t"),b.innerHTML=" <link/><table></table><a href='/a'>a</a><input type='checkbox'/>",d=b.getElementsByTagName("a")[0],c=y.createElement("select"),e=c.appendChild(y.createElement("option")),a=b.getElementsByTagName("input")[0],d.s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49719	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:19 UTC	581	OUT	GET /assets/js/jquery.cookie.js HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:19 UTC	490	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f81-e8f-55552f421595e" Accept-Ranges: bytes Content-Length: 3727 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: application/javascript
2024-04-24 07:21:19 UTC	3727	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 43 6f 6f 6b 69 65 20 50 6c 75 67 69 6e 20 76 31 2e 34 2e 31 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 63 61 72 68 61 72 74 6c 2f 6a 71 75 65 72 79 2d 63 6f 6f 6b 69 65 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 34 20 4b 6c 61 75 73 20 48 61 72 74 6c 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 20 28 66 61 63 74 6f 72 79 29 20 7b 0a 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 64 65 66 69 6e 65 2e 61 6d 64 29 20 7b 0a 20 20 20 20 20 20 20 20 2f 2f 20 41 4d 44 20 28 52 65 67 69 73 74 Data Ascii: /! jQuery Cookie Plugin v1.4.1 * https://github.com/carhartl/jquery-cookie * * Copyright 2006, 2014 Klaus Hartl * Released under the MIT license */(function (factory) { if (typeof define === 'function' && define.amd) { // AMD (Regist

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49724	23.202.57.177	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 07:21:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=258119 Date: Wed, 24 Apr 2024 07:21:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:20 UTC	643	OUT	GET /assets/images/login_logo.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:21 UTC	455	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f64-18a3-55552f42149c8" Accept-Ranges: bytes Content-Length: 6307 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:21 UTC	6307	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 27 00 00 00 25 08 06 00 00 00 00 e5 2f fe 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR'%/tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49730	23.202.57.177	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-24 07:21:21 UTC	521	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: CC1186E36C704BA5AF8177F229D6CC87 Ref B: PAOEDGE0621 Ref C: 2023-04-04T13:32:33Z Cache-Control: public, max-age=258070 Date: Wed, 24 Apr 2024 07:21:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-24 07:21:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49729	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	627	OUT	GET /assets/images/login_bg.jpg HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/assets/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	459	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f63-20466-55552f42149c8" Accept-Ranges: bytes Content-Length: 132198 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/jpeg
2024-04-24 07:21:22 UTC	7733	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e1 03 2b 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Ducky<+http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: 02 a9 c3 9e 5c 99 cc dd 56 30 e7 98 d3 a7 af 4b d7 6e ae 87 94 cf 9f 2e a9 0a 8a 46 25 4d aa e6 71 e3 66 79 f3 3d 72 f7 db dd ab 65 e0 93 cd 98 e6 28 d7 a5 75 66 78 25 f5 eb e9 37 7b 2b 9a 4f 23 13 d3 dd f4 2d b2 e6 94 4d 17 55 b4 41 9d 99 80 49 75 94 a9 00 b1 2b 54 a9 08 58 01 0a 08 52 41 43 2a c6 4b 18 af cc 4b f3 b6 94 90 92 a0 14 2c 4a 40 52 00 04 82 09 50 08 49 50 00 aa d6 48 25 7d 2c eb eb 33 bf 59 7b 6e 71 9a f2 f9 f4 92 f5 95 de 2d f3 cd e7 03 69 9e 89 ce f2 64 65 a7 4c 6a 98 9e 06 f3 e5 ef 1d 12 fd cc bf 2b d7 87 31 a5 cf aa 9e ad 7a d6 14 00 08 50 21 0a 42 80 00 00 00 00 80 00 04 1d d9 d8 00 00 2a 9c 8e 7e 57 0e 6d 5e 7e 33 2e 79 d3 ad ee ef d6 da d7 76 db 1e 53 1e 74 d6 a9 0b 11 05 08 5d 12 e6 67 99 81 3d 0b 7a aa d6 e2 9c b7 2c de 3c bc 94 f6 Data Ascii: \V0Kn.F%Mqfy=re(ufx%7{+O#-MUAIu+TXRACKK,J@RPIPH%},3Y{nq-ideLj+1zP!B~Wm^~3.yvSt]g=z,<
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: ea 97 19 79 c8 25 69 27 2c b1 64 cd 66 8a 03 35 ac 02 c2 00 2a 00 3a 2e 6a a9 61 2a 4a cc 45 90 4a 88 85 90 a2 00 35 29 16 15 42 61 64 2c 10 01 26 b6 41 68 b5 44 51 6a 41 00 82 40 20 b0 37 b9 ce 5d aa e4 a5 25 29 05 8b ad 8a 14 48 5a 90 49 43 d7 67 ed f5 8c 1a f8 5d 62 ab 16 7d 01 f4 3c f5 d1 9b 62 b6 66 b5 2a 56 4d b9 74 92 bb 9b 65 61 a9 cb d3 3c f5 48 b4 bd 79 ba a7 37 5c 63 2d 25 a1 b1 7d 67 9f a6 33 b2 01 59 60 c8 c5 73 2f 1f 41 2f 64 b8 49 32 c9 24 92 4a c9 24 92 21 64 2c 45 6a 0a 1c f1 e2 cb f3 fa 63 ac c5 23 29 6a a2 d5 72 45 84 fa 3a fb 5c 22 50 00 00 01 20 00 00 88 04 00 41 04 10 42 c1 09 55 aa 42 d6 2b 55 8a 95 2a 50 aa c2 6f bc 73 63 a5 4a 95 28 54 a9 05 4a 95 20 aa c1 43 9d 7c 35 14 81 16 00 96 28 40 04 9b 5c d2 5b 58 94 b4 20 42 a0 82 40 20 Data Ascii: y%i',df5:.jaJEJ5)Bad,&AhDQjA@ 7]%)HZICg]b}<bfVMtea<Hy7\c-%}g3Y`s/A/dI2$J$!d,Ejc#)jrE:\"P ABUB+UPoscJ(TJ C\|5(@\[X B@
