Edit tour

Windows Analysis Report
https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e

Overview

General Information

Sample URL:	https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e
Analysis ID:	1431775
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1988,i,17382038956107092195,18040501313747568172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /websurvey/2/prompts HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveContent-Length: 90sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CSRF-TOKEN: T5GafB+z+A3Wux5d5jjvIiFFOPgcnPyOyMe3FelFV0A=sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Accept: application/json, text/plain, */*x-session-token: bd479d89-973f-4ead-86a2-90f42772e6f5sec-ch-ua-platform: "Windows"Origin: https://feedback.inmoment.euSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_87.2.dr	String found in binary or memory: http://angularjs.org
Source: chromecache_87.2.dr	String found in binary or memory: http://html5shim.googlecode.com/svn/trunk/html5.js
Source: chromecache_87.2.dr	String found in binary or memory: http://www.enable-javascript.com
Source: chromecache_87.2.dr	String found in binary or memory: https://cdnssl.clicktale.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.5:49729 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/44@6/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1988,i,17382038956107092195,18040501313747568172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1988,i,17382038956107092195,18040501313747568172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://feedback.inmoment.eu/websurvey/css/third-party.min.css	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/powered-by-inmoment-gray.svg	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/css/webfonts/calibrib-webfont.woff	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/css/webfonts/icomoon.woff	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/jslib/third-party.min.js?v=1269	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/2/app/img/taken_icon.png	0%	Avira URL Cloud	safe
http://html5shim.googlecode.com/svn/trunk/html5.js	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/remove.png	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/close-white.png	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/faviconV2.png	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/2/views/errors.html	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/css/webfonts/calibri-webfont.woff	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/jslib/appDirectives.min.js?v=1269	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/spinner.png	0%	Avira URL Cloud	safe
http://html5shim.googlecode.com/svn/trunk/html5.js	0%	Virustotal		Browse
https://feedback.inmoment.eu/websurvey/2/prompts	0%	Avira URL Cloud	safe
https://feedback.inmoment.eu/websurvey/image/info.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
feedback.inmoment.eu	35.158.27.166	true	false	unknown
www.google.com	64.233.176.103	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/css/webfonts/icomoon.woff	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5	false		unknown
https://feedback.inmoment.eu/websurvey/css/third-party.min.css	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/css/webfonts/calibrib-webfont.woff	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/powered-by-inmoment-gray.svg	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/jslib/third-party.min.js?v=1269	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/2/app/img/taken_icon.png	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/remove.png	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/close-white.png	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/faviconV2.png	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/2/views/errors.html	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/css/webfonts/calibri-webfont.woff	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e	false		unknown
https://feedback.inmoment.eu/websurvey/jslib/appDirectives.min.js?v=1269	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/spinner.png	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/2/prompts	false	Avira URL Cloud: safe	unknown
https://feedback.inmoment.eu/websurvey/image/info.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.enable-javascript.com	chromecache_87.2.dr	false		high
http://html5shim.googlecode.com/svn/trunk/html5.js	chromecache_87.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://angularjs.org	chromecache_87.2.dr	false		high
https://cdnssl.clicktale.net/	chromecache_87.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.176.103	www.google.com	United States	15169	GOOGLEUS	false
35.158.27.166	feedback.inmoment.eu	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431775
Start date and time:	2024-04-25 18:56:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/44@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.105.94, 74.125.136.138, 74.125.136.102, 74.125.136.100, 74.125.136.113, 74.125.136.139, 74.125.136.101, 108.177.122.84, 34.104.35.123, 13.85.23.86, 23.40.205.26, 23.40.205.80, 23.40.205.17, 23.40.205.83, 192.229.211.108, 52.165.164.15, 13.85.23.206, 23.40.205.42, 23.40.205.35, 23.40.205.72, 23.40.205.73
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 15:57:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9820581885937596
Encrypted:	false
SSDEEP:	48:8d0dDTrb8He6idAKZdA19ehwiZUklqehly+3:8yrdgmy
MD5:	6AD3B723708237F2D54409CC27A34B7D
SHA1:	883E3EDA9E3F1A1FAE10998FB558A0D2B093935C
SHA-256:	10A1FD1D51DDF5843FBC9C6D5D143396882F9E79FE51196696761852B753F336
SHA-512:	731014AE4C38D6F8462EDA43C5C0621BFB63A5849B06A7E69DDC6E188EDE6EDB19859E83572A6255753F16322725C6E8DF19AA3F03FF3B243EFFCEFCE61E598B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....{A.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 15:57:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9976732651326112
Encrypted:	false
SSDEEP:	48:8AdDTrb8He6idAKZdA1weh/iZUkAQkqehWy+2:8wrda9Q/y
MD5:	97C1177BE302940FAF38D380FC788361
SHA1:	A51AF771302472BB8CB21925C0F67AE73AE99F77
SHA-256:	FFC28B0626AEB10545C8BD6079BA8AF3F180D39CF84A312938FAF964B4038B9C
SHA-512:	39049B0134BD85C1ECAB304052ED21F3F3108179A8ECE98EB16E58934D0CCC3F22C7598163C57C352E761FCEDE29963128CABDD991B622F64C8A72E8682825E7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....5.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009061879588097
Encrypted:	false
SSDEEP:	48:8x0dDTrbsHe6idAKZdA14tseh7sFiZUkmgqeh7sYy+BX:8xcrtCniy
MD5:	5218CA6F6BE5A451AFC851B57118E9CD
SHA1:	450D8DE946D892F3A189936274FDA519196DA4C8
SHA-256:	D836FE88EE7E2F2B1600AE50C5FC549322EE44D9248992B919626409C0543E25
SHA-512:	1EA14E27680A59C4CEBC9F7BB8BAE94CCFC6FF0BCFBF90A12D5004495EF9394A71D37131599DB249C5E1D054889E94A7487714C54D4FC1787BBB73ACE780A2AC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 15:57:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.996328005459617
Encrypted:	false
SSDEEP:	48:8odDTrb8He6idAKZdA1vehDiZUkwqehKy+R:8YrdBAy
MD5:	14D35A5BF200606D7FB61D59050B142C
SHA1:	3C7395D75B4244C8B5A7021A28E8D70D8ACEB2EA
SHA-256:	657963F0EB151FE9DAE34CF6666912A073B381D8B6DF565C865B5A13869CAF4F
SHA-512:	7EF610E8DE6352C82360769E1C9BD72AF66F46154E501819C58D4E17C3311D7651B0FF563E84866AD002F7BAB0EADA62F4F6D6957CB89C41EFFCE62EAF49082C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....../.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 15:57:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982313978091781
Encrypted:	false
SSDEEP:	48:8JdDTrb8He6idAKZdA1hehBiZUk1W1qehky+C:8XrdB9Ey
MD5:	4DE14CAEDBDFC494E658510A148D4B21
SHA1:	30FA723633376BE3AFB36AEC2425B31FDAD9E447
SHA-256:	579237AD379BD46A47597F3F4E07F5248FCBC2052DA61BCCCB0C9229EF1FB320
SHA-512:	EC58F63C7DCB92A6D41CD0C5ED8E3BC19575791757A07EFA23191818C17C9EB6DB3960986E3B94231424588E710B34EA5EB9CDE690B055B4C75CAA319BDD1F8C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....a-;.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 15:57:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.997656526855197
Encrypted:	false
SSDEEP:	48:8QdDTrb8He6idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbiy+yT+:8grd9T/TbxWOvTbiy7T
MD5:	B45B27E6FEF9BC108673870185C4F7C8
SHA1:	E3361BB24162E7EBC5C72CAD1954371834065549
SHA-256:	84C80E4E011B453C1D1EA6DF2BC3AB7D90C0ED5CCB6B3312C921FBA5AB24A0DA
SHA-512:	7E6A051A62CBAB503AB38CC5B8AA7E7BF6C06FFC0EA11F7BE149BC3B0412C598D2BD18DE88F6552B932352BB7E629D48E3E0FA5A6E7B1DC5FAA1F0263E156E1D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....<&.1...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X8.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X8.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X8.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X8............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............@.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	5.638983569325319
Encrypted:	false
SSDEEP:	6:6v/lhPknLIO2UHyMyy895Ua+ADq1e3KAPOLcDp5qLRgVZ/7lkup:6v/7gs6yMyy8oa+ADq1uRPOLcDpqw31
MD5:	31E09D424725E77D710434A54B180E05
SHA1:	469485198B101810D807F962ADEF0071E83FDD78
SHA-256:	C75C045E6733D6C600EC81F06D608D77D6A57E47EAADD07CD17B2D084D96F6D2
SHA-512:	D1AF8F85C932D8308181F854CCAFFC72FE9E0ECC5FDDA0CA3F72A92D8E17E0AA022E967FBA3B299072EDCDC6CA83232EB05F705F085B841BE03C8C4601F9CAE7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...................KPLTE....U..[..Z..Z..Z..X..V..V..Y..Y..W..X..W..Y..X..X..Y..W..X..X..X..X..X............tRNS..."367;>MSUfi.........P.I8....bKGD..i.....TIDAT(.c`.......b......$N.....0.b...Q.3.I.`..eff........SCW....._PP.k..A.....Q0`%7]..._...u......IEND.B`.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 315 x 236, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.680753887191402
Encrypted:	false
SSDEEP:	96:vSe0Jieza6SBWiA2did1f0/Re7v19eCWAiPm0:XFIJSKhAeh9e5A+
MD5:	7F6CEDF64BDECCAFB756ECFFC3E6A218
SHA1:	786C0CFAFF30E649387D3F501F5FFE7AC11C5289
SHA-256:	91483E5E8FC86597F485BF23BA708DEEEF997304F92CF38B19E0633770328F25
SHA-512:	3ABF70063B412E1E589F94CCE61A08339983868A6D1E9671CD752C4BFDC7F443FC3211C9FEF7C3DC2D61FA5DA862BA23AF4F4277555C54D063F53C76E0306A4E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...;.................sRGB.........gAMA......a.....pHYs..........+......IDATx^..y.Ue.....5M..H.4.t.r......J.?.@.....,.sl.J.4m....(&.(....t\.)..4mE+."my?.g.4s.......q.sM.9w..9w9.._....\Er..Q#v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.Lh..?.........7............TWW'K.....=..#.;w&..O.>.e.d../b...S..9s..C.k.L....#G....{.......K.w......[......y.1RWW........X.n..x..t.9...^{.5.0aB...B.".i.&.:t..-GN......3f..P..F.o..C...~.'...ot3lc..p....%t.......7.p3lc..`+W.......5..x...Gr...6.....<X6l.t.?........2p.@7..b..={.H.].+.......K..]...QG...R._e......G....a......?,S.LI.........C..n94.w.\|.....N..q..A....jkx....+.$S....o.X.dI..S...{2...2.u....@.^.:.Zv....7.,Ai.t.N..[.].......&.........K....B..v.A..,OAo.YF...,!v..`.=a.c.d.AC.w.T...n..2z.h7#n..b..5[.nu.Y...o.OZ n....o.....'.\|Rjjj.8.;D.S.N.c..7g..

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4534
Entropy (8bit):	4.01596428837431
Encrypted:	false
SSDEEP:	96:ZvuXfclFms/46pP6GN/KYnfIBzxanmHT7Erc:Zpw6p/KCIBzxanQT7Erc
MD5:	D96854F89C73390E543603FB5F846E62
SHA1:	120AB9E99AFE1F013C1AB5FDD4E196783C90E9B8
SHA-256:	9C2656FD9425FB4C80D6B3F39EF8067FCF039653E4EA1F2D0C7BAE72E6AACFC4
SHA-512:	A490E4E824628B5EBFA4C03C02929EA5C6AC0C438E3FE4E3187600E9F3DCFBB9FCDAB379DDB68386753145206BB43E2CE06711A5BDFFC845BB020E2151FF370E
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 762.01 89" xmlns:v="https://vecta.io/nano"><path d="M356.16 0h-13.4a1.18 1.18 0 0 0-1.18 1.18v13.41a1.18 1.18 0 0 0 1.18 1.18h13.4a1.18 1.18 0 0 0 1.18-1.18V1.18A1.18 1.18 0 0 0 356.16 0zm0 31.54h-13.33a1.23 1.23 0 0 0-1.22 1.23v39.25a1.24 1.24 0 0 1-1.23 1.23h-13.31a1.23 1.23 0 0 0-1.23 1.23v13.3a1.23 1.23 0 0 0 1.23 1.22h29.09a1.23 1.23 0 0 0 1.23-1.22v-55a1.23 1.23 0 0 0-1.22-1.24zm-30.3 1.23a1.23 1.23 0 0 1 1.23-1.23h0 13.31a1.24 1.24 0 0 0 1.23-1.23V17a1.24 1.24 0 0 0-1.23-1.23h-29.1a1.23 1.23 0 0 0-1.23 1.23v55a1.23 1.23 0 0 0 1.23 1.23h0 13.31a1.23 1.23 0 0 0 1.23-1.23l.02-39.23zm122.62-2.16a15 15 0 0 0-11.23 4.8v-3.1a.78.78 0 0 0-.77-.77h-8.95a.78.78 0 0 0-.77.77v40.16a.78.78 0 0 0 .77.77h8.95a.78.78 0 0 0 .77-.77V46.33a8.2 8.2 0 0 1 8.14-6.22c5 0 7.34 3.18 7.34 8v24.41a.78.78 0 0 0 .77.77h8.95a.78.78 0 0 0 .77-.77V46.05c0-9.22-5.29-15.44-14.74-15.44zm53.23 27.51l-16.23-41.86a.78.78 0 0 0-.72-.49h-11.39a.78.78 0 0 0-.77.77v55

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65497)
Category:	downloaded
Size (bytes):	314419
Entropy (8bit):	5.393851304662762
Encrypted:	false
SSDEEP:	6144:eIdAROhRzQy8TSlfspNlILEzqEg5VielCHJLlHOgmLD4+5OEyh1/mNF:ezIDv9
MD5:	38EF652F83531850660B86CCE8F27401
SHA1:	C36814BBFFDE8A4286EAD0FAF371D6D54407B5DE
SHA-256:	85801AA6CD957757D4D4536CA937C65D2AEFEDB3EB3F643F4AD5287CF0DF77F1
SHA-512:	B1D6F801F8EABAE68EF11FCCB6DB1C87B295ACA7A05DDFD101E80D5F6606FE54FE2EFEDFCF30DA51CFE84B4C2D70A2DB8DD292CCBEEB796A89C433F45A1770A4
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/jslib/appDirectives.min.js?v=1269
Preview:	/! websurvey - v0.0.1 - 2024-04-23 /.function extractToBoolean(e){return void 0!==e&&("string"==typeof e?"true"===e.toLowerCase():"boolean"==typeof e&&e)}function extractToNumber(e){var t=typeof e;if("string"==t){var r=parseInt(e);if(!isNaN(r))return r;if(r=parseFloat(e),!isNaN(r))return r}return"number"==t\|\|"bigint"==t?e:null}function findPrompt(e,t){for(var r=0;r<e.prompts.length;r++){var n=e.prompts[r];if(n.id===t)return n;if(n.prompts)for(var o=0;o<n.prompts.length;o++){var i=n.prompts[o];if(i.id===t)return i}}return null}function compileSurveyExpression(e){switch(e.type){case"Value":e.evalExpression=function(e){return this.value};break;case"Not":if(void 0===e.expr)throw"Expression undefined.";compileSurveyExpression(e.expr),e.evalExpression=function(e){return!extractToBoolean(this.expr.evalExpression(e))};break;case"AndOperator":for(var t=0;t<e.AND.length;t++)compileSurveyExpression(e.AND[t]);e.evalExpression=function(e){if(0==this.AND.length)return!1;for(var t=0;t<this.AND.leng

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
Category:	downloaded
Size (bytes):	1080
Entropy (8bit):	6.205186324822577
Encrypted:	false
SSDEEP:	24:lLUXDFX3Yepzl/RRcqHogh0YC6xoopKY9QGHxS/yDJv7:OpHYA/zpHGYLxoo3Gqiyl7
MD5:	CB3107F672F160651C49DB638E20E7BC
SHA1:	864D45DAC10FDEB8867DCAAECAF4E988F93D522F
SHA-256:	15AC4C2EDADB1D6CB91BCAA53883BEC10C69A0EDED6553FAC8133B1FF464A841
SHA-512:	240EB2D078FA881D4DBBCFAC47C03AB9AA3EF40A13A14150D34C48FDD32F9FE42E14EA661574CE25C4BC7D1D355D74ABB9A752995AE4ECB14656BE1430472CA5
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/spinner.png
Preview:	.PNG........IHDR.............:.......acTL.........=......tRNS..v..8....fcTL.......................d..V......PIDAT..m.... ..Pvr.f.,.....JP....80cZ.o."......(.p.].u0...~..y.......O0.I.lx.1.(?G.......fcTL.......................d..e.V....HfdAT......}.[.. .C.z...T.Zf.Q..Z.p...f.U.b7.D.&N5.[j.9.~8.n.K9O.f.9.....+.^.5......fcTL.......................d..i......GfdAT......c`@.g.00......E....@.c.....V0.B...3."...H..r..X.$....0.,.....e...........fcTL.......................d...y.....DfdAT......c``.....&F......0.. .....!.1._..166F."D.. ..cc.1`.d....:I.^.......fcTL.......................d...^.....GfdAT......u.Q.. .EQ:..,f!..^(.D...ag..W+.6U/.qlN.........`.9l.A....l.Y..........fcTL.......................d..=-.....CfdAT......u.K.. ....T-h......h.._.2y...{...fA%-HO.9.S..L.S".Z[..(g..>.^......fcTL.......................d........DfdAT......c`...r.T.,.....9.*........ .".j&.V`..0.n .........g@...n...........fcTL.......................d..._.....AfdAT......c`...P.T.,`l..(/...C.....$>P.B.3`