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: b5 25 f1 f9 fa 59 d3 af 87 4b b5 93 13 16 95 2b c5 52 a5 78 2a 54 87 eb e4 dd e6 f2 18 23 f1 ae 3e da 51 6d e1 8f e6 3d 18 f5 65 3b 34 65 8d 56 48 73 19 8e 47 c7 e6 72 8e eb 0a cd 83 9a 7b 0c 97 ed fc 36 5d a4 99 26 45 08 b8 b8 5c 2c 6c a8 b5 a9 26 26 61 7c bc 99 39 28 46 4e 7b ad ce 38 47 16 29 73 7b 75 a3 1e 8f b8 4b d3 32 e6 d1 24 47 d7 63 3a 67 3e 4f 17 4f 79 f0 d9 2b 8f c3 65 da 32 d1 22 4e 84 b2 11 95 5c 38 99 42 3a 32 a5 44 8c 3e 9c 77 73 f1 0e a2 17 73 f9 5c f4 8f c4 60 e7 97 fd 6b d3 12 fc 58 c7 a3 ee 39 f4 92 a9 43 6c db 9c 7d 3e 76 1f 9f c3 4f fc be 1b 2e c5 b2 e2 bc 19 09 fe d8 c8 15 2a 54 72 2e 2a 54 4c a9 26 4a 44 66 26 2c 8e 2e 32 4d 71 4b 1d 65 77 87 cb d2 c9 b9 43 d3 b9 6f b2 75 37 3b 6c 5d 2c 19 3f 48 90 f4 63 1e 8f b8 e7 88 f4 66 27 cf Data Ascii: %YK+RxT#>Qm=e;4eVHsGr{6]&E\,l&&a\|9(FN{8G)s{uK2$Gc:g>OOy+e2"N\8B:2D>wss\`kX9Cl}>vO.Tr.*TL&JDf&,.2MqKewCou7;l],?Hcf'
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: a3 d1 70 28 92 99 51 41 95 5a 50 a0 98 d0 b9 3f 8d 4a 6e bf e4 94 6e 70 7f 8f eb 2a d5 67 fd 68 53 b0 5a a7 c4 ca 95 2a 45 95 2a 29 17 97 97 97 97 17 17 17 15 2a 54 a9 52 a5 4a 95 2a 54 a9 52 a5 4a 95 2a 54 a9 52 e2 a5 c5 c5 c5 e5 e7 50 ea 1d 53 aa 75 8e b1 d5 67 51 9d 42 f2 f3 a8 75 0e a9 d5 3a c7 5c 7b 83 dc 0f 72 7b 93 dc 1d 76 75 99 d4 91 7b 1c 99 56 21 09 14 28 50 5a 4b 24 62 de 7f f1 cb d6 4f 45 a4 e3 c1 ea 35 c4 87 e9 12 5c 4c cb b7 cd 8c c7 b7 c3 89 62 86 4a ee 77 0f 3e 4e c1 8c 85 b5 72 83 c5 d8 2f f5 6a f8 be ec 7c 1f 64 21 24 89 ce a2 83 3f 14 73 28 53 82 3c d4 8d ae 77 87 2a 6a 58 d7 e2 a5 1f cb f7 8a 32 fe bc 6c a7 02 2b c2 f4 fb 09 89 95 2a 36 5c cb d9 7b 3a ac eb 1d 64 75 8e a9 d5 3a a7 50 bc bc bc bc bc b8 b8 b8 b8 b8 b8 b8 b8 bc bc ea 1d Data Ascii: p(QAZP?JnnpghSZE)TRJTRJTRPSugQBu:\{r{vu{V!(PZK$bOE5\LbJw>Nr/j\|d!$?s(S<wjX2l+6\{:du:P
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: be dd 31 5b c2 28 8c fc 2c 9d 15 14 6e 52 33 5c 86 31 f9 2f ff 00 43 28 7b f8 e2 b9 5d fd 6e f8 42 42 39 5b b3 d3 50 50 5c a5 45 72 3a 62 10 21 3b c6 6e 5c 84 f5 b3 f0 f8 41 c8 2a 6a a2 a9 99 a6 6f 8a e9 51 b3 7a 87 90 70 75 e1 3b c5 e4 1d 62 41 df 07 f9 8a 24 d9 1b 69 a1 9b 00 21 49 17 b8 72 79 1b 29 6e 5d 5d e3 e0 f7 da 1f d7 e3 ee 3b d4 05 05 50 d1 63 67 1b 01 08 1c 53 7c e3 f3 74 bf 8d c8 61 7f c1 d8 7f c8 44 97 30 1d 51 3c db ca 31 be ab 76 95 c8 7f 2d 13 fc 78 89 71 ba c6 70 f8 36 5c 68 16 f7 94 1a da 34 69 71 c5 0b 3c 98 1e a1 ea b9 70 3f 8e cb 43 61 47 88 5f 32 9d e6 3c 1a 9d a6 36 12 28 2f 1b f1 04 7b 7f ea 9c 3d 76 3e 23 2f 9a f5 0d 84 77 b0 4c 66 02 68 e9 30 b6 14 9a 11 aa 63 b0 77 e2 10 18 83 b1 d1 55 d8 b7 3b 00 9b c6 26 c7 70 d3 5a 4a ff 00 Data Ascii: 1[(,nR3\1/C({]nBB9[PP\Er:b!;n\A*joQzpu;bA$i!Iry)n]];PcgS\|taD0Q<1v-xqp6\h4iq<p?CaG_2<6(/{=v>#/wLfh0cwU;&pZJ
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: d2 eb 71 91 fc 1c 80 86 9e 46 c5 b3 5b 0a 55 3d f7 1f 6b d8 4c 9b ae ec 42 5f d0 d8 f7 11 81 b0 4d ea c5 51 14 ca dc 21 6f 04 84 b2 ff 00 25 a8 df c3 fe ed 87 6c 8a bc bf 2d 8a f9 82 bc 5f b8 10 3a 0b 84 37 ea 99 8f be 91 b0 ad 18 a1 86 43 18 c1 88 78 c8 24 82 9c 26 11 43 59 15 c2 43 c3 64 cc 60 1e 62 c8 80 84 74 21 09 4c 06 10 43 12 a6 35 09 8b 35 52 97 ac 0a 52 94 a5 29 7a 2f 43 d7 c1 bc 73 eb ba 3d 17 a7 7d 0e 75 c8 83 44 20 61 b5 0b f6 63 16 60 76 4b 84 3c 13 1a 11 52 20 a5 36 0c e7 2c f0 6a 5f d9 75 ec 42 9b 0a 51 fb 7c 09 94 f6 26 5f 34 81 2e e5 2d 26 77 37 5b 9c a1 ea 42 37 1c ec d9 bd a7 b0 63 c4 7b 36 3a c1 3d 90 ff 00 b2 35 59 bd 89 f7 5a 46 b9 1f b1 17 dd 3f c9 fd c6 24 10 d9 bf 45 41 2d 0a 74 39 8d a2 72 64 62 b6 53 d3 99 77 47 cc 08 7b 15 0b Data Ascii: qF[U=kLB_MQ!o%l-_:7Cx$&CYCd`bt!LC55RR)z/Cs=}uD ac`vK<R 6,j_uBQ\|&_4.-&w7[B7c{6:=5YZF?$EA-t9rdbSwG{
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: 96 22 1d f3 a1 04 53 73 91 f7 3e 67 f4 35 e4 c5 a8 f0 c7 ac 20 b0 44 24 20 fb 68 d8 2d ea d6 72 8c 81 ce 50 88 2e 86 fd 5e 34 9a 08 20 91 e9 b4 e0 c4 28 5a 1a 9a f7 17 f2 34 9b 8c 2d 19 d1 02 4d 13 a6 49 20 9d 69 f7 8e e4 91 e4 6e c6 65 06 f2 5e 81 31 0b a1 c9 35 61 ff 00 62 52 2c 2d 33 df 4c 92 49 24 1e c1 ed 1e 24 78 51 e3 47 8d 1e 02 f6 9e d2 74 83 09 e0 d5 0f 13 f0 78 c7 8d f8 3c 4f c1 ff 00 c6 1f fe 50 d9 ff 00 03 ff 00 82 3f fc f1 b3 fe 63 ff 00 cd 1f fe 40 cc 6e 07 d8 0f b3 15 e8 f1 1e c3 e3 7f c9 e1 7f 93 df fc 8f ff 00 a8 7d cf c8 ec a0 7a b2 33 42 f7 c7 de 7e 0f 23 f0 3f fe 41 ff 00 f0 96 1e 27 62 ee f9 8d a6 e1 0b 71 b2 8f a9 18 ba 6c ab f0 5a 4a 6e d5 c6 0a a8 70 e3 d2 fa 0b 71 8d 88 23 69 c2 14 ee 84 e9 e2 30 13 56 10 78 7c 8f b8 37 7a dd c4 Data Ascii: "Ss>g5 D$ h-rP.^4 (Z4-MI ine^15abR,-3LI$$xQGtx<OP?c@n}z3B~#?A'bqlZJnpq#i0Vx\|7z
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: ff 00 f0 14 9f fe 70 97 52 7f f9 9c 21 34 7f fe 6e 25 d4 bf fc d1 2f 41 7a 0d 6b 3f fc a1 21 7a ab a2 74 df ff 00 24 44 d1 7a 8b d0 c9 05 ff 00 e4 69 7d 2c ff 00 f2 75 e8 42 13 44 21 08 24 42 13 ff 00 ca 17 4c 21 35 9d 13 ae 0d 69 35 4f ff 00 20 5a d2 94 bf 42 d7 ff 00 92 9b 9f 50 7a bf f1 25 fe 20 87 f5 49 a3 5f 7b 7f e4 46 16 8f eb 73 ef 73 5b f4 0b d0 bf 71 9f 4a f5 7f 54 f5 7f 78 bd 2f e8 97 5b 45 fb 84 a5 f4 ab eb d0 fe fe 9f 4d 13 f4 13 f4 93 fc 11 fd 7b 17 df 6e 8f d6 c1 21 0b ee 73 ea 5f d6 3d 58 be f8 f5 7d 36 3d 12 d1 14 bd 37 42 fb 4b 17 5d fa 84 73 fe 38 c8 3d 11 45 a9 8b 5a 51 74 5d 16 a6 27 f6 72 fa f5 d0 b6 fa 63 1a 69 9d 74 ee 98 3f b8 2f a1 4b 57 a2 7a 3e b2 5f 6c 17 d9 0c 4b 5b a2 0a ba 2a 1a 95 eb c1 08 42 34 92 a4 89 08 30 8a 29 f7 b3 Data Ascii: pR!4n%/Azk?!zt$Dzi},uBD!$BL!5i5O ZBPz% I_{Fss[qJTx/[EM{n!s_=X}6=7BK]s8=EZQt]'rcit?/KWz>_lK[*B40)
2024-04-24 07:21:22 UTC	8000	IN	Data Raw: a4 a7 b1 b8 57 2c b7 1b 0a dc 6b 20 9c 08 0d 34 86 48 6e 58 41 ae 61 50 b0 d7 71 80 d2 20 24 17 88 34 42 2b 26 4a 27 1c 28 c8 62 02 41 70 03 af 1f 10 23 61 d9 23 a1 b8 b3 92 7f 1a d4 5e de c5 40 68 8a 13 7c 9b 15 01 f6 e0 a7 a9 23 1f fd d7 d5 b2 d0 b4 90 52 6a 72 c6 9f fd d0 53 25 01 69 97 89 04 13 18 60 c8 a0 60 04 a8 a8 14 2b 2b a4 ec 34 53 6b 90 44 c9 6d 0b d7 b1 3d 5e 84 bb 65 e2 a7 69 ff 00 bc cb 3a f2 40 90 0d 43 f1 28 64 73 19 4b 32 aa 22 b0 7b cd 2c 18 d8 00 9b 79 6c 2e 44 ed 21 98 42 13 c0 0c 80 6a f5 82 45 d6 92 42 9f aa 89 ad b3 69 59 79 f4 2b 06 fd 98 12 8b 92 7c cc 0a 6c 2e 1f 91 f0 94 73 cc b0 1f c7 12 2f 60 b2 d3 b3 4d 06 3e b4 10 61 59 27 e5 f5 41 5f 63 04 49 02 70 83 42 da 0e be 7a 99 29 02 49 03 fd d8 04 15 39 23 db 41 40 00 93 09 08 b4 Data Ascii: W,k 4HnXAaPq $4B+&J'(bAp#a#^@h\|#RjrS%i``++4SkDm=^ei:@C(dsK2"{,yl.D!BjEBiYy+\|l.s/`M>aY'A_cIpBz)I9#A@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	628	OUT	GET /assets/images/header_bg.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/assets/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	454	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f61-4a2-55552f42145e2" Accept-Ranges: bytes Content-Length: 1186 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:22 UTC	1186	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 04 00 00 00 70 08 02 00 00 00 b6 20 46 fe 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDRp FtEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	627	OUT	GET /assets/images/after_bg.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/assets/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	454	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f5c-5d1-55552f42141fd" Accept-Ranges: bytes Content-Length: 1489 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:22 UTC	1489	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 24 00 00 00 10 08 06 00 00 00 7e eb dd 23 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR$~#tEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49726	185.81.4.126	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	634	OUT	GET /2837823766tsa6rf62r1fw6rt22e.png HTTP/1.1 Host: duh28uhuyicedhgwuidfycg2789.guestplan.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:21 UTC	264	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 06 Feb 2020 08:56:09 GMT ETag: "36c0043-2b-59de471bb475b" Accept-Ranges: bytes Content-Length: 43 Content-Type: image/png
2024-04-24 07:21:21 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49731	143.244.51.206	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	530	OUT	GET /recorder.js HTTP/1.1 Host: rec.smartlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:21 UTC	795	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:21 GMT Content-Type: application/javascript Content-Length: 6097 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 23 Apr 2024 14:11:06 GMT ETag: "6627c17a-17d1" Access-Control-Allow-Origin: * Cache-Control: public, max-age=600 Strict-Transport-Security: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-77-NZT: EgwBj/QzzQGWvxYAAAwBubQNCgH3UAIAAA X-77-NZT-Ray: 355b290a080e32def1b22866825c9a23 X-Accel-Expires: @1713943340 X-Accel-Date: 1713937458 X-77-Cache: HIT X-77-Age: 6415 Server: CDN77-Turbo X-Cache: REVALIDATED X-Age: 5823 X-77-POP: losangelesUSCA Accept-Ranges: bytes
2024-04-24 07:21:21 UTC	6097	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 2c 65 2c 74 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 76 61 72 20 65 3d 6e 75 6c 6c 3b 74 72 79 7b 65 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 7d 63 61 74 63 68 28 6f 29 7b 7d 72 65 74 75 72 6e 20 65 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 76 61 72 20 65 3d 6e 75 6c 6c 3b 74 72 79 7b 65 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 7d 63 61 74 63 68 28 6f 29 7b 7d 72 65 74 75 72 6e 20 65 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 6f 2c 65 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 Data Ascii: !function(){"use strict";var o,e,t,n=function(o){var e=null;try{e=window.localStorage.getItem(o)}catch(o){}return e},r=function(o){var e=null;try{e=window.sessionStorage.getItem(o)}catch(o){}return e},d=function(o,e){try{return window.sessionStorage.setIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49732	18.65.25.14	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	535	OUT	GET /monitor/stat.js HTTP/1.1 Host: www.clickcease.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:21 UTC	954	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 145222 Connection: close Last-Modified: Tue, 12 Sep 2023 09:05:15 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: Cf02rYNryv9UIBzoGOQeQJTZ2QU2vf2Y Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 24 Apr 2024 07:21:21 GMT ETag: "e112b8bf96f23bc2970347a3c98e37fc" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e52e2837600a0e5014c3bbea3436b996.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX53-P1 X-Amz-Cf-Id: QfzegTDsS_ReZYOJEwWsKxxsHOD_31iNr2vvdVoJeT5gxUJ2xKCdsQ== Age: 14 X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: frame-ancestors 'self' https://clickceasebiz.com https://*.clickceasebiz.com; upgrade-insecure-requests; X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: microphone 'none'; camera 'none'; Vary: Origin
2024-04-24 07:21:21 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 63 2c 61 3d 7b 7d 2c 65 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6c 3d 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 75 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 5b 74 5d 3d 6e 2e 76 61 6c 75 65 7d 2c 74 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3f 53 79 6d 62 6f 6c 3a 7b 7d 2c 72 3d 74 2e 69 74 65 72 61 74 6f 72 7c 7c 22 40 40 69 74 65 72 61 74 6f 72 22 2c 6e 3d 74 2e 61 73 79 6e 63 49 74 65 72 61 74 6f 72 7c 7c 22 40 40 61 73 79 Data Ascii: !function(){"use strict";function k(){k=function(){return a};var c,a={},e=Object.prototype,l=e.hasOwnProperty,u=Object.defineProperty\|\|function(e,t,n){e[t]=n.value},t="function"==typeof Symbol?Symbol:{},r=t.iterator\|\|"@@iterator",n=t.asyncIterator\|\|"@@asy