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4534
Entropy (8bit):	4.01596428837431
Encrypted:	false
SSDEEP:	96:ZvuXfclFms/46pP6GN/KYnfIBzxanmHT7Erc:Zpw6p/KCIBzxanQT7Erc
MD5:	D96854F89C73390E543603FB5F846E62
SHA1:	120AB9E99AFE1F013C1AB5FDD4E196783C90E9B8
SHA-256:	9C2656FD9425FB4C80D6B3F39EF8067FCF039653E4EA1F2D0C7BAE72E6AACFC4
SHA-512:	A490E4E824628B5EBFA4C03C02929EA5C6AC0C438E3FE4E3187600E9F3DCFBB9FCDAB379DDB68386753145206BB43E2CE06711A5BDFFC845BB020E2151FF370E
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/powered-by-inmoment-gray.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 762.01 89" xmlns:v="https://vecta.io/nano"><path d="M356.16 0h-13.4a1.18 1.18 0 0 0-1.18 1.18v13.41a1.18 1.18 0 0 0 1.18 1.18h13.4a1.18 1.18 0 0 0 1.18-1.18V1.18A1.18 1.18 0 0 0 356.16 0zm0 31.54h-13.33a1.23 1.23 0 0 0-1.22 1.23v39.25a1.24 1.24 0 0 1-1.23 1.23h-13.31a1.23 1.23 0 0 0-1.23 1.23v13.3a1.23 1.23 0 0 0 1.23 1.22h29.09a1.23 1.23 0 0 0 1.23-1.22v-55a1.23 1.23 0 0 0-1.22-1.24zm-30.3 1.23a1.23 1.23 0 0 1 1.23-1.23h0 13.31a1.24 1.24 0 0 0 1.23-1.23V17a1.24 1.24 0 0 0-1.23-1.23h-29.1a1.23 1.23 0 0 0-1.23 1.23v55a1.23 1.23 0 0 0 1.23 1.23h0 13.31a1.23 1.23 0 0 0 1.23-1.23l.02-39.23zm122.62-2.16a15 15 0 0 0-11.23 4.8v-3.1a.78.78 0 0 0-.77-.77h-8.95a.78.78 0 0 0-.77.77v40.16a.78.78 0 0 0 .77.77h8.95a.78.78 0 0 0 .77-.77V46.33a8.2 8.2 0 0 1 8.14-6.22c5 0 7.34 3.18 7.34 8v24.41a.78.78 0 0 0 .77.77h8.95a.78.78 0 0 0 .77-.77V46.05c0-9.22-5.29-15.44-14.74-15.44zm53.23 27.51l-16.23-41.86a.78.78 0 0 0-.72-.49h-11.39a.78.78 0 0 0-.77.77v55

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (433), with CRLF line terminators
Category:	downloaded
Size (bytes):	1707
Entropy (8bit):	5.1217616372228045
Encrypted:	false
SSDEEP:	48:FYcA/wp9Mq93fRCuacVMX++Re0XWIDTLAM0ho7z4:FYcbMq93fREcAZDEhh
MD5:	2E9366F45068AFB01B8448E71FD925F7
SHA1:	94BF5C28F4F7A4FBDCE1A68351695A8F6D89B2AE
SHA-256:	048F225ECA045538A65CC4C68DDD3ABA04DB90B8868CC874E528AFDF2FF260BC
SHA-512:	E0FB470999D1231F1416CF761E30511241279F50A613F0FB477FA933B093F17DC9895C97C34EEC5E4C14215450EDA64762022727D4E9F83D2D74D1DCB5F1C9E5
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/2/views/errors.html
Preview:	<div ms-main-image="logo.url"/>..<div class="promptArea errorArea">.....<div class="errorImage" ng-class="{'expired':errorStatusCode==510, 'taken':errorStatusCode==508, 'taken2':errorStatusCode==421, 'cookieDisabled':errorStatusCode==412, 'timeout':errorStatusCode==420\|\|errorStatusCode==424,'gateway':errorStatusCode==502, 'generic':errorStatusCode!=420 && errorStatusCode!=502 && errorStatusCode!=510 && errorStatusCode!=508 && errorStatusCode!=412 && errorStatusCode!=421&&errorStatusCode!=424}" />.....<h2>{{errorPageMessages.summary}}</h2>.....<span class="helpPoint" ng-if="errorStatusCode == 420">......<div class="circle" tooltip-placement="bottom" tooltip-trigger="mouseenter" tooltip-html-unsafe="{{errorPageMessages.tooltip}}">?</div>.....</span>.....<p ng-if="errorStatusCode == 424 \|\| errorStatusCode == 420 \|\| errorStatusCode == 412" ng-bind-html="errorPageMessages.description \| unsafe"/>.....<div class="cookieInstructions" ng-if="errorStatusCode == 412">......<div class="ui-select

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit grayscale, non-interlaced
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	6.205186324822577
Encrypted:	false
SSDEEP:	24:lLUXDFX3Yepzl/RRcqHogh0YC6xoopKY9QGHxS/yDJv7:OpHYA/zpHGYLxoo3Gqiyl7
MD5:	CB3107F672F160651C49DB638E20E7BC
SHA1:	864D45DAC10FDEB8867DCAAECAF4E988F93D522F
SHA-256:	15AC4C2EDADB1D6CB91BCAA53883BEC10C69A0EDED6553FAC8133B1FF464A841
SHA-512:	240EB2D078FA881D4DBBCFAC47C03AB9AA3EF40A13A14150D34C48FDD32F9FE42E14EA661574CE25C4BC7D1D355D74ABB9A752995AE4ECB14656BE1430472CA5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............:.......acTL.........=......tRNS..v..8....fcTL.......................d..V......PIDAT..m.... ..Pvr.f.,.....JP....80cZ.o."......(.p.].u0...~..y.......O0.I.lx.1.(?G.......fcTL.......................d..e.V....HfdAT......}.[.. .C.z...T.Zf.Q..Z.p...f.U.b7.D.&N5.[j.9.~8.n.K9O.f.9.....+.^.5......fcTL.......................d..i......GfdAT......c`@.g.00......E....@.c.....V0.B...3."...H..r..X.$....0.,.....e...........fcTL.......................d...y.....DfdAT......c``.....&F......0.. .....!.1._..166F."D.. ..cc.1`.d....:I.^.......fcTL.......................d...^.....GfdAT......u.Q.. .EQ:..,f!..^(.D...ag..W+.6U/.qlN.........`.9l.A....l.Y..........fcTL.......................d..=-.....CfdAT......u.K.. ....T-h......h.._.2y...{...fA%-HO.9.S..L.S".Z[..(g..>.^......fcTL.......................d........DfdAT......c`...r.T.,.....9.*........ .".j&.V`..0.n .........g@...n...........fcTL.......................d..._.....AfdAT......c`...P.T.,`l..(/...C.....$>P.B.3`

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 11 x 11, 1-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	122
Entropy (8bit):	5.076292417006227
Encrypted:	false
SSDEEP:	3:yionv//thPl6CQ+oaI/hl/g3+vnBZJgkeps/lljp:6v/lhP8CQ+oaI/hW3+vru5kljp
MD5:	38205594EA7D032DE0FEC3BEBC015B8A
SHA1:	A30CE5533BE8EF943B5B6E76B026F9AC943FB3F4
SHA-256:	0C790386760D342D9332A64E76AD915250CCB5B7A853DE684CF0C29CBD1F549E
SHA-512:	D0EF75AF266F317C950B5F30D9DB52FA652C350BEC111D82EC05F1CE758F80BC000D2034AE62740C7837FC5BF0D60E389CC950D799256CEEB6B77FF985CBCC1F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............b.e....PLTE.............tRNS.@..f..."IDAT..chP`pp`Ph`.d`.b``..@6P.(....=...........IEND.B`.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (433), with CRLF line terminators
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	5.1217616372228045
Encrypted:	false
SSDEEP:	48:FYcA/wp9Mq93fRCuacVMX++Re0XWIDTLAM0ho7z4:FYcbMq93fREcAZDEhh
MD5:	2E9366F45068AFB01B8448E71FD925F7
SHA1:	94BF5C28F4F7A4FBDCE1A68351695A8F6D89B2AE
SHA-256:	048F225ECA045538A65CC4C68DDD3ABA04DB90B8868CC874E528AFDF2FF260BC
SHA-512:	E0FB470999D1231F1416CF761E30511241279F50A613F0FB477FA933B093F17DC9895C97C34EEC5E4C14215450EDA64762022727D4E9F83D2D74D1DCB5F1C9E5
Malicious:	false
Reputation:	low
Preview:	<div ms-main-image="logo.url"/>..<div class="promptArea errorArea">.....<div class="errorImage" ng-class="{'expired':errorStatusCode==510, 'taken':errorStatusCode==508, 'taken2':errorStatusCode==421, 'cookieDisabled':errorStatusCode==412, 'timeout':errorStatusCode==420\|\|errorStatusCode==424,'gateway':errorStatusCode==502, 'generic':errorStatusCode!=420 && errorStatusCode!=502 && errorStatusCode!=510 && errorStatusCode!=508 && errorStatusCode!=412 && errorStatusCode!=421&&errorStatusCode!=424}" />.....<h2>{{errorPageMessages.summary}}</h2>.....<span class="helpPoint" ng-if="errorStatusCode == 420">......<div class="circle" tooltip-placement="bottom" tooltip-trigger="mouseenter" tooltip-html-unsafe="{{errorPageMessages.tooltip}}">?</div>.....</span>.....<p ng-if="errorStatusCode == 424 \|\| errorStatusCode == 420 \|\| errorStatusCode == 412" ng-bind-html="errorPageMessages.description \| unsafe"/>.....<div class="cookieInstructions" ng-if="errorStatusCode == 412">......<div class="ui-select

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	7.6553277441021725
Encrypted:	false
SSDEEP:	24:0PC9kBh84UI3LV7O3wvTcUYkOrpQoKwNhaFiZwIQnhzjEm/r2EM5:D9kBTTB77pyrpThaF6gnhx/r2EW
MD5:	4C1A1D1F1B8E604FDCE3327D3DFA1B81
SHA1:	0FB5EBD35871228CD932856C870C89CF52E00BFF
SHA-256:	269B9E22206B4FB23DE720A11626A717DBBAB5BCB2D5C811C371FD91DB4452A2
SHA-512:	C65DB4DAD149B13792011D93602BB2DA4A3DD99786B849183E448DCA19356220B8B5A3E24563190716FCA67AC1ADCED97BCC7AA2D20A179B2035C8328FA3090A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...-...-............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATH..Oh.U..?.SH:..A....%..B0....PJ ....H..@..^.-....B.........\^s19(..r..l.....M.N...o.....&...2..g..7.....N`...p.S# ......7.`.aTKG.}..`7...h.F.W2.....u..hQ...8..........F. U.\..."..RG.\...lr."..c..."#\b..-....g...w"...'\|..K....m...?KE..V#:....d.Yr,..Y..(<..+.[.{L.{/....V.t.-.-.....)..... .........v....F..E!..L..S.LY..=...l..GAT..y.....A..o3..r..K.L.g#.G..b.4....b..i.."^S..=yK....{..%.L..........%...8\|....Wi!Ir.j.y._.....1..^...9...zG...z..X;......4.....n..G.9/.T.@...U6Mq..8.;.~..<C....Q!cX..k.v1s...g.....pm..z.&.UVs...{3.....l.....,.8.....b.r....I..\.."....47.."..G...X..(]g.T/=.t...u.l..x]....)n7b....j..gln..@.R6..K...9n.b.]P..6..Y.A.MxVu=...Q1...L.+..k.Y6..k`..i.X...wy.<.n"x.u{X..q.D.Q.d....I....'.1q..&9EF.).)..4.=.>d........;.\c6.C_s.._..^.C...xT........mC^.....=...q...a.......D......q.*.g....o...].j....q..Q..C.4......3...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, CFF, length 9584, version 1.0
Category:	downloaded
Size (bytes):	9584
Entropy (8bit):	6.401493380742472
Encrypted:	false
SSDEEP:	192:miEqzmlV3xtgWfgFHxWDVGPtcHuDT70PqFa92c8lvJiBQXqD/:mjmmPxtgWfgFwVGFwuDT7wT92liQqz
MD5:	66E9F4BDF11FE301DDAA284C93E83920
SHA1:	0DFB2B5AF0D88B33451E913DF0E5E2014F7D5ACD
SHA-256:	3AC2830CC7024ABFCE9EBE2543E1E022EEDA04F82B3F81B85C512BAFC29FBBDF
SHA-512:	18979BC97A3A96479C1E3CBA6F473AE20990D96467D7C40FE3CE7890F8197E099D29578571C5DAD255471841F555C762F6346B41345BBFA4039A54C0FA584F35
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/css/webfonts/icomoon.woff
Preview:	wOFFOTTO..%p......%(........................CFF .............$.OS/2.. ....`...`.#.Ocmap..!D...t...te.b.gasp..".............head.."....6...6..#.hhea.."....$...$...Bhmtx..#.........hN..maxp..$..........<P.name..$....9...9D...post..%P... ... .............icomoon......:.............S.......S......f...t.........................=................ .%.*./.4.9.>.C.H.M.R.W.\.a.f.k.p.u.z...................................................................$.)..icomoonicomoonu0u1u20uE600uE748uE754uE766uE788uE7AEuE7BAuE7DEuE854uE867uE868uE8BDuE8BEuE8C2uE8C4uE8D6uE915uE9C2uEA3BuEA3EuEA3FuEA45uEA46uEAE9uEB21uEB22uEB23uEB24uEB25uEB26uEB27uEB28uEB2DuEB3EuEB4AuEB6DuEBA5uEBB8uEBC3uEBDEuEBF2uEC10uEC11uEC12uEC13uEC20uEC21uEC3DuEC40uEC42uEC72uEC73uEC74uEC75uEC97uEC99......:.<................1...........[.......9.....$.......?...8.....v...<...x.].%...a.............9...;.x...!.I.....x...:.l.......e................B.C.A..................................................{{x.u.......voa.~.............w.\|............

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65496)
Category:	downloaded
Size (bytes):	544610
Entropy (8bit):	5.477902282956111
Encrypted:	false
SSDEEP:	6144:pg/f/h3Q47GK0zRi/pJ6dpqAP1BHYLCUjpNjs0fGgworg4fGvfOHMlAku358lwqt:pmj6JP1GfrwAcki1x/
MD5:	8155A6FCBC53AC3FDB5BE5B2594D10E1
SHA1:	F79B54296839972C8974A1FC17B161C4B7ED41F0
SHA-256:	DFD17E2BFCAE86BD8E7F0E691D084891874C489ED05A84D2914042003E37CA49
SHA-512:	23705EDB9C626D0BE9760670F0B1A6BC732A283031BE38FC076F7EC14F72D7862B9199A920F6CF4F21DFA7544035D0352D8D23A41DF94348F0D577AEE070E204
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/jslib/third-party.min.js?v=1269
Preview:	/! websurvey - v0.0.1 - 2024-04-23 /.!function(h,b){function P(e,t){return t.toUpperCase()}function H(){g.addEventListener?(g.removeEventListener("DOMContentLoaded",r,!1),h.removeEventListener("load",r,!1)):(g.detachEvent("onreadystatechange",r),h.detachEvent("onload",r))}var L,m=typeof b,R=h.location,g=h.document,I=g.documentElement,V=h.jQuery,U=h.$,z={},q=[],t="1.10.2",B=q.concat,W=q.push,c=q.slice,J=q.indexOf,Y=z.toString,G=z.hasOwnProperty,K=t.trim,T=function(e,t){return new T.fn.init(e,t,ge)},Q=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,X=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,Z=/^(?:\s(<[\w\W]+>)[^>]\|#([\w-]))$/,ee=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,te=/^[\],:{}\s]$/,ne=/(?:^\|:\|,)(?:\s\[)+/g,re=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,ie=/"[^"\\\r\n]"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,ae=/^-ms-/,oe=/-([\da-z])/gi,r=function(e){!g.addEventListener&&"load"!==e.type&&"complete"!==g.readyState\|\|(H(),T.ready())};function se(e){var t=e.length,n=T.type(e);return!

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 315 x 236, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3683
Entropy (8bit):	7.680753887191402
Encrypted:	false
SSDEEP:	96:vSe0Jieza6SBWiA2did1f0/Re7v19eCWAiPm0:XFIJSKhAeh9e5A+
MD5:	7F6CEDF64BDECCAFB756ECFFC3E6A218
SHA1:	786C0CFAFF30E649387D3F501F5FFE7AC11C5289
SHA-256:	91483E5E8FC86597F485BF23BA708DEEEF997304F92CF38B19E0633770328F25
SHA-512:	3ABF70063B412E1E589F94CCE61A08339983868A6D1E9671CD752C4BFDC7F443FC3211C9FEF7C3DC2D61FA5DA862BA23AF4F4277555C54D063F53C76E0306A4E
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/2/app/img/taken_icon.png
Preview:	.PNG........IHDR...;.................sRGB.........gAMA......a.....pHYs..........+......IDATx^..y.Ue.....5M..H.4.t.r......J.?.@.....,.sl.J.4m....(&.(....t\.)..4mE+."my?.g.4s.......q.sM.9w..9w9.._....\Er..Q#v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.L v.Lh..?.........7............TWW'K.....=..#.;w&..O.>.e.d../b...S..9s..C.k.L....#G....{.......K.w......[......y.1RWW........X.n..x..t.9...^{.5.0aB...B.".i.&.:t..-GN......3f..P..F.o..C...~.'...ot3lc..p....%t.......7.p3lc..`+W.......5..x...Gr...6.....<X6l.t.?........2p.@7..b..={.H.].+.......K..]...QG...R._e......G....a......?,S.LI.........C..n94.w.\|.....N..q..A....jkx....+.$S....o.X.dI..S...{2...2.u....@.^.:.Zv....7.,Ai.t.N..[.].......&.........K....B..v.A..,OAo.YF...,!v..`.=a.c.d.AC.w.T...n..2z.h7#n..b..5[.nu.Y...o.OZ n....o.....'.\|Rjjj.8.;D.S.N.c..7g..