2024-04-24 07:21:21 UTC	16384	IN	Data Raw: 69 64 20 72 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6e 2c 65 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 5b 6e 5d 3d 7b 73 74 61 74 75 73 3a 22 72 65 6a 65 63 74 65 64 22 2c 72 65 61 73 6f 6e 3a 65 7d 2c 30 3d 3d 2d 2d 61 26 26 6f 28 69 29 7d 29 7d 69 5b 6e 5d 3d 7b 73 74 61 74 75 73 3a 22 66 75 6c 66 69 6c 6c 65 64 22 2c 76 61 6c 75 65 3a 65 7d 2c 30 3d 3d 2d 2d 61 26 26 6f 28 69 29 7d 28 74 2c 69 5b 74 5d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 29 7b 74 68 69 73 2e 6e 61 6d 65 3d 22 41 67 67 72 65 67 61 74 65 45 72 72 6f 72 22 2c 74 68 69 73 2e 65 72 72 6f 72 73 3d 65 2c 74 68 69 73 2e 6d 65 73 73 61 67 65 3d 74 7c 7c 22 22 7d 66 75 6e 63 74 69 6f 6e 20 76 28 69 29 7b 76 61 72 20 61 3d 74 68 69 73 3b 72 65 74 Data Ascii: id r.call(e,function(e){t(n,e)},function(e){i[n]={status:"rejected",reason:e},0==--a&&o(i)})}i[n]={status:"fulfilled",value:e},0==--a&&o(i)}(t,i[t])})}function m(e,t){this.name="AggregateError",this.errors=e,this.message=t\|\|""}function v(i){var a=this;ret
2024-04-24 07:21:21 UTC	16384	IN	Data Raw: 72 43 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 57 28 74 2c 65 29 7b 76 61 72 20 6e 3d 65 2e 64 6f 63 2c 72 3d 65 2e 6d 61 70 2c 6f 3d 65 2e 62 6c 6f 63 6b 43 6c 61 73 73 2c 69 3d 65 2e 62 6c 6f 63 6b 53 65 6c 65 63 74 6f 72 2c 61 3d 65 2e 6d 61 73 6b 54 65 78 74 43 6c 61 73 73 2c 73 3d 65 2e 6d 61 73 6b 54 65 78 74 53 65 6c 65 63 74 6f 72 2c 63 3d 65 2e 73 6b 69 70 43 68 69 6c 64 2c 63 3d 76 6f 69 64 20 30 21 3d 3d 63 26 26 63 2c 6c 3d 65 2e 69 6e 6c 69 6e 65 53 74 79 6c 65 73 68 65 65 74 2c 75 3d 76 6f 69 64 20 30 3d 3d 3d 6c 7c 7c 6c 2c 6c 3d 65 2e 6d 61 73 6b 49 6e 70 75 74 4f 70 74 69 6f 6e 73 2c 64 3d 76 6f 69 64 20 30 3d 3d 3d 6c 3f 7b 7d 3a 6c 2c 66 3d 65 2e 6d 61 73 6b 54 65 78 74 46 6e 2c 70 3d 65 2e 6d 61 73 6b 49 6e 70 75 74 46 6e 2c 68 3d Data Ascii: rCase()}function W(t,e){var n=e.doc,r=e.map,o=e.blockClass,i=e.blockSelector,a=e.maskTextClass,s=e.maskTextSelector,c=e.skipChild,c=void 0!==c&&c,l=e.inlineStylesheet,u=void 0===l\|\|l,l=e.maskInputOptions,d=void 0===l?{}:l,f=e.maskTextFn,p=e.maskInputFn,h=
2024-04-24 07:21:21 UTC	15173	IN	Data Raw: 2e 73 68 61 64 6f 77 52 6f 6f 74 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 70 2e 73 68 61 64 6f 77 52 6f 6f 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 70 2e 73 68 61 64 6f 77 52 6f 6f 74 2e 66 69 72 73 74 43 68 69 6c 64 29 3b 65 6c 73 65 20 70 2e 61 74 74 61 63 68 53 68 61 64 6f 77 28 7b 6d 6f 64 65 3a 22 6f 70 65 6e 22 7d 29 3b 72 65 74 75 72 6e 20 70 3b 63 61 73 65 20 4e 2e 54 65 78 74 3a 72 65 74 75 72 6e 20 6c 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 63 2e 69 73 53 74 79 6c 65 26 26 75 3f 6b 28 63 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2c 64 29 3a 63 2e 74 65 78 74 43 6f 6e 74 65 6e 74 29 3b 63 61 73 65 20 4e 2e 43 44 41 54 41 3a 72 65 74 75 72 6e 20 6c 2e 63 72 65 61 74 65 43 44 41 54 41 53 65 63 74 69 6f 6e 28 63 2e 74 65 78 74 43 6f 6e 74 65 6e 74 Data Ascii: .shadowRoot.firstChild;)p.shadowRoot.removeChild(p.shadowRoot.firstChild);else p.attachShadow({mode:"open"});return p;case N.Text:return l.createTextNode(c.isStyle&&u?k(c.textContent,d):c.textContent);case N.CDATA:return l.createCDATASection(c.textContent
2024-04-24 07:21:21 UTC	16384	IN	Data Raw: 6e 28 65 29 7b 72 65 74 75 72 6e 7b 69 64 3a 62 2e 6d 69 72 72 6f 72 2e 67 65 74 49 64 28 65 2e 6e 6f 64 65 29 2c 61 74 74 72 69 62 75 74 65 73 3a 65 2e 61 74 74 72 69 62 75 74 65 73 7d 7d 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 62 2e 6d 69 72 72 6f 72 2e 68 61 73 28 65 2e 69 64 29 7d 29 2c 72 65 6d 6f 76 65 73 3a 62 2e 72 65 6d 6f 76 65 73 2c 61 64 64 73 3a 6f 7d 3b 28 67 2e 74 65 78 74 73 2e 6c 65 6e 67 74 68 7c 7c 67 2e 61 74 74 72 69 62 75 74 65 73 2e 6c 65 6e 67 74 68 7c 7c 67 2e 72 65 6d 6f 76 65 73 2e 6c 65 6e 67 74 68 7c 7c 67 2e 61 64 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 62 2e 74 65 78 74 73 3d 5b 5d 2c 62 2e 61 74 74 72 69 62 75 74 65 73 3d 5b 5d 2c 62 2e 72 65 6d 6f 76 65 73 3d 5b 5d 2c 62 2e 61 64 Data Ascii: n(e){return{id:b.mirror.getId(e.node),attributes:e.attributes}}).filter(function(e){return b.mirror.has(e.id)}),removes:b.removes,adds:o};(g.texts.length\|\|g.attributes.length\|\|g.removes.length\|\|g.adds.length)&&(b.texts=[],b.attributes=[],b.removes=[],b.ad
2024-04-24 07:21:21 UTC	16384	IN	Data Raw: 74 79 70 65 2e 6c 6f 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6c 6f 63 6b 65 64 3d 21 30 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 75 6e 6c 6f 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6c 6f 63 6b 65 64 3d 21 31 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 43 61 6e 76 61 73 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 2e 73 74 61 72 74 52 41 46 54 69 6d 65 73 74 61 6d 70 69 6e 67 28 29 2c 74 68 69 73 2e 73 74 61 72 74 50 65 6e 64 69 6e 67 43 61 6e 76 61 73 4d 75 74 61 74 69 6f 6e 46 6c 75 73 68 65 72 28 29 3b 76 61 72 20 6e 2c 72 2c 6f 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 29 7b 76 61 72 20 74 3d 5b 5d 3b 74 72 79 7b 76 61 72 20 6e 3d 52 65 28 65 2e Data Ascii: type.lock=function(){this.locked=!0},o.prototype.unlock=function(){this.locked=!1},o.prototype.initCanvasMutationObserver=function(e,t){this.startRAFTimestamping(),this.startPendingCanvasMutationFlusher();var n,r,o,i=function(e,o){var t=[];try{var n=Re(e.