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 37880, version 1.0
Category:	downloaded
Size (bytes):	37880
Entropy (8bit):	7.985607149259716
Encrypted:	false
SSDEEP:	768:Anuk4Uz3pmMsZE7UEwTl4aEFcHJyUsKHa6:TdE7UEwRaaUHK5
MD5:	C736458BE6566AD973D93D49B3F7C221
SHA1:	7CFB10719937F5E98E072F47EA3F892B71BD4F4B
SHA-256:	8FDCEB23BB28FD6B4F8A56B28F01F77AFCA03B0E6CE2AA0E66BB425F47515BD5
SHA-512:	8DF818CEB31E5B158AB676CE0C2656D40653F6615393D2D44994C5258669D19D0FC8E5CC6819F5BDA73AA65AD95D99B586C7F72BA93D5E0E61DB60BB0D6FC2E7
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/css/webfonts/calibrib-webfont.woff
Preview:	wOFF..............5.........................FFTM............W8.CGDEF.......'........GPOS..........B....GSUB...\|.......X..&.OS/2......._...`....cmap...l...+.....H.cvt .......R...R....fpgm...........eS./.gasp................glyf......o....0\..zhead...X...4...6..._hhea...........$...\hmtx.......^....\|S<.loca............>.maxp....... ... ....name...........\|....post...\|........~m.prep...h............webf............M(R..........=........\|.........x.c`d``..b9.5 .....O..).. ..,......G....x...xU..Wr...0"0.P....BQ.D...K@..S.A;....L..fx..O....Zd.. .G.D.R...(EK.$@#p.$......a..9....<n .].:g.._k....k.s...I...\|..x..g%.S.K.g.....ON.c.:p.U..l..q.^.....J..... ..}.cH.I...?~~...\|...I..c..H.4..1......g[..:I...n.t....'...J.G........HL........1.c....=...'..I.zzz.z.yFz..3....c.2....q#......7n?p0.G.....M..........?._..MB..v...:.z..!.t ..\.}..&....~HX......x..7..r.&x..%.v..a8<yDz....Vn.+.....>`_.~.J..ByL..+..M...Bp..........@..9).%r..a...%.\..IZ$..G.,..y'...I.N.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 45 x 45, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	1142
Entropy (8bit):	7.6553277441021725
Encrypted:	false
SSDEEP:	24:0PC9kBh84UI3LV7O3wvTcUYkOrpQoKwNhaFiZwIQnhzjEm/r2EM5:D9kBTTB77pyrpThaF6gnhx/r2EW
MD5:	4C1A1D1F1B8E604FDCE3327D3DFA1B81
SHA1:	0FB5EBD35871228CD932856C870C89CF52E00BFF
SHA-256:	269B9E22206B4FB23DE720A11626A717DBBAB5BCB2D5C811C371FD91DB4452A2
SHA-512:	C65DB4DAD149B13792011D93602BB2DA4A3DD99786B849183E448DCA19356220B8B5A3E24563190716FCA67AC1ADCED97BCC7AA2D20A179B2035C8328FA3090A
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/info.png
Preview:	.PNG........IHDR...-...-............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATH..Oh.U..?.SH:..A....%..B0....PJ ....H..@..^.-....B.........\^s19(..r..l.....M.N...o.....&...2..g..7.....N`...p.S# ......7.`.aTKG.}..`7...h.F.W2.....u..hQ...8..........F. U.\..."..RG.\...lr."..c..."#\b..-....g...w"...'\|..K....m...?KE..V#:....d.Yr,..Y..(<..+.[.{L.{/....V.t.-.-.....)..... .........v....F..E!..L..S.LY..=...l..GAT..y.....A..o3..r..K.L.g#.G..b.4....b..i.."^S..=yK....{..%.L..........%...8\|....Wi!Ir.j.y._.....1..^...9...zG...z..X;......4.....n..G.9/.T.@...U6Mq..8.;.~..<C....Q!cX..k.v1s...g.....pm..z.&.UVs...{3.....l.....,.8.....b.r....I..\.."....47.."..G...X..(]g.T/=.t...u.l..x]....)n7b....j..gln..@.R6..K...9n.b.]P..6..Y.A.MxVu=...Q1...L.+..k.Y6..k`..i.X...wy.<.n"x.u{X..q.D.Q.d....I....'.1q..&9EF.).)..4.=.>d........;.\c6.C_s.._..^.C...xT........mC^.....=...q...a.......D......q.*.g....o...].j....q..Q..C.4......3...

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 40, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	605
Entropy (8bit):	6.865214911922468
Encrypted:	false
SSDEEP:	12:6v/79hPdxPezvyYIdkanCESWNFOLIwKaER9jsUIqDf9:2PziyYinvS3L6/1vT
MD5:	3963678CCB1A78D0CF7F7B04A8D94652
SHA1:	1618741CB8ECFEF252F950DBCA7711F57EC08324
SHA-256:	7AB3B740E4CD95AE0D4EFD1F5470B7F8A014EE5B069DD16B8EBC25BDA86A30D1
SHA-512:	2FD06F0640E7291606B8996DFA40A84F8A1A5699F8362A18E7E16B3B4945A79F0A43F50C1A28C37C2EC71AEFFC25333B3DE84712903034785D7944B7FC954C2B
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/remove.png
Preview:	.PNG........IHDR...(...(...... H_...oPLTE.................................................................................................................r....$tRNS.1.v.......,.o...E;.ih....zqJ....3....yIDAT8... ......L&......?.9J...,Y..@..6......f...F+Yb%Z....OQB....-U...v.,N.$.q.......].........9}..{.2(..oR...,-1.gQ...2.\|.~..d...h,...f0..o&Q\...7.h....R.(.h.q]..'..Ad.G..#&g..So3..}..#.$.3.8._=7.SQ.CZY..kG>X.<.....x..~H.z..\|.......1.{4.zK.G...('..f.s3.G..7...p.4....Wz4...ai...l4.=...'......lj.....f..xA.AE...+.....G...y..V.....iN....t+*,...h..<H.J4....g........IEND.B`.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 40 x 40, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	605
Entropy (8bit):	6.865214911922468
Encrypted:	false
SSDEEP:	12:6v/79hPdxPezvyYIdkanCESWNFOLIwKaER9jsUIqDf9:2PziyYinvS3L6/1vT
MD5:	3963678CCB1A78D0CF7F7B04A8D94652
SHA1:	1618741CB8ECFEF252F950DBCA7711F57EC08324
SHA-256:	7AB3B740E4CD95AE0D4EFD1F5470B7F8A014EE5B069DD16B8EBC25BDA86A30D1
SHA-512:	2FD06F0640E7291606B8996DFA40A84F8A1A5699F8362A18E7E16B3B4945A79F0A43F50C1A28C37C2EC71AEFFC25333B3DE84712903034785D7944B7FC954C2B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...(...(...... H_...oPLTE.................................................................................................................r....$tRNS.1.v.......,.o...E;.ih....zqJ....3....yIDAT8... ......L&......?.9J...,Y..@..6......f...F+Yb%Z....OQB....-U...v.,N.$.q.......].........9}..{.2(..oR...,-1.gQ...2.\|.~..d...h,...f0..o&Q\...7.h....R.(.h.q]..'..Ad.G..#&g..So3..}..#.$.3.8._=7.SQ.CZY..kG>X.<.....x..~H.z..\|.......1.{4.zK.G...('..f.s3.G..7...p.4....Wz4...ai...l4.=...'......lj.....f..xA.AE...+.....G...y..V.....iN....t+*,...h..<H.J4....g........IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 11 x 11, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	122
Entropy (8bit):	5.076292417006227
Encrypted:	false
SSDEEP:	3:yionv//thPl6CQ+oaI/hl/g3+vnBZJgkeps/lljp:6v/lhP8CQ+oaI/hW3+vru5kljp
MD5:	38205594EA7D032DE0FEC3BEBC015B8A
SHA1:	A30CE5533BE8EF943B5B6E76B026F9AC943FB3F4
SHA-256:	0C790386760D342D9332A64E76AD915250CCB5B7A853DE684CF0C29CBD1F549E
SHA-512:	D0EF75AF266F317C950B5F30D9DB52FA652C350BEC111D82EC05F1CE758F80BC000D2034AE62740C7837FC5BF0D60E389CC950D799256CEEB6B77FF985CBCC1F
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/close-white.png
Preview:	.PNG........IHDR..............b.e....PLTE.............tRNS.@..f..."IDAT..chP`pp`Ph`.d`.b``..@6P.(....=...........IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	104927
Entropy (8bit):	5.1826810580045235
Encrypted:	false
SSDEEP:	3072:h+0+uCndkZCwO1CA5kiDb3CyQ5xrQe/0ST6:V+uCndkZCwO1CA5kiDb3CyQ5xrQe/0SO
MD5:	B6CDC8D689AC681E381D9D9D44476DE4
SHA1:	3B5BFB4DC21C88D492C2C71BB9E89FD9246572FD
SHA-256:	435D62BC906C9B529C88CCC6B028A573BD98059C7340054E399FC11BD94E9B49
SHA-512:	D52A558B2DF3C227BF3816215275493E0A67B46634FFD69A18958502A61B81466AC963C5C2C6D697785EBF367FAC1A510A9E544D72A8C7F6FE20B9672C08828A
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/css/third-party.min.css
Preview:	@charset "UTF-8";/! websurvey - v0.0.1 - 2024-04-23 /@font-face{font-family:icons_mobiscroll;src:url('icons_mobiscroll.eot?p4qr6u');src:url('icons_mobiscroll.eot?#iefixp4qr6u') format('embedded-opentype'),url('icons_mobiscroll.ttf?p4qr6u') format('truetype'),url('icons_mobiscroll.woff?p4qr6u') format('woff'),url('icons_mobiscroll.svg?p4qr6u#icons_mobiscroll') format('svg');font-weight:400;font-style:normal}.mbsc-ic:before{font-family:icons_mobiscroll;speak:none;font-style:normal;font-weight:400;font-variant:normal;text-transform:none;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.mbsc-ic-aid:before{content:"\f100"}.mbsc-ic-airplane:before{content:"\f101"}.mbsc-ic-alarm2:before{content:"\f102"}.mbsc-ic-attachment:before{content:"\f103"}.mbsc-ic-bars:before{content:"\f104"}.mbsc-ic-book:before{content:"\f105"}.mbsc-ic-bubble:before{content:"\f106"}.mbsc-ic-bubbles:before{content:"\f107"}.mbsc-ic-bullhorn:before{content:"\f108"}.mbsc-ic-calendar:before{content:"\f

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	5.638983569325319
Encrypted:	false
SSDEEP:	6:6v/lhPknLIO2UHyMyy895Ua+ADq1e3KAPOLcDp5qLRgVZ/7lkup:6v/7gs6yMyy8oa+ADq1uRPOLcDpqw31
MD5:	31E09D424725E77D710434A54B180E05
SHA1:	469485198B101810D807F962ADEF0071E83FDD78
SHA-256:	C75C045E6733D6C600EC81F06D608D77D6A57E47EAADD07CD17B2D084D96F6D2
SHA-512:	D1AF8F85C932D8308181F854CCAFFC72FE9E0ECC5FDDA0CA3F72A92D8E17E0AA022E967FBA3B299072EDCDC6CA83232EB05F705F085B841BE03C8C4601F9CAE7
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/image/faviconV2.png
Preview:	.PNG........IHDR...................KPLTE....U..[..Z..Z..Z..X..V..V..Y..Y..W..X..W..Y..X..X..Y..W..X..X..X..X..X............tRNS..."367;>MSUfi.........P.I8....bKGD..i.....TIDAT(.c`.......b......$N.....0.b...Q.3.I.`..eff........SCW....._PP.k..A.....Q0`%7]..._...u......IEND.B`.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 37720, version 1.0
Category:	downloaded
Size (bytes):	37720
Entropy (8bit):	7.98592309179125
Encrypted:	false
SSDEEP:	768:KKbL8eJx2h+4H2TADXRNo9M+36oM1qdP5IVyuq0P9rjkzet7JLIg4pUzMi:KKb/JYh1HpqMgBMwPHGP1L10JU
MD5:	E962B3CC2BC3AFDBE001BFB03BBA9EF5
SHA1:	EF65BCA0B3F461CE12F4E8F1C101E37C7A4AA7F2
SHA-256:	8B52ABEF9088FD2AF316385116F9D2348E06E5C89C365FDE7CD650BBA42EFD4C
SHA-512:	38389069A8C84778ED0A6F3D47617092ABB662436220579FBE3906BFB1426A5B1525AB70706A8E30282F0D68EB736A479EB22AF77DE6289175C3D2B869F14056
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/css/webfonts/calibri-webfont.woff
Preview:	wOFF.......X......7.........................FFTM............W8.BGDEF.......'........GPOS.......Q..I....dGSUB...@.......X..&.OS/2......._...`....cmap...0...+.....H.cvt ...\...N...N.R.jfpgm...........eS./.gasp...`............glyf...h..n....,.D.mhead...x...3...6.n.@hhea...........$....hmtx.......Y....iDI.loca...(........!.V.maxp....... ... ....name...........t.8.4post............Im.prep...........gzv'.webf...P........M'R..........=........\|.........x.c`d``..b9.5 .....O..).. ..,......G....x...xUE..+.I... .... ....(0.\|.g....`F.....E.Q....S.e_D...(a.!H.H....%0.K.....%7....W..V...U..}..%"..L....2v.T.6.........{...}..*....~..j...G'...#u.Z.]...7.( ..c...O=1v.Tur./9.'.m<..h.A<.\N....K.....J]iK...M.%o..H6.-d+.R...b9.-...F=.51.Ctj....=1.xOUOmOSO+O.O7....y^.......S?.[...1.b......d.....\.......[;.n..csc/.U...W+.N\=j..-..........'m.^...q..\|.kZ..J...K.9..C........(...F..4`.._...IZ..iM.6:J..~.2s[Y&././.....o......]....S....t.92.....fC1]6p..n%.A^&.....J

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (593)
Category:	downloaded
Size (bytes):	14466
Entropy (8bit):	5.354480531510454
Encrypted:	false
SSDEEP:	384:xm/sVzTtjNQae1OsgMdOxu1EG+7XwtXp32pxZYdEv+8uOirwtqxOE:DzTtjNEOsg2OxSEG/ZqxK3
MD5:	5A79FE27A28698BC37D00DFA0322334D
SHA1:	0035040DC8A957419207C280001557B0ABE497EF
SHA-256:	A5ED802A4351061B9493C1B922C024EB067AFC6AAEF82B00823401AB9D5524D7
SHA-512:	3A3FC0CA016DF7627C990CC45D5022F995EA6AEAE9D81CFD6ED46755506706AB5DCFF8842CEC327AEBEBA73CE6C353D609B41028627BC23763F53D3C12024FE0
Malicious:	false
Reputation:	low
URL:	https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.. [if lte IE 7]>..<html id="ng-app" ng-app="surveyApp" class="no-js lt-ie9 lt-ie8" lang="en" xml:lang="en" xmlns:ng="http://angularjs.org" xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"> <![endif]-->. [if IE 8]>...<html ng-app="surveyApp" class="no-js lt-ie9" lang="en" xml:lang="en" xmlns:ng="http://angularjs.org" xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org"> <![endif]-->. [if gt IE 8]> >.<html ng-app="surveyApp" class="no-js notranslate" lang="en" xml:lang="en" xmlns:ng="http://angularjs.org" xmlns="http://www.w3.org/1999/xhtml" translate="no"> <![endif]-->..<head>... [if lt IE 9]>....<script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>....<script src="app/lib/shims/ieshims.js"></script>...<![endif]-->... [if lte IE 8]>....<script src="app/lib/angular/json3.min.js"></script>....<s

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 18:57:46.427845001 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:46.427840948 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:46.552833080 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:52.537075043 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.537113905 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.537189007 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.537808895 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.537841082 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.537902117 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.538073063 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.538100958 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.538247108 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.538259983 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.976524115 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.976819038 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.976866007 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.978347063 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.978435993 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.979482889 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.979574919 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.979619980 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.988893986 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.989170074 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.989228010 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.991117001 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:52.991205931 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.992050886 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:52.992152929 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.020148039 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.130642891 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.130698919 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.146287918 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.146331072 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.176609039 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.253866911 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.467655897 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.467753887 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.468177080 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.468230009 CEST	443	49709	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.468257904 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.470355988 CEST	49709	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.470455885 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.516122103 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908838987 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908901930 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908921957 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908940077 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908978939 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.908996105 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.909018040 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.909063101 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.909102917 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.909545898 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.909620047 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.928685904 CEST	49710	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.928719044 CEST	443	49710	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.931601048 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.931652069 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.931754112 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.932212114 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.932252884 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.932328939 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.932660103 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.932699919 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.932761908 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933084965 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933109999 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.933177948 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933273077 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933294058 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.933410883 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933434963 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.933517933 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933535099 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.933629990 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.933645964 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.934617996 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.934643030 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.934709072 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.935158014 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.935235023 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.935311079 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.935422897 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.935436010 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:53.935570955 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:53.935605049 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.364593983 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.364942074 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.364994049 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.365602016 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.365869999 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.365895033 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.366108894 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.366183996 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.366519928 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.366610050 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.366717100 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.366735935 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.366879940 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.366945982 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.367183924 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.367270947 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.367278099 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.367290020 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.370271921 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.370436907 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.370445967 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.371939898 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.372004986 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.372489929 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.372579098 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.372653008 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.372657061 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.373214006 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.373449087 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.373506069 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.373697042 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.373898029 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.373935938 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.374187946 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.374330997 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.374567986 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.374675035 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.374936104 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.374973059 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.375031948 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.375214100 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.375266075 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.375312090 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.375401974 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.376274109 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.376346111 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.376616955 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.376681089 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.376771927 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.376786947 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.409424067 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.409657001 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.409667969 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.416119099 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.416125059 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.426958084 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.426959038 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.458113909 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.846611977 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.846757889 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.846848965 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.847779989 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.847948074 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.848014116 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.849323988 CEST	49713	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.849359035 CEST	443	49713	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.854245901 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.854276896 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.854348898 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.857599974 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.857613087 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.858247995 CEST	49717	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.858294964 CEST	443	49717	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.992165089 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.992240906 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.992321014 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.992660046 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.992750883 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.992810965 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.993614912 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.993649006 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:54.994158983 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:54.994194031 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044512987 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044534922 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044543028 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044558048 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044595003 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.044603109 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044650078 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044681072 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.044681072 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.044728041 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.044862986 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044882059 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044926882 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.044944048 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.044972897 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.045007944 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048263073 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048358917 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048403978 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048454046 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048523903 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048562050 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048583984 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048676968 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048752069 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048753023 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048779964 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.048819065 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.048841953 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.056670904 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056718111 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056725979 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056741953 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056750059 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056760073 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056761026 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.056771994 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.056818008 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.057152987 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.057172060 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.057200909 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.057208061 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.057239056 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.057260036 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250369072 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250386953 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250392914 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250437021 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250456095 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250477076 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250507116 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250536919 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250557899 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250557899 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250557899 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250581026 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250802040 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250817060 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250874043 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250884056 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.250904083 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.250921965 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.256534100 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.256545067 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.256601095 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.256618977 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.256659985 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.256680012 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.256747007 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257091045 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257111073 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257153034 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257165909 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257211924 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257232904 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257719040 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257739067 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257814884 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257847071 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.257872105 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.257906914 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260026932 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260057926 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260119915 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260128021 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260147095 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260179996 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260200977 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260351896 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260399103 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260418892 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260425091 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260458946 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260477066 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260839939 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260883093 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260907888 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260914087 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.260945082 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.260963917 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.270725012 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.270737886 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.270766973 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.270786047 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.270792007 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.270832062 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.271365881 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271398067 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271420956 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.271424055 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271460056 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.271796942 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271816015 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271840096 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.271846056 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.271866083 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.271904945 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.301014900 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.303678036 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.303689003 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.304177999 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.305469990 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.305543900 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.306087017 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.352111101 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.439011097 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.439382076 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.439416885 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.442817926 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.442878962 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.443566084 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.444032907 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.444055080 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.444602013 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.444693089 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.445066929 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.445123911 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.445280075 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.445298910 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.445956945 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.446078062 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.446618080 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.446624994 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.463830948 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.463840008 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.463913918 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.463918924 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.463958025 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.463996887 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.464019060 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.464629889 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.464647055 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.464694023 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.464709044 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.464739084 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.464756966 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.465317011 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.465329885 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.465377092 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.465389967 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.465415955 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.465434074 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.468744993 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.468760967 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.468822956 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.468826056 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.468858004 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.468890905 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.468913078 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.468959093 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.469014883 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.469033003 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.469059944 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.470763922 CEST	49715	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.470796108 CEST	443	49715	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.471837044 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.471868038 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.471911907 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.471911907 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.471945047 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.471959114 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.471985102 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.472002983 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.472290993 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.472347021 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.472364902 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.472373009 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.472409010 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.472419977 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473146915 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473190069 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473213911 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473220110 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473251104 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473263025 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473782063 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473823071 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473848104 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473854065 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.473886013 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.473902941 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.474488974 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.474534988 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.474570990 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.474576950 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.474620104 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.474637985 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.475013018 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.475053072 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.475085020 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.475090981 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.475121021 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.475138903 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488251925 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488266945 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488293886 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488351107 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488385916 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488392115 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488399982 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488430977 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488441944 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488523960 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488528967 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488543034 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488562107 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488565922 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488580942 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488614082 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488637924 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.488641024 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.488667011 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.500554085 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.506112099 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.518826008 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:55.518845081 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:55.518908978 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:55.519162893 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:55.519172907 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:55.677079916 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677094936 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677162886 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677164078 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677225113 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677226067 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677251101 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677303076 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677736044 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677751064 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677797079 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677815914 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.677839994 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.677861929 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.678376913 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678391933 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678448915 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.678462029 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678492069 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.678513050 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.678917885 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678958893 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678991079 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.678992033 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.679023981 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.679044008 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.679294109 CEST	49714	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.679322004 CEST	443	49714	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.683389902 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.683413982 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.683454990 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.683469057 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.683504105 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.683522940 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.683547974 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.683568001 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684082031 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684142113 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684150934 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684166908 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684197903 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684217930 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684715033 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684756041 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684782028 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684792995 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.684818029 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.684858084 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685220003 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685259104 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685288906 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685298920 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685329914 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685347080 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685729027 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685754061 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685796022 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685826063 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.685854912 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.685870886 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686247110 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686289072 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686332941 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686348915 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686374903 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686393023 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686809063 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686866045 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686897993 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686908960 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.686933994 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.686971903 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687370062 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687413931 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687444925 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687455893 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687501907 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687501907 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687550068 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687627077 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687642097 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687690973 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.687711000 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.687767982 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.688513994 CEST	49712	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.688540936 CEST	443	49712	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702418089 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702455044 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702483892 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.702488899 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702514887 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.702575922 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.702815056 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702852011 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702883005 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.702887058 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.702905893 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.702924013 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.703470945 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.703491926 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.703517914 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.703528881 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.703566074 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.703598022 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704056025 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704087019 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704133034 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704138041 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704154968 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704174995 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704679012 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704711914 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704741001 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704745054 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.704775095 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.704792976 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.705095053 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705117941 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705188990 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.705193043 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705225945 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.705765963 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705805063 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705820084 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.705822945 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.705867052 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.705867052 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.706598043 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.706617117 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.706674099 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.706680059 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.706687927 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.706732035 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.740278959 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.740314960 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.740386009 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.740391016 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.740410089 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.740458012 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.741111994 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.741146088 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.741233110 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.741233110 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.741238117 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.741317034 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.748208046 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:55.748480082 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:55.748488903 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:55.749463081 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:55.749547005 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:55.774192095 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.774240017 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.774301052 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.774307966 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.774415016 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.774471998 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.775171041 CEST	49719	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.775180101 CEST	443	49719	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.912955046 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.913106918 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.913180113 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.914381981 CEST	49721	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.914419889 CEST	443	49721	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.917747021 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.917809963 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.917845964 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.917853117 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.917911053 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.917960882 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.918004036 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.918028116 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.918032885 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.918055058 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.918075085 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.919397116 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.919436932 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.919523001 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.919528961 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.919550896 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.919581890 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.919888973 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920070887 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920162916 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920188904 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920228958 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920249939 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920274019 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920300007 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920329094 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920778036 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920816898 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920883894 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920887947 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.920912981 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.920933008 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.921457052 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.921494007 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.921530962 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.921535015 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.921576023 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.921933889 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.921972036 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.922007084 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.922027111 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.922034025 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.922081947 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.922508955 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.922548056 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.922588110 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.922591925 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.922643900 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.922643900 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.923309088 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.923360109 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.923396111 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.923399925 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.923429966 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.923481941 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924141884 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924182892 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924217939 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924221992 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924247980 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924273968 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924802065 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924834967 CEST	49720	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924839020 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924868107 CEST	443	49720	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924875975 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.924880028 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.924913883 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925002098 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925658941 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.925695896 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.925724983 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925744057 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.925765038 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925822973 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925844908 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.925893068 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.925896883 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.926007986 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:55.926132917 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.927057981 CEST	49716	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:55.927068949 CEST	443	49716	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.031516075 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:56.031516075 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:56.070609093 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:56.070735931 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:56.111463070 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:56.111470938 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:57:56.145709038 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.145792007 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.145885944 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.146075010 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.146101952 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.146399975 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.146436930 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.146522045 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.146771908 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.146787882 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.156904936 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:56.156919956 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:57:56.578398943 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.586796999 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.609399080 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.609436989 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.609987974 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.610167027 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.610222101 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.611473083 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.618036032 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.618243933 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.621898890 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.622082949 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.626566887 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.627338886 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:56.672110081 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.672120094 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:56.833317041 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:56.833347082 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:56.833444118 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:56.868571997 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:56.868585110 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.045717955 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.045804024 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.045871973 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.055088997 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.055253983 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.055327892 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.095037937 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.095101118 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.118597984 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.118621111 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.118695974 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.124604940 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.124617100 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.155584097 CEST	49724	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.155627012 CEST	443	49724	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.156032085 CEST	49723	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.156075954 CEST	443	49723	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.158411980 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.158422947 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.158652067 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.201333046 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.209126949 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.209219933 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.209290028 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.210145950 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.210197926 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.210253000 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.210586071 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.210617065 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.210896015 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.210931063 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.235634089 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.280114889 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.345803022 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.345870972 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.345922947 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.349019051 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.349030018 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.349042892 CEST	49725	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.349047899 CEST	443	49725	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.381623983 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.381635904 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.381711006 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.381953001 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.381962061 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.555361032 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 18:57:57.555458069 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:57:57.562982082 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.563287020 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.563297033 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.563772917 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.564089060 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.564196110 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.564199924 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.604552984 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.604618073 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.605840921 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.605844975 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.606074095 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.606975079 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.608118057 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.615855932 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.646950960 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.648114920 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.648816109 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.666495085 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.666551113 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.667157888 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.667188883 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.668025970 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.668303967 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.668368101 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.669858932 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.670048952 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.670995951 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.671080112 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.671350956 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.671418905 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.671448946 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.712157011 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:57.720645905 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:57.823348999 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.823421001 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:57.823479891 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.897258043 CEST	49729	443	192.168.2.5	184.31.62.93
Apr 25, 2024 18:57:57.897280931 CEST	443	49729	184.31.62.93	192.168.2.5
Apr 25, 2024 18:57:58.036092997 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.036257029 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.036319971 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.039169073 CEST	49726	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.039186954 CEST	443	49726	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.061980963 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.062067032 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.062161922 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.062421083 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.062455893 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.072946072 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.073024035 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.073101997 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.078176022 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.078212023 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.087311983 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.087352991 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.087412119 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.087862015 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.087876081 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.088437080 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.088476896 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.088536978 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.088732004 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.088758945 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328353882 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328388929 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328408957 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328460932 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328526974 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328562021 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328581095 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328705072 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328728914 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328759909 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328773975 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.328799963 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328819036 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.328829050 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338519096 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338541985 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338548899 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338555098 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338567019 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338573933 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338606119 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.338664055 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338700056 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.338838100 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.338958979 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.338973999 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.339035034 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.339049101 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.339071035 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.339122057 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.339133978 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.339150906 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.339198112 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.340471029 CEST	49727	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.340492010 CEST	443	49727	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.373481989 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.373568058 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.373581886 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.373794079 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.374419928 CEST	49728	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.374450922 CEST	443	49728	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.387794971 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.387830019 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.387995958 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.388303041 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.388315916 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.501126051 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.511447906 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.511504889 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.512150049 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.512586117 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.512711048 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.512933969 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.514041901 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.514278889 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.514302969 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.514672041 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.515002012 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.515075922 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.515283108 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.523708105 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.524183989 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.524240971 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.525161028 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.525228977 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.525609016 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.525675058 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.525902033 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.525918961 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.532844067 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.533123016 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.533179045 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.533569098 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.534046888 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.534120083 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.535181999 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.556117058 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.560111046 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.565970898 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.580110073 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.821681976 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.821964979 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.821991920 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.822300911 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.822602987 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.822658062 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.822736979 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.864140034 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.977533102 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.977560043 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.977638006 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.977628946 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.977716923 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.978362083 CEST	49731	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.978415966 CEST	443	49731	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.991142988 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.991168022 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.991219044 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.991240025 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.991276026 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.991843939 CEST	49732	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.991867065 CEST	443	49732	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.996227980 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.996268034 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:58.996325970 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.996820927 CEST	49734	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:58.996839046 CEST	443	49734	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.005182981 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.005352974 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.005410910 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.005819082 CEST	49733	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.005832911 CEST	443	49733	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.219820023 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.219851017 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.219974041 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.220374107 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.220383883 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.223788023 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.223890066 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.223980904 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.224167109 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.224200010 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.235780954 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.235816002 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.235899925 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.236161947 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.236180067 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.294945955 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.295006037 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.295084953 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.392199039 CEST	49735	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.392247915 CEST	443	49735	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.655179024 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.658471107 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.669114113 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.705195904 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.705212116 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.720813036 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.784799099 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.784816980 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.784970999 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.784981012 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.785144091 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.785172939 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.785507917 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.785609007 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.785634995 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.786859989 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.786928892 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.787761927 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.787868023 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.788445950 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.788547039 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.788913012 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.789191008 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.789217949 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:57:59.832122087 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.832133055 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:57:59.836117983 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134229898 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134269953 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134279966 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134330988 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134363890 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.134387016 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134398937 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.134439945 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.139381886 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.139405966 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.139477015 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.139487982 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.139525890 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.150408983 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.150470018 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.150563955 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.150625944 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.150660992 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.154190063 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.346548080 CEST	49738	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.346615076 CEST	443	49738	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.384196997 CEST	49737	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.384217978 CEST	443	49737	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.387840033 CEST	49736	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.387860060 CEST	443	49736	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.507401943 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.507472992 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.507569075 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.507920027 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.507955074 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.547611952 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.547705889 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.547873020 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.548089981 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.548126936 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.947424889 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.975183964 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.975243092 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.976488113 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.977236986 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.977421999 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.977777958 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.981419086 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.982439041 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.982497931 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.982861042 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.986887932 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:00.986960888 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:00.987035990 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.020144939 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.028143883 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.421370029 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.421560049 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.421627998 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.438513041 CEST	49740	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.438532114 CEST	443	49740	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.469683886 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.469705105 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.469758987 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:01.469762087 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.469803095 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.471374035 CEST	49743	443	192.168.2.5	35.158.27.166
Apr 25, 2024 18:58:01.471402884 CEST	443	49743	35.158.27.166	192.168.2.5
Apr 25, 2024 18:58:05.763497114 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:05.763562918 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:05.763616085 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:07.765229940 CEST	49722	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:07.765254974 CEST	443	49722	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:08.023302078 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.023586988 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.024000883 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.024041891 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.024130106 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.024492025 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.024507999 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.180982113 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.181116104 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.353343010 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.353429079 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.579211950 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.579241037 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.579725027 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.579802036 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.580338955 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.580370903 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.583528042 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.583537102 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.944582939 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.944674015 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.944797039 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:08.944856882 CEST	443	49750	23.1.237.91	192.168.2.5
Apr 25, 2024 18:58:08.944907904 CEST	49750	443	192.168.2.5	23.1.237.91
Apr 25, 2024 18:58:55.459738970 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:55.459769011 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.459856033 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:55.462547064 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:55.462558985 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.693913937 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.703527927 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:55.703541994 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.704678059 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.705038071 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:58:55.705207109 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:58:55.752230883 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:59:05.693630934 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:59:05.693794966 CEST	443	49754	64.233.176.103	192.168.2.5
Apr 25, 2024 18:59:05.693921089 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:59:05.755172968 CEST	49754	443	192.168.2.5	64.233.176.103
Apr 25, 2024 18:59:05.755194902 CEST	443	49754	64.233.176.103	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 18:57:51.593375921 CEST	53	51370	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:51.597537994 CEST	53	60033	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:52.222841024 CEST	53	54960	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:52.403969049 CEST	58349	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:52.406488895 CEST	60678	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:52.532893896 CEST	53	60678	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:52.535715103 CEST	53	58349	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:54.865392923 CEST	63537	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:54.865627050 CEST	53396	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:54.990475893 CEST	53	53396	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:54.991111040 CEST	53	63537	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:55.404572010 CEST	54813	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:55.405468941 CEST	62747	53	192.168.2.5	1.1.1.1
Apr 25, 2024 18:57:55.515378952 CEST	53	62747	1.1.1.1	192.168.2.5
Apr 25, 2024 18:57:55.515516043 CEST	53	54813	1.1.1.1	192.168.2.5
Apr 25, 2024 18:58:09.347271919 CEST	53	59164	1.1.1.1	192.168.2.5
Apr 25, 2024 18:58:28.080777884 CEST	53	58906	1.1.1.1	192.168.2.5
Apr 25, 2024 18:58:51.200512886 CEST	53	58647	1.1.1.1	192.168.2.5
Apr 25, 2024 18:58:51.284560919 CEST	53	62825	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 18:57:52.403969049 CEST	192.168.2.5	1.1.1.1	0xdb36	Standard query (0)	feedback.inmoment.eu	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:52.406488895 CEST	192.168.2.5	1.1.1.1	0x95d2	Standard query (0)	feedback.inmoment.eu	65	IN (0x0001)	false
Apr 25, 2024 18:57:54.865392923 CEST	192.168.2.5	1.1.1.1	0x57b3	Standard query (0)	feedback.inmoment.eu	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:54.865627050 CEST	192.168.2.5	1.1.1.1	0x9bb3	Standard query (0)	feedback.inmoment.eu	65	IN (0x0001)	false
Apr 25, 2024 18:57:55.404572010 CEST	192.168.2.5	1.1.1.1	0x4f69	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.405468941 CEST	192.168.2.5	1.1.1.1	0xe289	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 18:57:52.535715103 CEST	1.1.1.1	192.168.2.5	0xdb36	No error (0)	feedback.inmoment.eu		35.158.27.166	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:52.535715103 CEST	1.1.1.1	192.168.2.5	0xdb36	No error (0)	feedback.inmoment.eu		3.74.185.135	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:52.535715103 CEST	1.1.1.1	192.168.2.5	0xdb36	No error (0)	feedback.inmoment.eu		3.76.234.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:54.991111040 CEST	1.1.1.1	192.168.2.5	0x57b3	No error (0)	feedback.inmoment.eu		35.158.27.166	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:54.991111040 CEST	1.1.1.1	192.168.2.5	0x57b3	No error (0)	feedback.inmoment.eu		3.76.234.91	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:54.991111040 CEST	1.1.1.1	192.168.2.5	0x57b3	No error (0)	feedback.inmoment.eu		3.74.185.135	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515378952 CEST	1.1.1.1	192.168.2.5	0xe289	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:57:55.515516043 CEST	1.1.1.1	192.168.2.5	0x4f69	No error (0)	www.google.com		64.233.176.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:58:07.713891029 CEST	1.1.1.1	192.168.2.5	0x98b7	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 18:58:07.713891029 CEST	1.1.1.1	192.168.2.5	0x98b7	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:58:20.534243107 CEST	1.1.1.1	192.168.2.5	0x2881	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 18:58:20.534243107 CEST	1.1.1.1	192.168.2.5	0x2881	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:58:43.176229954 CEST	1.1.1.1	192.168.2.5	0x4f3	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 18:58:43.176229954 CEST	1.1.1.1	192.168.2.5	0x4f3	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 25, 2024 18:59:04.162013054 CEST	1.1.1.1	192.168.2.5	0x5d30	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 18:59:04.162013054 CEST	1.1.1.1	192.168.2.5	0x5d30	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

feedback.inmoment.eu

https:

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:52 UTC	744	OUT	GET /websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:53 UTC	480	IN	HTTP/1.1 303 See Other x-request-id: 19f6dc95-1483-418c-bf90-12758c26fa5b x-content-type-options: nosniff x-xss-protection: 1; mode=block location: /websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 x-session-token: bd479d89-973f-4ead-86a2-90f42772e6f5 content-language: en content-length: 0 date: Thu, 25 Apr 2024 16:57:52 GMT server: websurvey x-envoy-upstream-service-time: 29 access-control-expose-headers: x-request-id,x-page-load-id connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:53 UTC	720	OUT	GET /websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:53 UTC	418	IN	HTTP/1.1 200 OK x-request-id: 9a6a5582-9c3a-4191-a970-98a9b86057b4 x-content-type-options: nosniff x-xss-protection: 1; mode=block vary: accept-encoding content-type: text/html;charset=UTF-8 content-language: en date: Thu, 25 Apr 2024 16:57:53 GMT server: websurvey x-envoy-upstream-service-time: 8 access-control-expose-headers: x-request-id,x-page-load-id connection: close transfer-encoding: chunked
2024-04-25 16:57:53 UTC	14487	IN	Data Raw: 31 65 63 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 0a 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 37 5d 3e 09 09 3c 68 74 6d 6c 20 69 64 3d 22 6e 67 2d 61 70 70 22 20 6e 67 2d 61 70 70 3d 22 73 75 72 76 65 79 41 70 70 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3a 6e 67 3d 22 68 74 74 70 3a 2f 2f 61 6e 67 75 6c 61 72 6a 73 2e 6f 72 Data Ascii: 1ecf<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">...[if lte IE 7]><html id="ng-app" ng-app="surveyApp" class="no-js lt-ie9 lt-ie8" lang="en" xml:lang="en" xmlns:ng="http://angularjs.or