2024-04-24 07:21:22 UTC	16384	IN	Data Raw: 6e 28 29 7d 28 30 3c 6f 2e 6c 65 6e 67 74 68 7c 7c 69 2e 6c 69 76 65 4d 6f 64 65 29 26 26 28 69 2e 72 61 66 3d 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 65 29 29 7d 29 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 61 66 26 26 28 63 61 6e 63 65 6c 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 28 74 68 69 73 2e 72 61 66 29 2c 74 68 69 73 2e 72 61 66 3d 6e 75 6c 6c 29 2c 74 68 69 73 2e 61 63 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 3d 30 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 53 70 65 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 73 70 65 65 64 3d 65 7d 2c 63 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 67 67 6c 65 4c 69 76 65 4d 6f 64 65 3d 66 75 6e 63 74 69 Data Ascii: n()}(0<o.length\|\|i.liveMode)&&(i.raf=requestAnimationFrame(e))})},c.prototype.clear=function(){this.raf&&(cancelAnimationFrame(this.raf),this.raf=null),this.actions.length=0},c.prototype.setSpeed=function(e){this.speed=e},c.prototype.toggleLiveMode=functi
2024-04-24 07:21:22 UTC	16384	IN	Data Raw: 6f 4e 6f 72 6d 61 6c 28 29 2c 6c 2e 73 65 72 76 69 63 65 2e 73 65 6e 64 28 22 45 4e 44 22 29 2c 6c 2e 65 6d 69 74 74 65 72 2e 65 6d 69 74 28 45 65 2e 52 65 70 6c 61 79 65 72 45 76 65 6e 74 73 2e 46 69 6e 69 73 68 29 29 7d 2c 61 2e 74 79 70 65 3d 3d 3d 45 65 2e 45 76 65 6e 74 54 79 70 65 2e 49 6e 63 72 65 6d 65 6e 74 61 6c 53 6e 61 70 73 68 6f 74 26 26 61 2e 64 61 74 61 2e 73 6f 75 72 63 65 3d 3d 3d 45 65 2e 49 6e 63 72 65 6d 65 6e 74 61 6c 53 6f 75 72 63 65 2e 4d 6f 75 73 65 4d 6f 76 65 26 26 61 2e 64 61 74 61 2e 70 6f 73 69 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 3f 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 28 29 7d 2c 4d 61 74 68 2e 6d 61 78 28 30 2c 35 30 2d 61 2e 64 61 74 61 2e 70 6f 73 69 74 69 6f 6e 73 5b 30 5d 2e 74 69 6d 65 Data Ascii: oNormal(),l.service.send("END"),l.emitter.emit(Ee.ReplayerEvents.Finish))},a.type===Ee.EventType.IncrementalSnapshot&&a.data.source===Ee.IncrementalSource.MouseMove&&a.data.positions.length?setTimeout(function(){o()},Math.max(0,50-a.data.positions[0].time
2024-04-24 07:21:22 UTC	15361	IN	Data Raw: 65 20 74 72 79 7b 6e 2e 73 63 72 6f 6c 6c 54 6f 70 3d 65 2e 79 2c 6e 2e 73 63 72 6f 6c 6c 4c 65 66 74 3d 65 2e 78 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 61 70 70 6c 79 49 6e 70 75 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6d 69 72 72 6f 72 2e 67 65 74 4e 6f 64 65 28 65 2e 69 64 29 3b 69 66 28 21 74 29 72 65 74 75 72 6e 20 74 68 69 73 2e 64 65 62 75 67 4e 6f 64 65 4e 6f 74 46 6f 75 6e 64 28 65 2c 65 2e 69 64 29 3b 74 72 79 7b 74 2e 63 68 65 63 6b 65 64 3d 65 2e 69 73 43 68 65 63 6b 65 64 2c 74 2e 76 61 6c 75 65 3d 65 2e 74 65 78 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 2c 64 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 67 61 63 79 5f 72 65 73 6f 6c 76 65 4d 69 73 73 69 6e 67 4e 6f 64 65 3d 66 75 Data Ascii: e try{n.scrollTop=e.y,n.scrollLeft=e.x}catch(e){}},d.prototype.applyInput=function(e){var t=this.mirror.getNode(e.id);if(!t)return this.debugNodeNotFound(e,e.id);try{t.checked=e.isChecked,t.value=e.text}catch(e){}},d.prototype.legacy_resolveMissingNode=fu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49733	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:21 UTC	370	OUT	GET /assets/images/login_logo.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	455	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f64-18a3-55552f42149c8" Accept-Ranges: bytes Content-Length: 6307 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:22 UTC	6307	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 27 00 00 00 25 08 06 00 00 00 00 e5 2f fe 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR'%/tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49735	143.244.51.206	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:22 UTC	584	OUT	GET /es6/init.9c2ef46a9a6368c3390e.js HTTP/1.1 Host: rec.smartlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sso.serverplan.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	788	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:22 GMT Content-Type: application/javascript Content-Length: 63897 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Fri, 19 Apr 2024 15:45:49 GMT ETag: "662291ad-f999" Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Strict-Transport-Security: max-age=31536000 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-77-NZT: EggBj/QzzQFBDAGP9DMTAfdQGwYA X-77-NZT-Ray: 355b290aa20c38ebf2b22866ea95ba12 X-Accel-Expires: @1745079074 X-Accel-Date: 1713543074 X-77-Cache: HIT X-77-Age: 400208 Server: CDN77-Turbo X-Cache: MISS X-77-POP: losangelesUSCA Accept-Ranges: bytes
2024-04-24 07:21:22 UTC	15596	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 69 6e 69 74 2e 39 63 32 65 66 34 36 61 39 61 36 33 36 38 63 33 33 39 30 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 6f 3d 7b 34 38 37 3a 28 65 2c 74 2c 6f 29 3d 3e 7b 6f 2e 64 28 74 2c 7b 66 3a 28 29 3d 3e 72 7d 29 3b 63 6c 61 73 73 20 72 20 65 78 74 65 6e 64 73 20 45 72 72 6f 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 7b 61 64 64 69 74 69 6f 6e 61 6c 44 61 74 61 3a 74 3d 7b 7d 2c 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3a 6f 2c 73 68 6f 75 6c 64 52 65 70 6f 72 74 3a 6e 3d 21 30 7d 3d 7b 7d 29 7b 73 75 70 65 72 28 65 29 2c 4f 62 6a 65 63 74 Data Ascii: /! For license information please see init.9c2ef46a9a6368c3390e.js.LICENSE.txt /(()=>{"use strict";var e,t,o={487:(e,t,o)=>{o.d(t,{f:()=>r});class r extends Error{constructor(e,{additionalData:t={},originalError:o,shouldReport:n=!0}={}){super(e),Object
2024-04-24 07:21:22 UTC	16384	IN	Data Raw: 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 73 74 61 72 74 73 57 69 74 68 28 22 53 4c 5f 5f 22 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 31 7d 2c 69 3d 65 3d 3e 65 2e 6e 61 6d 65 3d 3d 3d 72 2e 44 49 53 43 4f 56 45 52 59 2c 73 3d 65 3d 3e 65 2e 6e 61 6d 65 3d 3d 3d 72 2e 44 49 53 43 4f 56 45 52 45 44 7d 2c 38 36 3a 28 65 2c 74 2c 6f 29 3d 3e 7b 6f 2e 64 28 74 2c 7b 6f 3a 28 29 3d 3e 72 7d 29 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 2e 2e 2e 74 29 3d 3e 7b 77 69 6e 64 6f 77 2e 73 6d 61 72 74 6c 6f 6f 6b 2e 73 69 6c 65 6e 74 7c 7c 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 60 5b 53 6d 61 72 74 6c 6f 6f 6b 5d 20 24 7b 65 7d 60 2c 2e 2e 2e 74 29 7d 7d 2c 38 36 35 3a 28 65 2c 74 2c 6f 29 3d 3e 7b 6f 2e 64 28 74 2c 7b 71 3a 28 29 3d 3e 69 2c 74 3a 28 29 Data Ascii: g"==typeof t&&t.startsWith("SL__"))return!0}return!1},i=e=>e.name===r.DISCOVERY,s=e=>e.name===r.DISCOVERED},86:(e,t,o)=>{o.d(t,{o:()=>r});const r=(e,...t)=>{window.smartlook.silent\|\|console.warn(`[Smartlook] ${e}`,...t)}},865:(e,t,o)=>{o.d(t,{q:()=>i,t:()