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	629	OUT	GET /websurvey/css/third-party.min.css HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	528	IN	HTTP/1.1 200 OK x-request-id: 6ca5881e-1e30-4e0e-a31d-120fc71d27be x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"104927-1713871262000" last-modified: Tue, 23 Apr 2024 11:21:02 GMT vary: accept-encoding, Accept-Encoding content-type: text/css content-length: 104927 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	15856	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 20 77 65 62 73 75 72 76 65 79 20 2d 20 76 30 2e 30 2e 31 20 2d 20 32 30 32 34 2d 30 34 2d 32 33 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 63 6f 6e 73 5f 6d 6f 62 69 73 63 72 6f 6c 6c 3b 73 72 63 3a 75 72 6c 28 27 69 63 6f 6e 73 5f 6d 6f 62 69 73 63 72 6f 6c 6c 2e 65 6f 74 3f 70 34 71 72 36 75 27 29 3b 73 72 63 3a 75 72 6c 28 27 69 63 6f 6e 73 5f 6d 6f 62 69 73 63 72 6f 6c 6c 2e 65 6f 74 3f 23 69 65 66 69 78 70 34 71 72 36 75 27 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 27 69 63 6f 6e 73 5f 6d 6f 62 69 73 63 72 6f 6c 6c 2e 74 74 66 3f 70 34 71 72 36 75 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 Data Ascii: @charset "UTF-8";/! websurvey - v0.0.1 - 2024-04-23 /@font-face{font-family:icons_mobiscroll;src:url('icons_mobiscroll.eot?p4qr6u');src:url('icons_mobiscroll.eot?#iefixp4qr6u') format('embedded-opentype'),url('icons_mobiscroll.ttf?p4qr6u') format('truet
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 64 65 72 2d 62 6f 78 7d 2e 64 77 2d 63 61 6c 2d 61 6e 69 6d 2d 63 2c 2e 64 77 2d 63 61 6c 2d 63 2c 2e 64 77 2d 63 61 6c 2d 73 6c 69 64 65 2c 2e 64 77 2d 63 61 6c 2d 74 61 62 20 2e 64 77 2d 69 2c 2e 64 77 2d 77 65 65 6b 2d 6e 72 73 2d 63 7b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 64 77 2d 63 61 6c 65 6e 64 61 72 20 2e 64 77 20 2e 64 77 2d 68 69 64 64 65 6e 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2e 64 77 2d 63 61 6c 65 6e 64 61 72 20 2e 64 77 63 63 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 64 77 2d 63 61 6c 65 6e 64 61 72 20 2e 64 77 2d 63 61 6c 2d 70 6e 6c 7b 64 69 73 70 Data Ascii: der-box}.dw-cal-anim-c,.dw-cal-c,.dw-cal-slide,.dw-cal-tab .dw-i,.dw-week-nrs-c{-webkit-backface-visibility:hidden;backface-visibility:hidden}.dw-calendar .dw .dw-hidden{padding:0;margin:0}.dw-calendar .dwcc{position:relative}.dw-calendar .dw-cal-pnl{disp
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 74 2d 6b 65 79 66 72 61 6d 65 73 20 64 77 2d 73 77 2d 69 6e 7b 66 72 6f 6d 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 59 28 2d 39 30 64 65 67 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 59 28 30 29 7d 7d 40 2d 6d 6f 7a 2d 6b 65 79 66 72 61 6d 65 73 20 64 77 2d 73 77 2d 69 6e 7b 66 72 6f 6d 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 59 28 2d 39 30 64 65 67 29 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 59 28 30 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 64 77 2d 73 77 2d 6f 75 74 7b 66 72 6f 6d 7b 6f 70 61 63 69 Data Ascii: t-keyframes dw-sw-in{from{opacity:0;-webkit-transform:rotateY(-90deg)}to{opacity:1;-webkit-transform:rotateY(0)}}@-moz-keyframes dw-sw-in{from{opacity:0;-moz-transform:rotateY(-90deg)}to{opacity:1;-moz-transform:rotateY(0)}}@keyframes dw-sw-out{from{opaci
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 73 63 61 6c 65 33 64 28 31 2e 31 2c 31 2e 31 2c 31 2e 31 29 20 72 6f 74 61 74 65 33 64 28 30 2c 30 2c 31 2c 2d 33 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 33 64 28 31 2e 31 2c 31 2e 31 2c 31 2e 31 29 20 72 6f 74 61 74 65 33 64 28 30 2c 30 2c 31 2c 2d 33 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 33 64 28 31 2c 31 2c 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 33 64 28 31 2c 31 2c 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 74 61 64 61 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 33 64 28 31 2c 31 2c 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 33 64 28 31 2c 31 2c 31 29 7d 31 30 25 2c 32 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 Data Ascii: scale3d(1.1,1.1,1.1) rotate3d(0,0,1,-3deg);transform:scale3d(1.1,1.1,1.1) rotate3d(0,0,1,-3deg)}100%{-webkit-transform:scale3d(1,1,1);transform:scale3d(1,1,1)}}@keyframes tada{0%{-webkit-transform:scale3d(1,1,1);transform:scale3d(1,1,1)}10%,20%{-webkit-tr
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 7d 2e 66 61 64 65 49 6e 55 70 42 69 67 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 64 65 49 6e 55 70 42 69 67 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 64 65 49 6e 55 70 42 69 67 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 4f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 4f 75 74 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 7d 2e 66 61 64 65 4f 75 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a Data Ascii: ty:1;-webkit-transform:none;transform:none}}.fadeInUpBig{-webkit-animation-name:fadeInUpBig;animation-name:fadeInUpBig}@-webkit-keyframes fadeOut{0%{opacity:1}100%{opacity:0}}@keyframes fadeOut{0%{opacity:1}100%{opacity:0}}.fadeOut{-webkit-animation-name:
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 72 69 67 68 74 20 62 6f 74 74 6f 6d 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 72 69 67 68 74 20 62 6f 74 74 6f 6d 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 33 64 28 30 2c 30 2c 31 2c 2d 34 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 33 64 28 30 2c 30 2c 31 2c 2d 34 35 64 65 67 29 3b 6f 70 61 63 69 74 79 3a 30 7d 7d 2e 72 6f 74 61 74 65 4f 75 74 44 6f 77 6e 52 69 67 68 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 72 6f 74 61 74 65 4f 75 74 44 6f 77 6e 52 69 67 68 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 72 6f 74 61 74 65 4f 75 74 44 6f 77 6e 52 69 67 68 74 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 Data Ascii: form-origin:right bottom;transform-origin:right bottom;-webkit-transform:rotate3d(0,0,1,-45deg);transform:rotate3d(0,0,1,-45deg);opacity:0}}.rotateOutDownRight{-webkit-animation-name:rotateOutDownRight;animation-name:rotateOutDownRight}@-webkit-keyframes
2024-04-25 16:57:55 UTC	7151	IN	Data Raw: 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 7d 31 30 30 25 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 25 2c 30 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 25 2c 30 2c 30 29 7d 7d 2e 73 6c 69 64 65 4f 75 74 52 69 67 68 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 73 6c 69 64 65 4f 75 74 52 69 67 68 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 73 6c 69 64 65 4f 75 74 52 69 67 68 74 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 73 6c 69 64 65 4f 75 74 55 70 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 Data Ascii: anslate3d(0,0,0)}100%{visibility:hidden;-webkit-transform:translate3d(100%,0,0);transform:translate3d(100%,0,0)}}.slideOutRight{-webkit-animation-name:slideOutRight;animation-name:slideOutRight}@-webkit-keyframes slideOutUp{0%{-webkit-transform:translate3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	684	OUT	GET /websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	562	IN	HTTP/1.1 200 OK x-request-id: d44844cc-8947-447d-882c-e084dc6b8bd5 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: no-cache,no-store,must-revalidate expires: Thu, 01 Jan 1970 00:00:00 GMT pragma: no-cache content-disposition: inline;filename=f.txt vary: accept-encoding, Accept-Encoding content-type: text/css;charset=UTF-8 content-length: 144136 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 204 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	15822	IN	Data Raw: 2f 2a 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 20 20 20 42 61 73 65 20 73 74 79 6c 65 73 0a 20 20 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2a 2f 0a 68 74 6d 6c 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a Data Ascii: /* ========================================================================== Base styles ========================================================================== */html { background-size: cover; background-color: #FFFFFF; background-image:
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 73 65 3b 0a 7d 0a 2e 66 69 65 6c 64 2d 70 72 6f 6d 70 74 2d 65 72 72 6f 72 2d 61 64 64 2c 0a 2e 66 69 65 6c 64 2d 70 72 6f 6d 70 74 2d 65 72 72 6f 72 2d 72 65 6d 6f 76 65 20 7b 0a 20 20 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 32 73 20 65 61 73 65 2c 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 32 73 20 65 61 73 65 2c 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 20 32 73 20 65 61 73 65 2c 20 62 6f 72 64 65 72 2d 77 69 64 74 68 20 32 73 20 65 61 73 65 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 32 73 20 65 61 73 65 2c 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 32 73 20 65 61 73 65 2c 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 20 32 Data Ascii: se;}.field-prompt-error-add,.field-prompt-error-remove { -moz-transition: background-color 2s ease, border-color 2s ease, border-style 2s ease, border-width 2s ease; -webkit-transition: background-color 2s ease, border-color 2s ease, border-style 2
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 20 20 20 20 68 65 69 67 68 74 3a 20 30 3b 0a 20 20 7d 0a 7d 0a 40 2d 6f 2d 6b 65 79 66 72 61 6d 65 73 20 69 6e 6c 69 6e 65 42 61 72 2d 61 70 70 65 61 72 2d 70 61 72 74 31 20 7b 0a 20 20 30 25 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 30 3b 0a 20 20 7d 0a 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 69 6e 6c 69 6e 65 42 61 72 2d 61 70 70 65 61 72 2d 70 61 72 74 31 20 7b 0a 20 20 30 25 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 30 3b 0a 20 20 7d 0a 7d 0a 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 69 6e 6c 69 6e 65 42 61 72 2d 61 70 70 65 61 72 2d 70 61 72 74 32 20 7b 0a 20 20 32 35 25 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 69 6e 68 65 72 69 74 3b 0a 20 20 7d 0a 20 20 37 30 25 20 7b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 69 6e 68 65 72 69 Data Ascii: height: 0; }}@-o-keyframes inlineBar-appear-part1 { 0% { height: 0; }}@keyframes inlineBar-appear-part1 { 0% { height: 0; }}@-webkit-keyframes inlineBar-appear-part2 { 25% { height: inherit; } 70% { height: inheri
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 68 6c 69 67 68 74 3a 66 6f 63 75 73 2d 77 69 74 68 69 6e 2c 0a 2e 61 64 61 48 69 67 68 6c 69 67 68 74 3a 66 6f 63 75 73 20 7b 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 31 70 78 20 73 6f 6c 69 64 20 67 72 65 65 6e 3b 0a 7d 0a 2e 67 65 6e 65 72 69 63 50 72 6f 6d 70 74 48 65 61 64 65 72 20 7b 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 73 6b 69 70 54 6f 43 6f 6e 74 65 6e 74 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 74 72 61 6e 73 66 6f 72 6d 20 30 2e 32 35 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 2c 20 62 6f 72 64 65 72 20 30 2e 32 35 73 20 6c 69 6e 65 61 72 2c 20 70 61 64 64 69 6e 67 20 30 2e 32 35 73 20 6c 69 6e 65 61 72 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 74 72 61 6e Data Ascii: hlight:focus-within,.adaHighlight:focus { outline: 1px solid green;}.genericPromptHeader { outline: none;}.skipToContent { -webkit-transition: transform 0.25s ease-in-out, border 0.25s linear, padding 0.25s linear !important; transition: tran
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 2e 2e 2f 69 6d 61 67 65 2f 67 6f 52 65 63 2f 69 63 6f 6e 73 2f 2f 74 77 69 74 74 65 72 2d 69 63 6f 6e 2d 33 32 2e 70 6e 67 27 29 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 33 31 70 78 3b 0a 20 20 77 69 64 74 68 3a 20 31 35 35 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 23 63 77 75 2d 74 77 69 74 74 65 72 3a 68 6f 76 65 72 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 31 34 61 62 64 62 3b 0a 7d 0a 23 63 77 75 2d 65 6d 61 69 6c 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 36 39 41 32 35 31 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 Data Ascii: background-image: url('../image/goRec/icons//twitter-icon-32.png'); padding-right: 31px; width: 155px !important;}#cwu-twitter:hover { background-color: #14abdb;}#cwu-email { background-color: #69A251; cursor: pointer; background-image:
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 6f 6d 70 74 20 2e 74 65 78 74 2d 73 65 67 6d 65 6e 74 20 69 6e 70 75 74 20 7b 0a 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 69 6e 69 74 69 61 6c 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 77 69 64 74 68 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 67 6f 52 65 63 53 68 61 72 65 50 72 6f 6d 70 74 20 2e 70 72 6f 6d 70 74 49 6e 70 75 74 20 2e 63 6f 6d 6d 65 6e 74 41 72 65 61 20 7b 0a 20 20 77 69 64 74 68 3a 20 35 32 35 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 33 36 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0a 20 20 72 65 73 69 7a 65 3a 20 6e 6f 6e 65 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 6d 61 Data Ascii: ompt .text-segment input { min-width: auto !important; min-width: initial !important; width: auto !important;}.goRecSharePrompt .promptInput .commentArea { width: 525px; height: 136px; border-style: solid; resize: none; color: #333; ma
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 7d 0a 20 20 2e 70 72 6f 6d 70 74 2e 63 61 74 65 67 6f 72 69 63 61 6c 47 72 6f 75 70 20 2e 70 72 6f 6d 70 74 20 2e 74 65 78 74 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 35 70 78 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 2d 31 31 70 78 3b 0a 20 20 7d 0a 20 20 2e 70 72 6f 6d 70 74 2e 63 61 74 65 67 6f 72 69 63 61 6c 47 72 6f 75 70 20 2e 70 72 6f 6d 70 74 20 2e 70 72 6f 6d 70 74 54 65 78 74 5f 5f 63 68 69 6c 64 20 7b 0a 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 34 30 25 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 2d Data Ascii: padding-left: 0; } .prompt.categoricalGroup .prompt .text { padding-left: 5px; display: inline-block; vertical-align: -11px; } .prompt.categoricalGroup .prompt .promptText__child { float: left; width: 40%; display: table-
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 23 66 38 66 38 66 38 3b 0a 20 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 23 66 38 66 38 66 38 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 23 66 38 66 38 66 38 3b 0a 7d 0a 23 65 6d 61 69 6c 4d 6f 64 61 6c 20 66 6f 72 6d 23 65 6d 61 69 6c 2d 72 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 2d 66 6f 72 6d 20 2e 66 74 20 2e 66 69 65 6c 64 73 65 74 20 2e 62 75 74 74 6f 6e 2e 73 68 61 72 65 3a 68 6f 76 65 72 2c 0a 23 65 6d 61 69 6c 4d 6f 64 61 6c 20 66 6f 72 6d 23 65 6d 61 69 6c 2d 72 65 63 6f 6d 6d 65 6e 64 61 74 69 6f 6e 2d 66 6f 72 6d 20 2e 66 74 20 2e 66 69 65 6c 64 73 65 74 20 2e 62 75 74 74 6f 6e 2e 73 68 61 72 65 3a 66 6f 63 75 73 20 7b 0a 20 20 2d Data Ascii: -shadow: 0 1px 0 #f8f8f8; -moz-box-shadow: 0 1px 0 #f8f8f8; box-shadow: 0 1px 0 #f8f8f8;}#emailModal form#email-recommendation-form .ft .fieldset .button.share:hover,#emailModal form#email-recommendation-form .ft .fieldset .button.share:focus { -
2024-04-25 16:57:55 UTC	13626	IN	Data Raw: 38 33 25 3b 0a 20 20 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 33 73 20 6c 69 6e 65 61 72 20 2e 35 73 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 33 73 20 6c 69 6e 65 61 72 20 2e 35 73 3b 0a 20 20 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 33 73 20 6c 69 6e 65 61 72 20 2e 35 73 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 33 73 20 6c 69 6e 65 61 72 20 2e 35 73 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 33 73 20 6c 69 6e 65 61 72 20 2e 35 73 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 6e 75 64 67 65 42 75 62 62 6c 65 20 2e 33 73 20 2e 37 73 20 65 61 73 65 3b 0a 20 20 2d 6d 6f 7a 2d 61 6e 69 6d 61 74 Data Ascii: 83%; -moz-transition: all .3s linear .5s; -webkit-transition: all .3s linear .5s; -o-transition: all .3s linear .5s; -ms-transition: all .3s linear .5s; transition: all .3s linear .5s; -webkit-animation: nudgeBubble .3s .7s ease; -moz-animat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	623	OUT	GET /websurvey/jslib/third-party.min.js?v=1269 HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	542	IN	HTTP/1.1 200 OK x-request-id: 10f51c3f-7323-4ccc-bc5d-333a849931f0 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"544610-1713871262000" last-modified: Tue, 23 Apr 2024 11:21:02 GMT vary: accept-encoding, Accept-Encoding content-type: application/javascript content-length: 544610 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	15842	IN	Data Raw: 2f 2a 21 20 77 65 62 73 75 72 76 65 79 20 2d 20 76 30 2e 30 2e 31 20 2d 20 32 30 32 34 2d 30 34 2d 32 33 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 68 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 50 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 48 28 29 7b 67 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 67 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 72 2c 21 31 29 2c 68 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 72 2c 21 31 29 29 3a 28 67 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 72 29 2c 68 2e 64 65 74 61 63 Data Ascii: /! websurvey - v0.0.1 - 2024-04-23 /!function(h,b){function P(e,t){return t.toUpperCase()}function H(){g.addEventListener?(g.removeEventListener("DOMContentLoaded",r,!1),h.removeEventListener("load",r,!1)):(g.detachEvent("onreadystatechange",r),h.detac
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 21 3d 3d 43 26 26 53 28 65 29 3b 76 61 72 20 6e 3d 6b 2e 61 74 74 72 48 61 6e 64 6c 65 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 2c 6e 3d 6e 26 26 43 65 2e 63 61 6c 6c 28 6b 2e 61 74 74 72 48 61 6e 64 6c 65 2c 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3f 6e 28 65 2c 74 2c 21 41 29 3a 79 65 3b 72 65 74 75 72 6e 20 6e 3d 3d 3d 79 65 3f 78 2e 61 74 74 72 69 62 75 74 65 73 7c 7c 21 41 3f 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 74 29 3a 28 6e 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 74 29 29 26 26 6e 2e 73 70 65 63 69 66 69 65 64 3f 6e 2e 76 61 6c 75 65 3a 6e 75 6c 6c 3a 6e 7d 2c 5f 2e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 6e 65 77 Data Ascii: e.ownerDocument\|\|e)!==C&&S(e);var n=k.attrHandle[t.toLowerCase()],n=n&&Ce.call(k.attrHandle,t.toLowerCase())?n(e,t,!A):ye;return n===ye?x.attributes\|\|!A?e.getAttribute(t):(n=e.getAttributeNode(t))&&n.specified?n.value:null:n},_.error=function(e){throw new
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 21 3d 74 79 70 65 6f 66 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 28 72 3f 73 5b 6c 5d 3d 54 2e 65 78 74 65 6e 64 28 73 5b 6c 5d 2c 74 29 3a 73 5b 6c 5d 2e 64 61 74 61 3d 54 2e 65 78 74 65 6e 64 28 73 5b 6c 5d 2e 64 61 74 61 2c 74 29 29 2c 65 3d 73 5b 6c 5d 2c 72 7c 7c 28 65 2e 64 61 74 61 7c 7c 28 65 2e 64 61 74 61 3d 7b 7d 29 2c 65 3d 65 2e 64 61 74 61 29 2c 6e 21 3d 3d 62 26 26 28 65 5b 54 2e 63 61 6d 65 6c 43 61 73 65 28 74 29 5d 3d 6e 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 6e 75 6c 6c 3d 3d 28 69 3d 65 5b 74 5d 29 26 26 28 69 3d 65 5b 54 2e 63 61 6d 65 6c 43 61 73 65 28 74 29 5d 29 3a 69 3d 65 2c 69 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 74 28 65 2c 74 2c 6e 29 7b 69 66 28 54 2e 61 63 63 65 70 Data Ascii: !=typeof t&&"function"!=typeof t\|\|(r?s[l]=T.extend(s[l],t):s[l].data=T.extend(s[l].data,t)),e=s[l],r\|\|(e.data\|\|(e.data={}),e=e.data),n!==b&&(e[T.camelCase(t)]=n),"string"==typeof t?null==(i=e[t])&&(i=e[T.camelCase(t)]):i=e,i}}function lt(e,t,n){if(T.accep
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 26 26 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6e 2c 21 31 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 74 3d 22 6f 6e 22 2b 74 3b 65 2e 64 65 74 61 63 68 45 76 65 6e 74 26 26 28 74 79 70 65 6f 66 20 65 5b 74 5d 3d 3d 6d 26 26 28 65 5b 74 5d 3d 6e 75 6c 6c 29 2c 65 2e 64 65 74 61 63 68 45 76 65 6e 74 28 74 2c 6e 29 29 7d 2c 54 2e 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 54 2e 45 76 65 6e 74 29 29 72 65 74 75 72 6e 20 6e 65 77 20 54 2e 45 76 65 6e 74 28 65 2c 74 29 3b 65 26 26 65 2e 74 79 70 65 3f 28 74 68 69 73 2e 6f 72 69 67 69 6e Data Ascii: ction(e,t,n){e.removeEventListener&&e.removeEventListener(t,n,!1)}:function(e,t,n){t="on"+t;e.detachEvent&&(typeof e[t]==m&&(e[t]=null),e.detachEvent(t,n))},T.Event=function(e,t){if(!(this instanceof T.Event))return new T.Event(e,t);e&&e.type?(this.origin
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 6f 6e 3d 2f 5e 28 74 6f 70 7c 72 69 67 68 74 7c 62 6f 74 74 6f 6d 7c 6c 65 66 74 29 24 2f 2c 73 6e 3d 2f 5e 28 6e 6f 6e 65 7c 74 61 62 6c 65 28 3f 21 2d 63 5b 65 61 5d 29 2e 2b 29 2f 2c 6c 6e 3d 2f 5e 6d 61 72 67 69 6e 2f 2c 75 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 51 2b 22 29 28 2e 2a 29 24 22 2c 22 69 22 29 2c 63 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 51 2b 22 29 28 3f 21 70 78 29 5b 61 2d 7a 25 5d 2b 24 22 2c 22 69 22 29 2c 64 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 5b 2b 2d 5d 29 3d 28 22 2b 51 2b 22 29 22 2c 22 69 22 29 2c 66 6e 3d 7b 42 4f 44 59 3a 22 62 6c 6f 63 6b 22 7d 2c 70 6e 3d 7b 70 6f 73 69 74 69 6f 6e 3a 22 61 62 73 6f 6c 75 74 65 22 2c 76 69 73 69 62 69 6c 69 74 79 3a 22 68 69 64 64 65 6e 22 2c 64 69 Data Ascii: on=/^(top\|right\|bottom\|left)$/,sn=/^(none\|table(?!-c[ea]).+)/,ln=/^margin/,un=new RegExp("^("+Q+")(.*)$","i"),cn=new RegExp("^("+Q+")(?!px)[a-z%]+$","i"),dn=new RegExp("^([+-])=("+Q+")","i"),fn={BODY:"block"},pn={position:"absolute",visibility:"hidden",di
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 74 63 68 28 65 29 7b 7d 7d 54 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 68 2e 41 63 74 69 76 65 58 4f 62 6a 65 63 74 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 74 68 69 73 2e 69 73 4c 6f 63 61 6c 26 26 58 6e 28 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 68 2e 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50 22 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 7d 3a 58 6e 2c 65 3d 54 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 2c 54 2e 73 75 70 70 6f 72 74 2e 63 6f 72 73 3d 21 21 65 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 65 2c 28 65 3d 54 2e 73 75 70 70 6f 72 74 2e 61 6a 61 78 3d 21 21 65 29 26 26 54 2e 61 Data Ascii: tch(e){}}T.ajaxSettings.xhr=h.ActiveXObject?function(){return!this.isLocal&&Xn()\|\|function(){try{return new h.ActiveXObject("Microsoft.XMLHTTP")}catch(e){}}()}:Xn,e=T.ajaxSettings.xhr(),T.support.cors=!!e&&"withCredentials"in e,(e=T.support.ajax=!!e)&&T.a
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 74 68 69 73 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 75 28 74 68 69 73 29 5b 30 5d 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 75 28 74 68 69 73 29 5b 30 5d 2e 6a 41 6c 65 72 74 29 72 65 74 75 72 6e 20 75 28 74 68 69 73 29 5b 30 5d 2e 6a 41 6c 65 72 74 3b 75 2e 65 61 63 68 28 75 2e 66 6e 2e 6a 41 6c 65 72 74 2e 64 65 66 61 75 6c 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 76 6f 69 64 20 30 21 3d 3d 72 5b 6e 5d 26 26 28 72 5b 65 5d 3d 72 5b 6e 5d 29 7d 29 3b 76 61 72 20 6e 3d 28 72 3d 75 2e 65 78 74 65 6e 64 28 7b 7d 2c 75 2e 66 6e 2e 6a 41 6c 65 72 74 2e 64 65 66 61 75 6c 74 73 2c 72 29 29 2e 69 64 3f 72 2e 69 64 3a 22 6a 61 5f 22 2b 28 44 61 74 65 2e 6e 6f 77 28 29 2e 74 6f 53 74 72 Data Ascii: this;if(void 0!==u(this)[0]&&"undefined"!=u(this)[0].jAlert)return u(this)[0].jAlert;u.each(u.fn.jAlert.defaults,function(e,t){var n=e.toLowerCase();void 0!==r[n]&&(r[e]=r[n])});var n=(r=u.extend({},u.fn.jAlert.defaults,r)).id?r.id:"ja_"+(Date.now().toStr
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 4e 75 6d 62 65 72 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 74 72 69 6e 67 5d 22 3a 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 44 61 74 65 5d 22 3a 72 65 74 75 72 6e 20 6e 65 77 20 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2e 76 61 6c 75 65 4f 66 28 29 29 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 52 65 67 45 78 70 5d 22 3a 76 61 72 20 74 3d 6e 65 77 20 52 65 67 45 78 70 28 65 2e 73 6f 75 72 63 65 2c 65 2e 74 6f 53 74 72 69 6e 67 28 29 2e 6d 61 74 63 68 28 2f 5b 5e 2f 5d 2a 24 2f 29 5b 30 5d 29 3b 72 65 74 75 72 6e 20 74 2e 6c 61 73 74 49 6e 64 65 78 3d 65 2e 6c 61 73 74 49 6e 64 65 78 2c 74 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 42 6c 6f 62 5d 22 3a 72 65 74 75 72 6e 20 6e 65 77 20 65 2e 63 6f 6e Data Ascii: ]":case"[object Number]":case"[object String]":case"[object Date]":return new e.constructor(e.valueOf());case"[object RegExp]":var t=new RegExp(e.source,e.toString().match(/[^/]*$/)[0]);return t.lastIndex=e.lastIndex,t;case"[object Blob]":return new e.con
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 7c 28 28 72 3d 6f 5b 65 5d 3d 5b 5d 29 2e 73 70 65 63 69 61 6c 48 61 6e 64 6c 65 72 57 72 61 70 70 65 72 3d 74 2c 22 24 64 65 73 74 72 6f 79 22 3d 3d 3d 65 7c 7c 6e 7c 7c 69 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 65 2c 73 29 29 2c 72 2e 70 75 73 68 28 61 29 7d 3b 72 2d 2d 3b 29 65 3d 6e 5b 72 5d 2c 75 74 5b 65 5d 3f 28 6c 28 75 74 5b 65 5d 2c 51 74 29 2c 6c 28 65 2c 76 6f 69 64 20 30 2c 21 30 29 29 3a 6c 28 65 29 7d 2c 6f 66 66 3a 45 74 2c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 28 74 3d 78 65 28 74 29 29 2e 6f 6e 28 6e 2c 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 2e 6f 66 66 28 6e 2c 72 29 2c 74 2e 6f 66 66 28 6e 2c 65 29 7d 29 2c 74 2e 6f 6e 28 6e 2c 72 29 7d 2c 72 65 70 6c 61 63 65 57 69 74 68 3a 66 75 6e 63 74 69 6f Data Ascii: \|((r=o[e]=[]).specialHandlerWrapper=t,"$destroy"===e\|\|n\|\|i.addEventListener(e,s)),r.push(a)};r--;)e=n[r],ut[e]?(l(ut[e],Qt),l(e,void 0,!0)):l(e)},off:Et,one:function(t,n,r){(t=xe(t)).on(n,function e(){t.off(n,r),t.off(n,e)}),t.on(n,r)},replaceWith:functio
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 69 72 65 3d 28 21 41 65 28 69 3d 28 72 3d 6e 29 2e 72 65 71 75 69 72 65 7c 7c 72 2e 63 6f 6e 74 72 6f 6c 6c 65 72 26 26 72 2e 6e 61 6d 65 29 26 26 53 65 28 69 29 26 26 54 65 28 69 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 6d 61 74 63 68 28 64 29 3b 65 2e 73 75 62 73 74 72 69 6e 67 28 6e 5b 30 5d 2e 6c 65 6e 67 74 68 29 7c 7c 28 69 5b 74 5d 3d 6e 5b 30 5d 2b 74 29 7d 29 2c 69 29 2c 6e 2e 72 65 73 74 72 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 7c 7c 43 65 28 65 29 26 26 2f 5b 45 41 43 4d 5d 2f 2e 74 65 73 74 28 65 29 29 72 65 74 75 72 6e 20 65 7c 7c 22 45 41 22 3b 74 68 72 6f 77 20 6a 65 28 22 62 61 64 72 65 73 74 72 69 63 74 22 2c 22 52 65 73 74 72 69 63 74 20 70 72 6f 70 65 72 74 79 20 27 7b 30 7d 27 Data Ascii: ire=(!Ae(i=(r=n).require\|\|r.controller&&r.name)&&Se(i)&&Te(i,function(e,t){var n=e.match(d);e.substring(n[0].length)\|\|(i[t]=n[0]+t)}),i),n.restrict=function(e,t){if(!e\|\|Ce(e)&&/[EACM]/.test(e))return e\|\|"EA";throw je("badrestrict","Restrict property '{0}'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	625	OUT	GET /websurvey/jslib/appDirectives.min.js?v=1269 HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	542	IN	HTTP/1.1 200 OK x-request-id: 274f15e2-aede-4d52-9aae-82af38dfe73f x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"314419-1713871250000" last-modified: Tue, 23 Apr 2024 11:20:50 GMT vary: accept-encoding, Accept-Encoding content-type: application/javascript content-length: 314419 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	15842	IN	Data Raw: 2f 2a 21 20 77 65 62 73 75 72 76 65 79 20 2d 20 76 30 2e 30 2e 31 20 2d 20 32 30 32 34 2d 30 34 2d 32 33 20 2a 2f 0a 66 75 6e 63 74 69 6f 6e 20 65 78 74 72 61 63 74 54 6f 42 6f 6f 6c 65 61 6e 28 65 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 65 26 26 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 22 74 72 75 65 22 3d 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3a 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 29 7d 66 75 6e 63 74 69 6f 6e 20 65 78 74 72 61 63 74 54 6f 4e 75 6d 62 65 72 28 65 29 7b 76 61 72 20 74 3d 74 79 70 65 6f 66 20 65 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 29 7b 76 61 72 20 72 3d 70 61 72 73 65 49 6e 74 28 65 29 3b 69 66 28 21 69 73 4e 61 4e 28 72 29 29 72 65 74 75 72 6e 20 72 3b Data Ascii: /! websurvey - v0.0.1 - 2024-04-23 /function extractToBoolean(e){return void 0!==e&&("string"==typeof e?"true"===e.toLowerCase():"boolean"==typeof e&&e)}function extractToNumber(e){var t=typeof e;if("string"==t){var r=parseInt(e);if(!isNaN(r))return r;
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 6f 6d 6d 6f 6e 5b 22 78 2d 69 6d 2d 67 2d 69 64 22 5d 3d 65 2c 6f 2e 64 65 66 61 75 6c 74 73 2e 68 65 61 64 65 72 73 2e 67 65 74 7c 7c 28 6f 2e 64 65 66 61 75 6c 74 73 2e 68 65 61 64 65 72 73 2e 67 65 74 3d 7b 7d 29 2c 6f 2e 64 65 66 61 75 6c 74 73 2e 68 65 61 64 65 72 73 2e 67 65 74 5b 22 78 2d 69 6d 2d 67 2d 69 64 22 5d 3d 65 7d 7d 7d 5d 29 2c 61 70 70 2e 66 61 63 74 6f 72 79 28 22 77 63 61 67 53 65 72 76 69 63 65 22 2c 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 21 31 3b 72 65 74 75 72 6e 7b 67 65 74 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 7d 2c 73 65 74 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 3d 22 62 6f 6f 6c 65 61 6e 22 21 3d 74 79 70 65 6f 66 20 65 3f 28 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 Data Ascii: ommon["x-im-g-id"]=e,o.defaults.headers.get\|\|(o.defaults.headers.get={}),o.defaults.headers.get["x-im-g-id"]=e}}}]),app.factory("wcagService",[function(){var t=!1;return{getState:function(){return t},setState:function(e){t="boolean"!=typeof e?(console.log
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 72 72 65 6e 74 50 61 67 65 28 29 26 26 24 73 63 6f 70 65 2e 63 75 72 72 65 6e 74 50 61 67 65 28 29 2e 70 72 6f 6d 70 74 73 29 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 24 73 63 6f 70 65 2e 63 75 72 72 65 6e 74 50 61 67 65 28 29 2e 70 72 6f 6d 70 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 74 3d 24 73 63 6f 70 65 2e 63 75 72 72 65 6e 74 50 61 67 65 28 29 2e 70 72 6f 6d 70 74 73 5b 65 5d 2c 72 3d 24 73 63 6f 70 65 2e 67 65 74 50 72 6f 6d 70 74 44 69 73 70 6c 61 79 56 61 6c 75 65 28 74 29 2c 6e 3d 74 2e 64 69 73 70 6c 61 79 3b 69 66 28 74 2e 70 72 6f 6d 70 74 73 29 7b 66 6f 72 28 76 61 72 20 6f 3d 21 31 2c 69 3d 30 3b 69 3c 74 2e 70 72 6f 6d 70 74 73 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 76 61 72 20 61 3d 74 2e 70 72 6f 6d 70 74 73 5b 69 5d 2c Data Ascii: rrentPage()&&$scope.currentPage().prompts)for(var e=0;e<$scope.currentPage().prompts.length;e++){var t=$scope.currentPage().prompts[e],r=$scope.getPromptDisplayValue(t),n=t.display;if(t.prompts){for(var o=!1,i=0;i<t.prompts.length;i++){var a=t.prompts[i],
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 22 2c 24 73 63 6f 70 65 2e 6c 6f 63 61 6c 65 29 2c 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 53 65 72 76 69 63 65 2e 73 74 6f 72 65 49 74 65 6d 28 22 73 75 72 76 65 79 4f 76 65 72 22 2c 24 73 63 6f 70 65 2e 73 75 72 76 65 79 4f 76 65 72 29 2c 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 53 65 72 76 69 63 65 2e 73 74 6f 72 65 49 74 65 6d 28 22 72 65 76 69 65 77 55 72 6c 22 2c 24 73 63 6f 70 65 2e 72 65 76 69 65 77 55 72 6c 29 2c 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 53 65 72 76 69 63 65 2e 73 74 6f 72 65 49 74 65 6d 28 22 72 65 76 69 65 77 42 61 6e 6e 65 72 22 2c 24 73 63 6f 70 65 2e 72 65 76 69 65 77 42 61 6e 6e 65 72 29 2c 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 53 65 72 76 69 63 65 2e 73 74 6f 72 65 49 74 65 6d 28 22 70 68 72 61 73 65 73 22 2c 4a 53 Data Ascii: ",$scope.locale),sessionStorageService.storeItem("surveyOver",$scope.surveyOver),sessionStorageService.storeItem("reviewUrl",$scope.reviewUrl),sessionStorageService.storeItem("reviewBanner",$scope.reviewBanner),sessionStorageService.storeItem("phrases",JS
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 65 61 72 63 68 28 74 68 69 73 2e 64 65 76 69 63 65 42 72 65 77 29 7d 2c 44 65 74 65 63 74 53 6d 61 72 74 70 68 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 28 74 68 69 73 2e 44 65 74 65 63 74 54 69 65 72 49 70 68 6f 6e 65 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 53 36 30 4f 73 73 42 72 6f 77 73 65 72 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 53 79 6d 62 69 61 6e 4f 53 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 57 69 6e 64 6f 77 73 4d 6f 62 69 6c 65 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 42 6c 61 63 6b 42 65 72 72 79 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 4d 65 65 67 6f 50 68 6f 6e 65 28 29 7c 7c 74 68 69 73 2e 44 65 74 65 63 74 50 61 6c 6d 4f 53 28 29 29 7d 2c 44 65 74 65 63 74 4d 6f 62 69 6c 65 51 75 69 63 6b Data Ascii: earch(this.deviceBrew)},DetectSmartphone:function(){return!!(this.DetectTierIphone()\|\|this.DetectS60OssBrowser()\|\|this.DetectSymbianOS()\|\|this.DetectWindowsMobile()\|\|this.DetectBlackBerry()\|\|this.DetectMeegoPhone()\|\|this.DetectPalmOS())},DetectMobileQuick
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 6f 74 68 65 72 4f 70 74 69 6f 6e 49 6e 70 75 74 5f 22 2b 73 2e 64 64 2e 70 72 6f 6d 70 74 2e 69 64 29 29 26 26 28 65 2e 74 61 62 49 6e 64 65 78 3d 2d 31 2c 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 66 6f 63 75 73 28 29 7d 2c 31 30 30 29 29 7d 7d 7d 73 2e 63 68 65 63 6b 41 72 69 61 49 6e 76 61 6c 69 64 28 29 7d 2c 73 2e 6b 65 79 70 72 65 73 73 59 4e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 73 2e 6b 65 79 44 69 72 65 63 74 69 6f 6e 28 65 29 3b 65 2e 6d 6f 76 65 4c 65 66 74 7c 7c 65 2e 6d 6f 76 65 55 70 3f 28 73 2e 64 64 2e 61 6e 73 77 65 72 2e 76 61 6c 75 65 3d 73 2e 64 64 2e 70 72 6f 6d 70 74 2e 63 68 6f 69 63 65 73 5b 31 5d 2e 63 68 6f 69 63 65 49 64 2c 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 64 6f Data Ascii: .getElementById("otherOptionInput_"+s.dd.prompt.id))&&(e.tabIndex=-1,d(function(){r.focus()},100))}}}s.checkAriaInvalid()},s.keypressYN=function(e){e=s.keyDirection(e);e.moveLeft\|\|e.moveUp?(s.dd.answer.value=s.dd.prompt.choices[1].choiceId,d(function(){do
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 73 6c 69 63 65 28 29 3b 72 65 74 75 72 6e 20 61 6e 67 75 6c 61 72 2e 66 6f 72 45 61 63 68 28 45 2e 73 70 6c 69 74 28 22 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 2e 6c 65 6e 67 74 68 26 26 74 3d 3d 3d 6f 5b 30 5d 3f 28 6e 2b 3d 72 2e 63 68 61 72 41 74 28 30 29 7c 7c 22 5f 22 2c 72 3d 72 2e 73 75 62 73 74 72 28 31 29 2c 6f 2e 73 68 69 66 74 28 29 29 3a 6e 2b 3d 65 7d 29 2c 6e 7d 76 3d 73 2e 75 69 4f 70 74 69 6f 6e 73 3f 28 76 3d 77 2e 24 65 76 61 6c 28 22 5b 22 2b 73 2e 75 69 4f 70 74 69 6f 6e 73 2b 22 5d 22 29 2c 61 6e 67 75 6c 61 72 2e 69 73 4f 62 6a 65 63 74 28 76 5b 30 5d 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 20 69 6e 20 65 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f Data Ascii: slice();return angular.forEach(E.split(""),function(e,t){r.length&&t===o[0]?(n+=r.charAt(0)\|\|"_",r=r.substr(1),o.shift()):n+=e}),n}v=s.uiOptions?(v=w.$eval("["+s.uiOptions+"]"),angular.isObject(v[0])?function(e,t){for(var r in e)Object.prototype.hasOwnPro
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 65 22 7d 2c 6c 69 6e 6b 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 76 61 72 20 72 2c 6f 2c 69 3b 6e 2e 63 6c 69 63 6b 65 64 47 6f 6f 67 6c 65 50 6c 75 73 42 75 74 74 6f 6e 3d 21 31 2c 6e 2e 67 6f 6f 67 6c 65 50 6c 75 73 41 75 74 68 52 65 73 75 6c 74 43 6f 64 65 3d 6e 75 6c 6c 2c 6e 2e 72 65 6e 64 65 72 42 75 74 74 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 72 79 7b 67 61 70 69 2e 69 6e 74 65 72 61 63 74 69 76 65 70 6f 73 74 2e 72 65 6e 64 65 72 28 74 2e 61 74 74 72 28 22 69 64 22 29 2c 72 29 7d 63 61 74 63 68 28 65 29 7b 6c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 72 65 6e 64 65 72 42 75 74 74 6f 6e 28 74 2c 72 29 7d 2c 31 30 30 29 7d 7d 2c 6e 2e 67 6f 6f 67 6c 65 44 61 74 61 2e 73 68 61 72 65 64 4f 6e 7c 7c 28 22 22 21 3d 28 72 3d 6e Data Ascii: e"},link:function(n,e,t){var r,o,i;n.clickedGooglePlusButton=!1,n.googlePlusAuthResultCode=null,n.renderButton=function(t,r){try{gapi.interactivepost.render(t.attr("id"),r)}catch(e){l(function(){n.renderButton(t,r)},100)}},n.googleData.sharedOn\|\|(""!=(r=n
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 24 28 74 29 2e 76 61 6c 28 29 3b 22 22 21 3d 3d 72 26 26 6e 75 6c 6c 21 3d 3d 72 7c 7c 28 24 28 74 29 2e 70 61 72 65 6e 74 28 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 66 69 65 6c 64 2d 70 72 6f 6d 70 74 2d 65 72 72 6f 72 2d 72 65 6d 6f 76 65 22 29 2e 61 64 64 43 6c 61 73 73 28 22 66 69 65 6c 64 2d 70 72 6f 6d 70 74 2d 65 72 72 6f 72 22 29 2c 24 28 74 29 2e 61 64 64 43 6c 61 73 73 28 22 74 65 78 74 45 72 72 6f 72 22 29 29 7d 29 7d 29 7d 7d 7d 5d 29 2c 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 22 6e 75 6d 65 72 69 63 22 2c 5b 22 69 6d 2e 6d 61 73 6b 22 5d 29 2e 64 69 72 65 63 74 69 76 65 28 22 6d 73 4e 75 6d 65 72 69 63 22 2c 5b 22 65 72 72 6f 72 4d 61 6e 61 67 65 72 22 2c 22 77 63 61 67 53 65 72 76 Data Ascii: ction(e,t){var r=$(t).val();""!==r&&null!==r\|\|($(t).parent().removeClass("field-prompt-error-remove").addClass("field-prompt-error"),$(t).addClass("textError"))})})}}}]),angular.module("numeric",["im.mask"]).directive("msNumeric",["errorManager","wcagServ
2024-04-25 16:57:55 UTC	16384	IN	Data Raw: 72 6f 72 4d 65 73 73 61 67 65 3a 76 2e 67 65 74 45 72 72 6f 72 4d 65 73 73 61 67 65 28 70 2e 64 64 2e 70 72 6f 6d 70 74 2c 22 6d 69 6e 6c 65 6e 67 74 68 22 29 7d 29 2c 65 2e 70 75 73 68 28 7b 64 69 76 45 6c 65 6d 65 6e 74 3a 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 65 6d 61 69 6c 22 29 2c 65 72 72 6f 72 4d 65 73 73 61 67 65 3a 76 2e 67 65 74 45 72 72 6f 72 4d 65 73 73 61 67 65 28 70 2e 64 64 2e 70 72 6f 6d 70 74 2c 22 65 6d 61 69 6c 22 29 7d 29 2c 65 2e 70 75 73 68 28 7b 64 69 76 45 6c 65 6d 65 6e 74 3a 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 74 65 6c 22 29 2c 65 72 72 6f 72 4d 65 73 73 61 67 65 3a 76 2e 67 65 74 45 72 72 6f 72 4d 65 73 73 61 67 65 28 70 2e 64 64 2e 70 72 6f 6d 70 Data Ascii: rorMessage:v.getErrorMessage(p.dd.prompt,"minlength")}),e.push({divElement:t.getElementsByClassName("email"),errorMessage:v.getErrorMessage(p.dd.prompt,"email")}),e.push({divElement:t.getElementsByClassName("tel"),errorMessage:v.getErrorMessage(p.dd.promp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49713	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	668	OUT	GET /websurvey/image/remove.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:54 UTC	483	IN	HTTP/1.1 200 OK x-request-id: 26908d72-fc93-404c-bc4d-ca25699da4aa x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"605-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 605 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:54 UTC	605	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 03 00 00 00 bb 20 48 5f 00 00 00 6f 50 4c 54 45 00 00 00 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 00 f7 72 ab 00 00 00 24 74 52 4e 53 00 31 f2 76 08 f9 c8 c0 ec 80 f5 03 2c c3 b0 6f e6 ce 2a e2 8e 45 3b 13 69 68 d2 b6 a2 a1 94 7a 71 4a d3 01 8a f6 33 b5 00 00 01 79 49 44 41 54 38 cb 9d d3 eb ae 83 20 0c 00 e0 8a a2 dd a6 4c 26 88 97 cd cb c6 fb 3f e3 39 4a 1c ba 92 2c 59 ff cc 40 f7 d1 36 00 ba 11 15 a2 Data Ascii: PNGIHDR(( H_oPLTEr$tRNS1v,o*E;ihzqJ3yIDAT8 L&?9J,Y@6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:54 UTC	673	OUT	GET /websurvey/image/close-white.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:54 UTC	483	IN	HTTP/1.1 200 OK x-request-id: 5a6714f1-3764-4419-8f7f-0f5024e2b346 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"122-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 122 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:54 UTC	122	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0b 00 00 00 0b 01 03 00 00 00 93 62 e5 65 00 00 00 06 50 4c 54 45 00 00 00 ff ff ff a5 d9 9f dd 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 22 49 44 41 54 08 d7 63 68 50 60 70 70 60 50 68 60 10 64 60 e0 62 60 60 01 91 40 36 50 04 28 0e 94 05 00 3d bb 03 bb b9 c0 15 c9 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRbePLTEtRNS@f"IDATchP`pp`Ph`d`b``@6P(=IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49719	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:55 UTC	686	OUT	GET /websurvey/image/powered-by-inmoment-gray.svg HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	512	IN	HTTP/1.1 200 OK x-request-id: c4673e5a-4205-449a-8707-0d11f8f03345 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"4534-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/svg+xml content-length: 4534 date: Thu, 25 Apr 2024 16:57:55 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id vary: Accept-Encoding connection: close