2024-04-24 07:21:22 UTC	16384	IN	Data Raw: 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 73 65 74 75 70 52 65 74 72 79 41 66 74 65 72 29 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 6e 75 6c 6c 7d 67 65 74 53 65 74 75 70 52 65 74 72 79 41 66 74 65 72 45 78 70 69 72 65 52 65 61 73 6f 6e 28 29 7b 76 61 72 20 65 3b 63 6f 6e 73 74 20 74 3d 74 68 69 73 2e 67 65 74 4c 6f 63 61 6c 53 74 6f 72 61 67 65 50 72 6f 6a 65 63 74 4d 65 74 61 64 61 74 61 28 74 68 69 73 2e 70 72 6f 6a 65 63 74 4b 65 79 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 73 65 74 75 70 52 65 74 72 79 41 66 74 65 72 52 65 61 73 6f 6e 29 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 6e 75 6c 6c 7d 69 73 52 65 63 6f 72 64 65 72 49 Data Ascii: turn null!==(e=null==t?void 0:t.setupRetryAfter)&&void 0!==e?e:null}getSetupRetryAfterExpireReason(){var e;const t=this.getLocalStorageProjectMetadata(this.projectKey);return null!==(e=null==t?void 0:t.setupRetryAfterReason)&&void 0!==e?e:null}isRecorderI
2024-04-24 07:21:22 UTC	15533	IN	Data Raw: 6d 61 72 74 6c 6f 6f 6b 2e 76 69 73 69 74 6f 72 49 64 3a 6e 75 6c 6c 3d 3d 3d 28 6f 3d 77 69 6e 64 6f 77 2e 73 6d 61 72 74 6c 6f 6f 6b 2e 72 65 63 6f 72 64 65 72 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 76 69 73 69 74 6f 72 49 64 7d 63 61 74 63 68 28 74 29 7b 65 2e 56 79 2e 64 65 62 75 67 28 60 43 61 6e 6e 6f 74 20 67 65 74 20 76 69 73 69 74 6f 72 49 64 3a 20 24 7b 74 7d 60 29 7d 7d 7d 7d 29 7d 29 28 5a 29 2c 21 72 65 29 7b 63 6f 6e 73 74 20 74 3d 28 28 74 2c 6f 29 3d 3e 7b 63 6f 6e 73 74 20 72 3d 6e 65 77 20 5f 28 7b 70 72 6f 6a 65 63 74 4b 65 79 3a 74 2e 70 72 6f 6a 65 63 74 4b 65 79 2c 73 74 6f 72 61 67 65 4b 65 79 73 3a 74 2e 73 74 6f 72 61 67 65 4b 65 79 73 2c 75 73 65 43 6f 6f 6b 69 65 73 3a 74 2e 63 6f 6f 6b 69 65 73 7d Data Ascii: martlook.visitorId:null===(o=window.smartlook.recorder)\|\|void 0===o?void 0:o.visitorId}catch(t){e.Vy.debug(`Cannot get visitorId: ${t}`)}}}})})(Z),!re){const t=((t,o)=>{const r=new _({projectKey:t.projectKey,storageKeys:t.storageKeys,useCookies:t.cookies}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	185.81.4.126	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:22 UTC	606	OUT	GET /lorem.gif HTTP/1.1 Host: cdn876158d777364.intrepidsupport.it Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:22 UTC	264	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 04 Feb 2020 15:50:09 GMT ETag: "36c002d-2b-59dc1fe9c73e8" Accept-Ranges: bytes Content-Length: 43 Content-Type: image/gif
2024-04-24 07:21:22 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49736	185.81.4.126	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:22 UTC	396	OUT	GET /2837823766tsa6rf62r1fw6rt22e.png HTTP/1.1 Host: duh28uhuyicedhgwuidfycg2789.guestplan.it Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:23 UTC	264	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 06 Feb 2020 08:56:09 GMT ETag: "36c0043-2b-59de471bb475b" Accept-Ranges: bytes Content-Length: 43 Content-Type: image/png
2024-04-24 07:21:23 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49737	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:22 UTC	368	OUT	GET /assets/images/after_bg.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:23 UTC	454	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f5c-5d1-55552f42141fd" Accept-Ranges: bytes Content-Length: 1489 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:23 UTC	1489	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 24 00 00 00 10 08 06 00 00 00 7e eb dd 23 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR$~#tEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49738	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:22 UTC	369	OUT	GET /assets/images/header_bg.png HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:23 UTC	454	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f61-4a2-55552f42145e2" Accept-Ranges: bytes Content-Length: 1186 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/png
2024-04-24 07:21:23 UTC	1186	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 04 00 00 00 70 08 02 00 00 00 b6 20 46 fe 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 66 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDRp FtEXtSoftwareAdobe ImageReadyqe<fiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49739	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:24 UTC	631	OUT	GET /dist/favicon.ico HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:24 UTC	482	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 01 Mar 2023 11:33:59 GMT ETag: "3c0248-2be2-5f5d5169117c0" Accept-Ranges: bytes Content-Length: 11234 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/x-icon
2024-04-24 07:21:24 UTC	7710	IN	Data Raw: 00 00 01 00 01 00 37 31 00 00 01 00 20 00 cc 2b 00 00 16 00 00 00 28 00 00 00 37 00 00 00 62 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 10 28 5d ea 0a 28 5d ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 Data Ascii: 71 +(7b (](](](](](](](](](](](](](](](](](](
2024-04-24 07:21:24 UTC	3524	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 77 f4 af 29 7b f4 ff 2a 88 f0 ff 2b 8d ea ff 2e 8a e7 ff 30 87 e4 ff 32 83 e2 ff 2b 79 ec ff 26 aa fb ff 25 a9 fb ff 24 a7 fa ff 23 a4 fa ff 26 95 f8 ff 2b 7d f4 ff 26 79 f4 cf 24 76 f4 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $w){*+.02+y&%$#&+}&y$v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49740	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:24 UTC	368	OUT	GET /assets/images/login_bg.jpg HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:25 UTC	459	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 27 Jul 2017 21:07:35 GMT ETag: "140f63-20466-55552f42149c8" Accept-Ranges: bytes Content-Length: 132198 Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/jpeg
2024-04-24 07:21:25 UTC	7733	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 3c 00 00 ff e1 03 2b 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Ducky<+http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xm
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: 02 a9 c3 9e 5c 99 cc dd 56 30 e7 98 d3 a7 af 4b d7 6e ae 87 94 cf 9f 2e a9 0a 8a 46 25 4d aa e6 71 e3 66 79 f3 3d 72 f7 db dd ab 65 e0 93 cd 98 e6 28 d7 a5 75 66 78 25 f5 eb e9 37 7b 2b 9a 4f 23 13 d3 dd f4 2d b2 e6 94 4d 17 55 b4 41 9d 99 80 49 75 94 a9 00 b1 2b 54 a9 08 58 01 0a 08 52 41 43 2a c6 4b 18 af cc 4b f3 b6 94 90 92 a0 14 2c 4a 40 52 00 04 82 09 50 08 49 50 00 aa d6 48 25 7d 2c eb eb 33 bf 59 7b 6e 71 9a f2 f9 f4 92 f5 95 de 2d f3 cd e7 03 69 9e 89 ce f2 64 65 a7 4c 6a 98 9e 06 f3 e5 ef 1d 12 fd cc bf 2b d7 87 31 a5 cf aa 9e ad 7a d6 14 00 08 50 21 0a 42 80 00 00 00 00 80 00 04 1d d9 d8 00 00 2a 9c 8e 7e 57 0e 6d 5e 7e 33 2e 79 d3 ad ee ef d6 da d7 76 db 1e 53 1e 74 d6 a9 0b 11 05 08 5d 12 e6 67 99 81 3d 0b 7a aa d6 e2 9c b7 2c de 3c bc 94 f6 Data Ascii: \V0Kn.F%Mqfy=re(ufx%7{+O#-MUAIu+TXRACKK,J@RPIPH%},3Y{nq-ideLj+1zP!B~Wm^~3.yvSt]g=z,<