2024-04-25 16:57:55 UTC	4534	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 36 32 2e 30 31 20 38 39 22 20 78 6d 6c 6e 73 3a 76 3d 22 68 74 74 70 73 3a 2f 2f 76 65 63 74 61 2e 69 6f 2f 6e 61 6e 6f 22 3e 3c 70 61 74 68 20 64 3d 22 4d 33 35 36 2e 31 36 20 30 68 2d 31 33 2e 34 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 2d 31 2e 31 38 20 31 2e 31 38 76 31 33 2e 34 31 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 31 2e 31 38 20 31 2e 31 38 68 31 33 2e 34 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 31 2e 31 38 2d 31 2e 31 38 56 31 2e 31 38 41 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 33 35 36 2e 31 36 20 30 7a 6d 30 20 33 31 2e 35 34 68 2d 31 33 2e 33 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 762.01 89" xmlns:v="https://vecta.io/nano"><path d="M356.16 0h-13.4a1.18 1.18 0 0 0-1.18 1.18v13.41a1.18 1.18 0 0 0 1.18 1.18h13.4a1.18 1.18 0 0 0 1.18-1.18V1.18A1.18 1.18 0 0 0 356.16 0zm0 31.54h-13.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49721	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:55 UTC	370	OUT	GET /websurvey/image/remove.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	483	IN	HTTP/1.1 200 OK x-request-id: 432ee92a-4be4-46e2-886e-326c05107618 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"605-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 605 date: Thu, 25 Apr 2024 16:57:55 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	605	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 03 00 00 00 bb 20 48 5f 00 00 00 6f 50 4c 54 45 00 00 00 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 10 12 12 00 f7 72 ab 00 00 00 24 74 52 4e 53 00 31 f2 76 08 f9 c8 c0 ec 80 f5 03 2c c3 b0 6f e6 ce 2a e2 8e 45 3b 13 69 68 d2 b6 a2 a1 94 7a 71 4a d3 01 8a f6 33 b5 00 00 01 79 49 44 41 54 38 cb 9d d3 eb ae 83 20 0c 00 e0 8a a2 dd a6 4c 26 88 97 cd cb c6 fb 3f e3 39 4a 1c ba 92 2c 59 ff cc 40 f7 d1 36 00 ba 11 15 a2 Data Ascii: PNGIHDR(( H_oPLTEr$tRNS1v,o*E;ihzqJ3yIDAT8 L&?9J,Y@6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:55 UTC	375	OUT	GET /websurvey/image/close-white.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:55 UTC	483	IN	HTTP/1.1 200 OK x-request-id: d79e6635-696d-45df-8542-745fcf6fdc52 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"122-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 122 date: Thu, 25 Apr 2024 16:57:54 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:55 UTC	122	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0b 00 00 00 0b 01 03 00 00 00 93 62 e5 65 00 00 00 06 50 4c 54 45 00 00 00 ff ff ff a5 d9 9f dd 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 22 49 44 41 54 08 d7 63 68 50 60 70 70 60 50 68 60 10 64 60 e0 62 60 60 01 91 40 36 50 04 28 0e 94 05 00 3d bb 03 bb b9 c0 15 c9 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRbePLTEtRNS@f"IDATchP`pp`Ph`d`b``@6P(=IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49723	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:56 UTC	666	OUT	GET /websurvey/image/info.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:57 UTC	485	IN	HTTP/1.1 200 OK x-request-id: 1cc3ad03-6b74-4db8-9527-3461fdcd57ab x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"1142-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 1142 date: Thu, 25 Apr 2024 16:57:56 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:57 UTC	1142	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2d 00 00 00 2d 08 04 00 00 00 90 13 2a 11 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 03 91 49 44 41 54 48 c7 b5 97 4f 68 1c 55 1c c7 3f f3 b2 53 48 3a 17 ed 41 94 06 91 a9 25 a7 80 42 30 07 f5 92 fe 50 4a 20 81 92 a0 0d 48 10 9a 40 db 0d 5e ea 2d 84 90 a3 87 42 8d d0 c6 8b 0a ae 18 11 0c 84 5c 5e 73 31 39 28 0b 11 72 89 d6 6c f6 e0 a9 e0 82 87 4d ab 4e dd f5 b0 6f de ce ce ce cc 26 bb ed ef 32 ef ef 67 be ef 37 ef fd e6 f7 1c 4e 60 e2 e0 e2 a2 70 a8 53 23 20 d0 f5 ce b3 9c 0e c8 37 99 60 8c 61 54 4b 47 8d 7d b6 d9 60 Data Ascii: PNGIHDR--*gAMAa cHRMz&u0`:pQ<bKGDIDATHOhU?SH:A%B0PJ H@^-B\^s19(rlMNo&2g7N`pS# 7`aTKG}`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49724	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:56 UTC	669	OUT	GET /websurvey/image/spinner.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:57 UTC	485	IN	HTTP/1.1 200 OK x-request-id: 0a6e09e6-2be5-490f-86b7-b6fe4e4dbb69 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"1080-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 1080 date: Thu, 25 Apr 2024 16:57:56 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:57 UTC	1080	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 00 00 00 00 3a 98 a0 bd 00 00 00 08 61 63 54 4c 00 00 00 08 00 00 00 00 b9 3d 8b d1 00 00 00 02 74 52 4e 53 00 00 76 93 cd 38 00 00 00 1a 66 63 54 4c 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 00 00 00 0a 00 64 00 00 56 df 18 1e 00 00 00 50 49 44 41 54 18 d3 6d cc d1 11 c0 20 08 03 50 76 72 16 66 e9 2c 99 c5 15 18 aa 4a 50 d3 ab f9 e1 f2 38 30 63 5a b3 6f 14 22 16 b8 17 04 c1 0b 28 d2 87 70 b8 5d 13 75 30 f3 8c fc e1 7e c6 01 79 93 1d 90 de fb 91 dc 4f 30 e0 bc 49 d0 6c 78 01 31 1e 28 3f 47 0d ca db 00 00 00 1a 66 63 54 4c 00 00 00 01 00 00 00 0e 00 00 00 10 00 00 00 02 00 00 00 00 00 0a 00 64 00 01 65 f8 56 01 00 00 00 48 66 64 41 54 00 00 00 02 18 d3 7d cb 5b 0d 00 20 Data Ascii: PNGIHDR:acTL=tRNSv8fcTLdVPIDATm Pvrf,JP80cZo"(p]u0~yO0Ilx1(?GfcTLdeVHfdAT}[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:57 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 16:57:57 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0790) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=137138 Date: Thu, 25 Apr 2024 16:57:57 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49726	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:57 UTC	847	OUT	POST /websurvey/2/prompts HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive Content-Length: 90 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-CSRF-TOKEN: T5GafB+z+A3Wux5d5jjvIiFFOPgcnPyOyMe3FelFV0A= sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;charset=UTF-8 Accept: application/json, text/plain, / x-session-token: bd479d89-973f-4ead-86a2-90f42772e6f5 sec-ch-ua-platform: "Windows" Origin: https://feedback.inmoment.eu Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:57 UTC	90	OUT	Data Raw: 7b 22 63 75 72 72 65 6e 74 50 61 67 65 49 6e 64 65 78 22 3a 2d 31 2c 22 76 69 64 65 6f 52 65 73 70 6f 6e 73 65 50 72 6f 63 65 73 73 65 64 22 3a 66 61 6c 73 65 2c 22 67 64 70 72 43 6f 6e 73 65 6e 74 44 61 74 65 22 3a 6e 75 6c 6c 2c 22 61 6e 73 77 65 72 73 22 3a 7b 7d 7d Data Ascii: {"currentPageIndex":-1,"videoResponseProcessed":false,"gdprConsentDate":null,"answers":{}}
2024-04-25 16:57:58 UTC	443	IN	HTTP/1.1 508 Loop Detected x-request-id: d9f3d361-4454-4e7c-85f0-4ae73d2bd771 x-content-type-options: nosniff x-xss-protection: 1; mode=block expires: 0 vary: accept-encoding, Accept-Encoding content-type: application/json;charset=UTF-8 date: Thu, 25 Apr 2024 16:57:57 GMT server: websurvey x-envoy-upstream-service-time: 4 access-control-expose-headers: x-request-id,x-page-load-id connection: close transfer-encoding: chunked
2024-04-25 16:57:58 UTC	871	IN	Data Raw: 33 36 30 0d 0a 7b 22 63 6f 6d 70 6c 65 74 65 22 3a 66 61 6c 73 65 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 73 61 6d 73 75 6e 67 50 68 6f 6e 65 22 3a 66 61 6c 73 65 2c 22 73 75 72 76 65 79 4f 76 65 72 22 3a 66 61 6c 73 65 2c 22 70 65 72 63 65 6e 74 43 6f 6d 70 6c 65 74 65 22 3a 30 2e 30 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 5f 55 53 22 2c 22 70 61 67 65 4d 65 73 73 61 67 65 73 22 3a 7b 22 63 6f 6e 74 61 63 74 55 73 22 3a 22 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 69 62 5c 22 3e 49 66 20 74 68 65 20 70 72 6f 62 6c 65 6d 20 70 65 72 73 69 73 74 73 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 75 73 20 61 74 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 69 6d 2d 63 6f 6e 74 61 63 74 2d 69 6e 66 6f 5c 22 3e 3c 64 69 76 20 63 6c 61 73 Data Ascii: 360{"complete":false,"mobile":false,"samsungPhone":false,"surveyOver":false,"percentComplete":0.0,"locale":"en_US","pageMessages":{"contactUs":"<div class=\"ib\">If the problem persists, please contact us at</div><div class=\"im-contact-info\"><div clas
2024-04-25 16:57:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:57 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 16:57:57 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=137138 Date: Thu, 25 Apr 2024 16:57:57 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 16:57:57 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49728	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:57 UTC	689	OUT	GET /websurvey/css/webfonts/calibri-webfont.woff HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://feedback.inmoment.eu sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:58 UTC	501	IN	HTTP/1.1 200 OK x-request-id: a353ee30-5e65-46a4-a49d-e39ed6c27467 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"37720-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: application/x-font-woff content-length: 37720 date: Thu, 25 Apr 2024 16:57:57 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:58 UTC	15883	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 93 58 00 13 00 00 00 01 37 90 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 46 54 4d 00 00 01 a8 00 00 00 1c 00 00 00 1c 57 38 1d 42 47 44 45 46 00 00 01 c4 00 00 00 27 00 00 00 2e 01 fa 01 1a 47 50 4f 53 00 00 01 ec 00 00 12 51 00 00 49 0c a4 ce db 64 47 53 55 42 00 00 14 40 00 00 01 8f 00 00 03 58 f1 f9 26 da 4f 53 2f 32 00 00 15 d0 00 00 00 5f 00 00 00 60 f8 1d b3 98 63 6d 61 70 00 00 16 30 00 00 02 2b 00 00 02 a2 ea b2 48 c7 63 76 74 20 00 00 18 5c 00 00 00 4e 00 00 00 4e 14 52 0f 6a 66 70 67 6d 00 00 18 ac 00 00 01 b1 00 00 02 65 53 b4 2f a7 67 61 73 70 00 00 1a 60 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 1a 68 00 00 6e 0d 00 00 d0 2c be 44 9f 6d 68 65 61 64 00 00 88 78 00 00 00 Data Ascii: wOFFX7FFTMW8BGDEF'.GPOSQIdGSUB@X&OS/2_`cmap0+Hcvt \NNRjfpgmeS/gasp`glyfhn,Dmheadx
2024-04-25 16:57:58 UTC	16384	IN	Data Raw: 2f 3f 96 3b d5 51 38 9e c7 6f d1 f3 a8 a2 9a d6 91 a4 c9 b6 14 2d 2f af 73 fc 1f 88 ff 6d 47 73 ec 00 7c f1 1c e8 c9 04 e6 ab ea 20 2f 98 10 89 a8 14 b0 20 57 49 f3 8a 80 77 39 2d 45 b3 52 47 94 b1 55 ea 66 f1 60 65 27 01 c2 17 1d a4 5e 32 11 33 4b 45 3d 8f 24 85 d7 13 df 71 fb 29 bd c8 2f bd 4a dc 26 4a 1a de a0 5c 81 fe 3a 93 cd e9 b7 92 2f 72 a2 5b 42 be a8 3f 10 13 9c 2e 9f e5 ca 8e 50 0c 55 d7 05 34 fd f8 d5 f2 05 c2 4d df 8a f9 01 a5 03 d8 51 45 53 09 95 b5 31 a6 e5 68 96 28 95 00 f4 22 73 87 8a a2 50 41 64 50 1b ac 5d 5c d1 dc a8 9a 23 bb 5c f4 96 22 be 6a 90 6c 46 1c 63 40 55 98 f9 4f 7c a2 72 bd 8a 19 6d 92 01 a0 8e ec 16 59 40 73 62 c0 f3 76 27 63 b6 8b 41 37 2b b8 61 2c 86 f2 af 48 2b fd 86 56 af b6 ac d6 6c b5 c0 2d 6e 10 82 6e 40 f2 3a 92 d8 Data Ascii: /?;Q8o-/smGs\| / WIw9-ERGUf`e'^23KE=$q)/J&J\:/r[B?.PU4MQES1h("sPAdP]\#\"jlFc@UO\|rmY@sbv'cA7+a,H+Vl-nn@:
2024-04-25 16:57:58 UTC	119	IN	Data Raw: b0 f1 6b fe 38 19 31 a6 1c d3 27 27 5a bf 67 4c d9 e0 a7 dc e4 6e 22 ff fe d4 7f bf 38 ad 50 3c a2 55 19 2d 2f 3b 17 4f 9e 1f 05 e7 51 2a 1e d3 29 8d 96 ff d6 bc f7 e4 67 a7 17 be 18 17 9d 91 ca d2 07 2f ae ef 96 4b 53 07 2f ee 0c ce 4d f5 35 71 6b bd c7 b1 c6 f9 dd 38 3e 9b 82 3d d3 58 51 c1 5e 8f e2 32 ac b7 84 62 35 6e 41 31 cd 55 54 69 20 16 63 4d a0 Data Ascii: k81''ZgLn"8P<U-/;OQ*)g/KS/M5qk8>=XQ^2b5nA1UTi cM
2024-04-25 16:57:58 UTC	5334	IN	Data Raw: d3 ac c1 32 8e 61 06 9f 3b cc f0 65 56 69 84 1a b3 1a eb 1a 04 88 d8 96 70 51 bc 50 aa 2f 56 8e 6d a8 c0 aa 23 66 26 14 2c 3c 2e 69 4c e1 ec 3e c1 88 81 7a ed ea 5f 6d 47 f9 4c dc 2b 10 3d 50 9c de 1b c2 2d 81 71 3b 28 a8 f9 b6 92 e4 71 db 4a f8 6d a6 28 fc b6 1a 4d f5 4e 00 62 a0 fe c6 da 06 b2 d7 a9 ff 26 10 58 34 28 09 f7 fa 26 d1 c5 b6 94 e2 44 5f 16 08 35 28 e2 62 85 9f ed 06 fe c9 cd fd 6c 71 6b 3f 5b e2 97 ac 29 28 0e 02 4f eb 9d 58 e0 3d 8d b5 8f 66 af db d7 b6 08 46 2e 6a 1a 83 f0 6c dd 88 64 bb fe 47 f5 6f 19 9d 40 7c f2 08 c6 d6 85 b1 1d 20 66 88 3f d9 88 2e 50 6d 41 ed 6b 1f 9a 2c a7 12 55 60 e7 78 b0 57 53 6a 52 86 e9 33 2a 60 5f 1d 6f 31 c9 70 e5 2b 1c f0 8f 5b 2a ed 30 5b e4 88 60 63 7a 6c 07 76 64 2a 8b 8c 00 9c 59 76 7f 85 11 d8 4c 1f 3e Data Ascii: 2a;eVipQP/Vm#f&,<.iL>z_mGL+=P-q;(qJm(MNb&X4(&D_5(blqk?[)(OX=fF.jldGo@\| f?.PmAk,U`xWSjR3`_o1p+[0[`czlvd*YvL>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49727	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:57 UTC	690	OUT	GET /websurvey/css/webfonts/calibrib-webfont.woff HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://feedback.inmoment.eu sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:58 UTC	501	IN	HTTP/1.1 200 OK x-request-id: 70406693-4c07-47aa-b385-6d0b0d672b5a x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"37880-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: application/x-font-woff content-length: 37880 date: Thu, 25 Apr 2024 16:57:57 GMT server: websurvey x-envoy-upstream-service-time: 2 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:58 UTC	15883	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 93 f8 00 13 00 00 00 01 35 c4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 46 46 54 4d 00 00 01 a8 00 00 00 1c 00 00 00 1c 57 38 1d 43 47 44 45 46 00 00 01 c4 00 00 00 27 00 00 00 2e 01 fa 01 1a 47 50 4f 53 00 00 01 ec 00 00 11 8f 00 00 42 e6 db a6 a4 2e 47 53 55 42 00 00 13 7c 00 00 01 8f 00 00 03 58 f1 f9 26 da 4f 53 2f 32 00 00 15 0c 00 00 00 5f 00 00 00 60 fa a8 b5 da 63 6d 61 70 00 00 15 6c 00 00 02 2b 00 00 02 a2 ea b2 48 c7 63 76 74 20 00 00 17 98 00 00 00 52 00 00 00 52 19 be 12 b2 66 70 67 6d 00 00 17 ec 00 00 01 b1 00 00 02 65 53 b4 2f a7 67 61 73 70 00 00 19 a0 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 19 a8 00 00 6f ad 00 00 d5 30 5c e7 fb 7a 68 65 61 64 00 00 89 58 00 00 00 Data Ascii: wOFF5FFTMW8CGDEF'.GPOSB.GSUB\|X&OS/2_`cmapl+Hcvt RRfpgmeS/gaspglyfo0\zheadX
2024-04-25 16:57:58 UTC	16384	IN	Data Raw: de c7 da bc 3c 5e d5 99 f4 94 85 7f fa 69 f5 da fa 16 ef b5 b1 2d 4d c9 1e b4 eb d1 79 97 72 e2 b5 27 74 42 d8 5d 4a 32 b6 a0 b2 2e 5f eb 47 e4 51 fa 0b 6a 4d 5b 47 7a f9 db c9 92 04 0e 77 a5 6c b2 e8 65 29 62 bd ae 33 a6 97 3f 49 3f ee 37 d1 94 ce 6c 78 f5 31 57 40 1d 69 8e a3 bf b7 b5 f5 31 bc d5 81 d3 27 ca 34 c0 a9 6b 57 4f 2b 70 82 97 da 06 f0 6a 70 6a 14 38 d5 f2 af cb 63 2a 0a 55 b6 d2 7a a3 ee 9d ef e4 51 90 5c 87 d7 00 3e a3 11 20 6f 7d 93 b7 fc a7 3b 2c e8 e8 5b 12 65 77 18 41 1b b4 bf fa b7 42 d0 c6 a8 fb 3a 84 5f 24 ff 9e 76 82 ce e4 31 25 0a 8e f4 64 5b 41 5a d6 04 ba 57 40 27 b5 8a 60 8a fb 35 46 3c a8 71 a6 ba 93 c9 9e a4 53 83 c7 8c 1a 7b 39 9b 28 87 78 fa c7 f4 f7 69 3e 58 4e 64 8b 84 10 f6 12 6f 31 5a 8d 5a 74 fa 69 f9 98 37 6c 51 59 c6 Data Ascii: <^i-Myr'tB]J2._GQjM[Gzwle)b3?I?7lx1W@i1'4kWO+pjpj8c*UzQ\> o};,[ewAB:_$v1%d[AZW@'`5F<qS{9(xi>XNdo1ZZti7lQY
2024-04-25 16:57:58 UTC	119	IN	Data Raw: 44 73 5e 6d f3 7b d1 98 23 60 56 2a cd 01 87 83 e5 f0 dc 78 29 36 d8 43 d3 3d 83 b1 48 de 4f d3 fe bc d8 1f 1d ec d1 eb 7b 06 a3 d1 1c dc c8 e1 f8 63 fa d6 6e 89 41 72 37 6a 6d 96 d8 01 bb 16 76 f0 8d 3c 5a 2b db 71 fe a7 dd 5b bf 13 44 f5 d5 54 fa 26 79 f1 46 08 2f 46 38 e9 55 48 a1 8e 42 f0 e7 0d 40 c8 a7 7f 4b 6e 77 52 c9 7e 18 d1 4c 2c 35 5e 1e 54 a7 Data Ascii: Ds^m{#`V*x)6C=HO{cnAr7jmv<Z+q[DT&yF/F8UHB@KnwR~L,5^T
2024-04-25 16:57:58 UTC	5494	IN	Data Raw: 02 98 be 81 30 25 76 b0 f9 a0 1c 57 1e 9f 0d 0a 29 38 8d c9 a0 c0 9a 38 8a f9 e4 cd 16 63 53 2e 68 52 14 9a 1e be f8 ed 4f 78 c7 5c a3 f2 44 62 28 a0 de c3 ec 4c 98 47 2e 7e fb 62 70 d4 31 21 eb 8d 0f f5 a8 f7 a1 4b a6 7f b0 79 de d7 f8 0d 43 87 87 5c ff 41 e3 a7 87 8e 0c b9 a4 1a 33 4d fe f8 dc 77 3e 33 2b 93 7d 5a a7 35 db 7e d7 b5 ff 9e 47 a7 c0 6d e4 b2 cf d2 1a 8b b5 ec 3a 70 cf a3 b3 83 bf 11 10 29 24 54 7c cf 23 1b 8f 51 54 6c e5 e1 a5 ee 5c 7f d2 88 31 c4 7a 7f 68 0e 48 a1 18 6e 06 fa 97 a0 e6 5f 39 0d 3f 77 30 95 1c 37 33 ce b6 95 00 9c e3 73 01 b3 39 84 66 97 be 9c 1c 83 50 fa 5f 26 07 28 18 5f 74 a8 11 a8 12 8e 32 b6 27 1d 28 7a 43 20 e2 68 c5 f1 fe 2d 71 9c 62 2a 43 db c2 11 a4 14 cb c9 cc 14 2c 45 a2 c0 3d 55 f4 18 4a f6 d1 fc ed a2 d8 1a 7d Data Ascii: 0%vW)88cS.hROx\Db(LG.~bp1!KyC\A3Mw>3+}Z5~Gm:p)$T\|#QTl\1zhHn_9?w073s9fP_&(_t2'(zC h-qb*C,E=UJ}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49731	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:58 UTC	692	OUT	GET /websurvey/2/views/errors.html HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / x-session-token: bd479d89-973f-4ead-86a2-90f42772e6f5 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:58 UTC	444	IN	HTTP/1.1 200 OK x-request-id: fdb62ae2-4d04-49ff-adeb-d96988744ed3 x-content-type-options: nosniff x-xss-protection: 1; mode=block last-modified: Tue, 23 Apr 2024 11:12:00 GMT accept-ranges: bytes vary: accept-encoding content-type: text/html content-length: 1707 date: Thu, 25 Apr 2024 16:57:58 GMT server: websurvey x-envoy-upstream-service-time: 4 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:58 UTC	1707	IN	Data Raw: 3c 64 69 76 20 6d 73 2d 6d 61 69 6e 2d 69 6d 61 67 65 3d 22 6c 6f 67 6f 2e 75 72 6c 22 2f 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 6d 70 74 41 72 65 61 20 65 72 72 6f 72 41 72 65 61 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 49 6d 61 67 65 22 20 6e 67 2d 63 6c 61 73 73 3d 22 7b 27 65 78 70 69 72 65 64 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 35 31 30 2c 20 27 74 61 6b 65 6e 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 35 30 38 2c 20 20 27 74 61 6b 65 6e 32 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 34 32 31 2c 20 27 63 6f 6f 6b 69 65 44 69 73 61 62 6c 65 64 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 34 31 32 2c 20 27 74 69 6d 65 6f 75 74 27 3a 65 72 72 6f 72 Data Ascii: <div ms-main-image="logo.url"/><div class="promptArea errorArea"><div class="errorImage" ng-class="{'expired':errorStatusCode==510, 'taken':errorStatusCode==508, 'taken2':errorStatusCode==421, 'cookieDisabled':errorStatusCode==412, 'timeout':error