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: ea 97 19 79 c8 25 69 27 2c b1 64 cd 66 8a 03 35 ac 02 c2 00 2a 00 3a 2e 6a a9 61 2a 4a cc 45 90 4a 88 85 90 a2 00 35 29 16 15 42 61 64 2c 10 01 26 b6 41 68 b5 44 51 6a 41 00 82 40 20 b0 37 b9 ce 5d aa e4 a5 25 29 05 8b ad 8a 14 48 5a 90 49 43 d7 67 ed f5 8c 1a f8 5d 62 ab 16 7d 01 f4 3c f5 d1 9b 62 b6 66 b5 2a 56 4d b9 74 92 bb 9b 65 61 a9 cb d3 3c f5 48 b4 bd 79 ba a7 37 5c 63 2d 25 a1 b1 7d 67 9f a6 33 b2 01 59 60 c8 c5 73 2f 1f 41 2f 64 b8 49 32 c9 24 92 4a c9 24 92 21 64 2c 45 6a 0a 1c f1 e2 cb f3 fa 63 ac c5 23 29 6a a2 d5 72 45 84 fa 3a fb 5c 22 50 00 00 01 20 00 00 88 04 00 41 04 10 42 c1 09 55 aa 42 d6 2b 55 8a 95 2a 50 aa c2 6f bc 73 63 a5 4a 95 28 54 a9 05 4a 95 20 aa c1 43 9d 7c 35 14 81 16 00 96 28 40 04 9b 5c d2 5b 58 94 b4 20 42 a0 82 40 20 Data Ascii: y%i',df5:.jaJEJ5)Bad,&AhDQjA@ 7]%)HZICg]b}<bfVMtea<Hy7\c-%}g3Y`s/A/dI2$J$!d,Ejc#)jrE:\"P ABUB+UPoscJ(TJ C\|5(@\[X B@
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: b5 25 f1 f9 fa 59 d3 af 87 4b b5 93 13 16 95 2b c5 52 a5 78 2a 54 87 eb e4 dd e6 f2 18 23 f1 ae 3e da 51 6d e1 8f e6 3d 18 f5 65 3b 34 65 8d 56 48 73 19 8e 47 c7 e6 72 8e eb 0a cd 83 9a 7b 0c 97 ed fc 36 5d a4 99 26 45 08 b8 b8 5c 2c 6c a8 b5 a9 26 26 61 7c bc 99 39 28 46 4e 7b ad ce 38 47 16 29 73 7b 75 a3 1e 8f b8 4b d3 32 e6 d1 24 47 d7 63 3a 67 3e 4f 17 4f 79 f0 d9 2b 8f c3 65 da 32 d1 22 4e 84 b2 11 95 5c 38 99 42 3a 32 a5 44 8c 3e 9c 77 73 f1 0e a2 17 73 f9 5c f4 8f c4 60 e7 97 fd 6b d3 12 fc 58 c7 a3 ee 39 f4 92 a9 43 6c db 9c 7d 3e 76 1f 9f c3 4f fc be 1b 2e c5 b2 e2 bc 19 09 fe d8 c8 15 2a 54 72 2e 2a 54 4c a9 26 4a 44 66 26 2c 8e 2e 32 4d 71 4b 1d 65 77 87 cb d2 c9 b9 43 d3 b9 6f b2 75 37 3b 6c 5d 2c 19 3f 48 90 f4 63 1e 8f b8 e7 88 f4 66 27 cf Data Ascii: %YK+RxT#>Qm=e;4eVHsGr{6]&E\,l&&a\|9(FN{8G)s{uK2$Gc:g>OOy+e2"N\8B:2D>wss\`kX9Cl}>vO.Tr.*TL&JDf&,.2MqKewCou7;l],?Hcf'
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: a3 d1 70 28 92 99 51 41 95 5a 50 a0 98 d0 b9 3f 8d 4a 6e bf e4 94 6e 70 7f 8f eb 2a d5 67 fd 68 53 b0 5a a7 c4 ca 95 2a 45 95 2a 29 17 97 97 97 97 17 17 17 15 2a 54 a9 52 a5 4a 95 2a 54 a9 52 a5 4a 95 2a 54 a9 52 e2 a5 c5 c5 c5 e5 e7 50 ea 1d 53 aa 75 8e b1 d5 67 51 9d 42 f2 f3 a8 75 0e a9 d5 3a c7 5c 7b 83 dc 0f 72 7b 93 dc 1d 76 75 99 d4 91 7b 1c 99 56 21 09 14 28 50 5a 4b 24 62 de 7f f1 cb d6 4f 45 a4 e3 c1 ea 35 c4 87 e9 12 5c 4c cb b7 cd 8c c7 b7 c3 89 62 86 4a ee 77 0f 3e 4e c1 8c 85 b5 72 83 c5 d8 2f f5 6a f8 be ec 7c 1f 64 21 24 89 ce a2 83 3f 14 73 28 53 82 3c d4 8d ae 77 87 2a 6a 58 d7 e2 a5 1f cb f7 8a 32 fe bc 6c a7 02 2b c2 f4 fb 09 89 95 2a 36 5c cb d9 7b 3a ac eb 1d 64 75 8e a9 d5 3a a7 50 bc bc bc bc bc b8 b8 b8 b8 b8 b8 b8 b8 bc bc ea 1d Data Ascii: p(QAZP?JnnpghSZE)TRJTRJTRPSugQBu:\{r{vu{V!(PZK$bOE5\LbJw>Nr/j\|d!$?s(S<wjX2l+6\{:du:P
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: be dd 31 5b c2 28 8c fc 2c 9d 15 14 6e 52 33 5c 86 31 f9 2f ff 00 43 28 7b f8 e2 b9 5d fd 6e f8 42 42 39 5b b3 d3 50 50 5c a5 45 72 3a 62 10 21 3b c6 6e 5c 84 f5 b3 f0 f8 41 c8 2a 6a a2 a9 99 a6 6f 8a e9 51 b3 7a 87 90 70 75 e1 3b c5 e4 1d 62 41 df 07 f9 8a 24 d9 1b 69 a1 9b 00 21 49 17 b8 72 79 1b 29 6e 5d 5d e3 e0 f7 da 1f d7 e3 ee 3b d4 05 05 50 d1 63 67 1b 01 08 1c 53 7c e3 f3 74 bf 8d c8 61 7f c1 d8 7f c8 44 97 30 1d 51 3c db ca 31 be ab 76 95 c8 7f 2d 13 fc 78 89 71 ba c6 70 f8 36 5c 68 16 f7 94 1a da 34 69 71 c5 0b 3c 98 1e a1 ea b9 70 3f 8e cb 43 61 47 88 5f 32 9d e6 3c 1a 9d a6 36 12 28 2f 1b f1 04 7b 7f ea 9c 3d 76 3e 23 2f 9a f5 0d 84 77 b0 4c 66 02 68 e9 30 b6 14 9a 11 aa 63 b0 77 e2 10 18 83 b1 d1 55 d8 b7 3b 00 9b c6 26 c7 70 d3 5a 4a ff 00 Data Ascii: 1[(,nR3\1/C({]nBB9[PP\Er:b!;n\A*joQzpu;bA$i!Iry)n]];PcgS\|taD0Q<1v-xqp6\h4iq<p?CaG_2<6(/{=v>#/wLfh0cwU;&pZJ
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: d2 eb 71 91 fc 1c 80 86 9e 46 c5 b3 5b 0a 55 3d f7 1f 6b d8 4c 9b ae ec 42 5f d0 d8 f7 11 81 b0 4d ea c5 51 14 ca dc 21 6f 04 84 b2 ff 00 25 a8 df c3 fe ed 87 6c 8a bc bf 2d 8a f9 82 bc 5f b8 10 3a 0b 84 37 ea 99 8f be 91 b0 ad 18 a1 86 43 18 c1 88 78 c8 24 82 9c 26 11 43 59 15 c2 43 c3 64 cc 60 1e 62 c8 80 84 74 21 09 4c 06 10 43 12 a6 35 09 8b 35 52 97 ac 0a 52 94 a5 29 7a 2f 43 d7 c1 bc 73 eb ba 3d 17 a7 7d 0e 75 c8 83 44 20 61 b5 0b f6 63 16 60 76 4b 84 3c 13 1a 11 52 20 a5 36 0c e7 2c f0 6a 5f d9 75 ec 42 9b 0a 51 fb 7c 09 94 f6 26 5f 34 81 2e e5 2d 26 77 37 5b 9c a1 ea 42 37 1c ec d9 bd a7 b0 63 c4 7b 36 3a c1 3d 90 ff 00 b2 35 59 bd 89 f7 5a 46 b9 1f b1 17 dd 3f c9 fd c6 24 10 d9 bf 45 41 2d 0a 74 39 8d a2 72 64 62 b6 53 d3 99 77 47 cc 08 7b 15 0b Data Ascii: qF[U=kLB_MQ!o%l-_:7Cx$&CYCd`bt!LC55RR)z/Cs=}uD ac`vK<R 6,j_uBQ\|&_4.-&w7[B7c{6:=5YZF?$EA-t9rdbSwG{
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: 96 22 1d f3 a1 04 53 73 91 f7 3e 67 f4 35 e4 c5 a8 f0 c7 ac 20 b0 44 24 20 fb 68 d8 2d ea d6 72 8c 81 ce 50 88 2e 86 fd 5e 34 9a 08 20 91 e9 b4 e0 c4 28 5a 1a 9a f7 17 f2 34 9b 8c 2d 19 d1 02 4d 13 a6 49 20 9d 69 f7 8e e4 91 e4 6e c6 65 06 f2 5e 81 31 0b a1 c9 35 61 ff 00 62 52 2c 2d 33 df 4c 92 49 24 1e c1 ed 1e 24 78 51 e3 47 8d 1e 02 f6 9e d2 74 83 09 e0 d5 0f 13 f0 78 c7 8d f8 3c 4f c1 ff 00 c6 1f fe 50 d9 ff 00 03 ff 00 82 3f fc f1 b3 fe 63 ff 00 cd 1f fe 40 cc 6e 07 d8 0f b3 15 e8 f1 1e c3 e3 7f c9 e1 7f 93 df fc 8f ff 00 a8 7d cf c8 ec a0 7a b2 33 42 f7 c7 de 7e 0f 23 f0 3f fe 41 ff 00 f0 96 1e 27 62 ee f9 8d a6 e1 0b 71 b2 8f a9 18 ba 6c ab f0 5a 4a 6e d5 c6 0a a8 70 e3 d2 fa 0b 71 8d 88 23 69 c2 14 ee 84 e9 e2 30 13 56 10 78 7c 8f b8 37 7a dd c4 Data Ascii: "Ss>g5 D$ h-rP.^4 (Z4-MI ine^15abR,-3LI$$xQGtx<OP?c@n}z3B~#?A'bqlZJnpq#i0Vx\|7z
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: ff 00 f0 14 9f fe 70 97 52 7f f9 9c 21 34 7f fe 6e 25 d4 bf fc d1 2f 41 7a 0d 6b 3f fc a1 21 7a ab a2 74 df ff 00 24 44 d1 7a 8b d0 c9 05 ff 00 e4 69 7d 2c ff 00 f2 75 e8 42 13 44 21 08 24 42 13 ff 00 ca 17 4c 21 35 9d 13 ae 0d 69 35 4f ff 00 20 5a d2 94 bf 42 d7 ff 00 92 9b 9f 50 7a bf f1 25 fe 20 87 f5 49 a3 5f 7b 7f e4 46 16 8f eb 73 ef 73 5b f4 0b d0 bf 71 9f 4a f5 7f 54 f5 7f 78 bd 2f e8 97 5b 45 fb 84 a5 f4 ab eb d0 fe fe 9f 4d 13 f4 13 f4 93 fc 11 fd 7b 17 df 6e 8f d6 c1 21 0b ee 73 ea 5f d6 3d 58 be f8 f5 7d 36 3d 12 d1 14 bd 37 42 fb 4b 17 5d fa 84 73 fe 38 c8 3d 11 45 a9 8b 5a 51 74 5d 16 a6 27 f6 72 fa f5 d0 b6 fa 63 1a 69 9d 74 ee 98 3f b8 2f a1 4b 57 a2 7a 3e b2 5f 6c 17 d9 0c 4b 5b a2 0a ba 2a 1a 95 eb c1 08 42 34 92 a4 89 08 30 8a 29 f7 b3 Data Ascii: pR!4n%/Azk?!zt$Dzi},uBD!$BL!5i5O ZBPz% I_{Fss[qJTx/[EM{n!s_=X}6=7BK]s8=EZQt]'rcit?/KWz>_lK[*B40)
2024-04-24 07:21:25 UTC	8000	IN	Data Raw: a4 a7 b1 b8 57 2c b7 1b 0a dc 6b 20 9c 08 0d 34 86 48 6e 58 41 ae 61 50 b0 d7 71 80 d2 20 24 17 88 34 42 2b 26 4a 27 1c 28 c8 62 02 41 70 03 af 1f 10 23 61 d9 23 a1 b8 b3 92 7f 1a d4 5e de c5 40 68 8a 13 7c 9b 15 01 f6 e0 a7 a9 23 1f fd d7 d5 b2 d0 b4 90 52 6a 72 c6 9f fd d0 53 25 01 69 97 89 04 13 18 60 c8 a0 60 04 a8 a8 14 2b 2b a4 ec 34 53 6b 90 44 c9 6d 0b d7 b1 3d 5e 84 bb 65 e2 a7 69 ff 00 bc cb 3a f2 40 90 0d 43 f1 28 64 73 19 4b 32 aa 22 b0 7b cd 2c 18 d8 00 9b 79 6c 2e 44 ed 21 98 42 13 c0 0c 80 6a f5 82 45 d6 92 42 9f aa 89 ad b3 69 59 79 f4 2b 06 fd 98 12 8b 92 7c cc 0a 6c 2e 1f 91 f0 94 73 cc b0 1f c7 12 2f 60 b2 d3 b3 4d 06 3e b4 10 61 59 27 e5 f5 41 5f 63 04 49 02 70 83 42 da 0e be 7a 99 29 02 49 03 fd d8 04 15 39 23 db 41 40 00 93 09 08 b4 Data Ascii: W,k 4HnXAaPq $4B+&J'(bAp#a#^@h\|#RjrS%i``++4SkDm=^ei:@C(dsK2"{,yl.D!BjEBiYy+\|l.s/`M>aY'A_cIpBz)I9#A@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49743	185.81.4.126	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:24 UTC	368	OUT	GET /lorem.gif HTTP/1.1 Host: cdn876158d777364.intrepidsupport.it Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:25 UTC	264	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:25 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 04 Feb 2020 15:50:09 GMT ETag: "36c002d-2b-59dc1fe9c73e8" Accept-Ranges: bytes Content-Length: 43 Content-Type: image/gif
2024-04-24 07:21:25 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 00 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49744	185.13.254.146	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:25 UTC	358	OUT	GET /dist/favicon.ico HTTP/1.1 Host: sso.serverplan.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:26 UTC	482	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:26 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 01 Mar 2023 11:33:59 GMT ETag: "3c0248-2be2-5f5d5169117c0" Accept-Ranges: bytes Content-Length: 11234 Vary: Accept-Encoding Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Method: POST, GET, OPTIONS X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Content-Type: image/x-icon
2024-04-24 07:21:26 UTC	7710	IN	Data Raw: 00 00 01 00 01 00 37 31 00 00 01 00 20 00 cc 2b 00 00 16 00 00 00 28 00 00 00 37 00 00 00 62 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 10 28 5d ea 0a 28 5d ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 5d ea 00 28 Data Ascii: 71 +(7b (](](](](](](](](](](](](](](](](](](
2024-04-24 07:21:26 UTC	3524	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 77 f4 af 29 7b f4 ff 2a 88 f0 ff 2b 8d ea ff 2e 8a e7 ff 30 87 e4 ff 32 83 e2 ff 2b 79 ec ff 26 aa fb ff 25 a9 fb ff 24 a7 fa ff 23 a4 fa ff 26 95 f8 ff 2b 7d f4 ff 26 79 f4 cf 24 76 f4 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $w){*+.02+y&%$#&+}&y$v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49745	18.196.89.120	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:27 UTC	649	OUT	POST /rec/setup-recording/website HTTP/1.1 Host: manager.eu.smartlook.cloud Connection: keep-alive Content-Length: 122 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://sso.serverplan.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sso.serverplan.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:27 UTC	122	OUT	Data Raw: 7b 22 6b 65 79 22 3a 22 66 33 63 62 37 35 65 38 61 31 36 33 62 30 36 31 61 61 62 35 31 63 32 61 33 31 64 33 34 33 34 38 39 35 38 66 64 31 63 32 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 3a 22 51 36 6e 32 45 35 56 4b 61 4b 67 55 76 46 37 48 4b 35 59 79 66 22 2c 22 76 69 73 69 74 6f 72 49 64 22 3a 22 59 74 41 73 49 6e 6e 61 74 71 74 2d 6b 5f 39 75 61 77 4a 50 64 22 7d Data Ascii: {"key":"f3cb75e8a163b061aab51c2a31d34348958fd1c2","sessionId":"Q6n2E5VKaKgUvF7HK5Yyf","visitorId":"YtAsInnatqt-k_9uawJPd"}
2024-04-24 07:21:28 UTC	590	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 07:21:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 123 Connection: close Strict-Transport-Security: max-age=63072000; includeSubDomains Vary: Accept-Encoding Access-Control-Allow-Origin: https://sso.serverplan.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: X-Request, X-Requested-With, Content-Type, Cookie Access-Control-Expose-Headers: Retry-After Retry-After: 1800 X-Content-Type-Options: nosniff sl-trace-id: rLa-_W308EPVwcbiXtOMk
2024-04-24 07:21:28 UTC	123	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 63 6f 72 64 69 6e 67 41 6c 6c 6f 77 65 64 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 22 72 65 63 6f 72 64 69 6e 67 5f 6c 69 6d 69 74 5f 72 65 61 63 68 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4d 6f 6e 74 68 6c 79 20 72 65 63 6f 72 64 69 6e 67 20 6c 69 6d 69 74 20 72 65 61 63 68 65 64 22 7d 7d Data Ascii: {"ok":true,"recordingAllowed":false,"error":{"code":"recording_limit_reached","message":"Monthly recording limit reached"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49746	18.196.89.120	443	6536	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:28 UTC	377	OUT	GET /rec/setup-recording/website HTTP/1.1 Host: manager.eu.smartlook.cloud Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-24 07:21:29 UTC	265	IN	HTTP/1.1 404 Not Found Date: Wed, 24 Apr 2024 07:21:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Strict-Transport-Security: max-age=63072000; includeSubDomains Vary: Accept-Encoding sl-trace-id: sUYnwgPZxjDHrn8tjORO_
2024-04-24 07:21:29 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49750	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-24 07:21:33 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1713943261051&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-24 07:21:33 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-24 07:21:33 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-24 07:21:33 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C312967943F84D299341D8AB9F494131 Ref B: LAX311000110007 Ref C: 2024-04-24T07:21:33Z Date: Wed, 24 Apr 2024 07:21:33 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1713943293.2a0c98d

Target ID:	0
Start time:	09:21:10
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:21:12
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7125224678661500542,6660031049639082003,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:21:15
Start date:	24/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Windows Analysis Report
https://sso.serverplan.com/rinnovare-dominio?payinvoice=03288