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49732	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:58 UTC	388	OUT	GET /websurvey/image/powered-by-inmoment-gray.svg HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:58 UTC	512	IN	HTTP/1.1 200 OK x-request-id: 4c0bd2e7-5a30-4257-b1e8-204ed5e7c23a x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"4534-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/svg+xml content-length: 4534 date: Thu, 25 Apr 2024 16:57:58 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id vary: Accept-Encoding connection: close
2024-04-25 16:57:58 UTC	4534	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 36 32 2e 30 31 20 38 39 22 20 78 6d 6c 6e 73 3a 76 3d 22 68 74 74 70 73 3a 2f 2f 76 65 63 74 61 2e 69 6f 2f 6e 61 6e 6f 22 3e 3c 70 61 74 68 20 64 3d 22 4d 33 35 36 2e 31 36 20 30 68 2d 31 33 2e 34 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 2d 31 2e 31 38 20 31 2e 31 38 76 31 33 2e 34 31 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 31 2e 31 38 20 31 2e 31 38 68 31 33 2e 34 61 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 31 2e 31 38 2d 31 2e 31 38 56 31 2e 31 38 41 31 2e 31 38 20 31 2e 31 38 20 30 20 30 20 30 20 33 35 36 2e 31 36 20 30 7a 6d 30 20 33 31 2e 35 34 68 2d 31 33 2e 33 33 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 762.01 89" xmlns:v="https://vecta.io/nano"><path d="M356.16 0h-13.4a1.18 1.18 0 0 0-1.18 1.18v13.41a1.18 1.18 0 0 0 1.18 1.18h13.4a1.18 1.18 0 0 0 1.18-1.18V1.18A1.18 1.18 0 0 0 356.16 0zm0 31.54h-13.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:58 UTC	368	OUT	GET /websurvey/image/info.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:58 UTC	485	IN	HTTP/1.1 200 OK x-request-id: 55f8edd8-f4be-402a-9dac-498be7d42df7 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"1142-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 1142 date: Thu, 25 Apr 2024 16:57:58 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:58 UTC	1142	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2d 00 00 00 2d 08 04 00 00 00 90 13 2a 11 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 03 91 49 44 41 54 48 c7 b5 97 4f 68 1c 55 1c c7 3f f3 b2 53 48 3a 17 ed 41 94 06 91 a9 25 a7 80 42 30 07 f5 92 fe 50 4a 20 81 92 a0 0d 48 10 9a 40 db 0d 5e ea 2d 84 90 a3 87 42 8d d0 c6 8b 0a ae 18 11 0c 84 5c 5e 73 31 39 28 0b 11 72 89 d6 6c f6 e0 a9 e0 82 87 4d ab 4e dd f5 b0 6f de ce ce ce cc 26 bb ed ef 32 ef ef 67 be ef 37 ef fd e6 f7 1c 4e 60 e2 e0 e2 a2 70 a8 53 23 20 d0 f5 ce b3 9c 0e c8 37 99 60 8c 61 54 4b 47 8d 7d b6 d9 60 Data Ascii: PNGIHDR--*gAMAa cHRMz&u0`:pQ<bKGDIDATHOhU?SH:A%B0PJ H@^-B\^s19(rlMNo&2g7N`pS# 7`aTKG}`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49733	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:58 UTC	371	OUT	GET /websurvey/image/spinner.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:59 UTC	485	IN	HTTP/1.1 200 OK x-request-id: 1a9e04dc-8a99-4014-bc4a-7af13d17cb57 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"1080-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 1080 date: Thu, 25 Apr 2024 16:57:57 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:59 UTC	1080	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 10 00 00 00 10 08 00 00 00 00 3a 98 a0 bd 00 00 00 08 61 63 54 4c 00 00 00 08 00 00 00 00 b9 3d 8b d1 00 00 00 02 74 52 4e 53 00 00 76 93 cd 38 00 00 00 1a 66 63 54 4c 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 00 00 00 0a 00 64 00 00 56 df 18 1e 00 00 00 50 49 44 41 54 18 d3 6d cc d1 11 c0 20 08 03 50 76 72 16 66 e9 2c 99 c5 15 18 aa 4a 50 d3 ab f9 e1 f2 38 30 63 5a b3 6f 14 22 16 b8 17 04 c1 0b 28 d2 87 70 b8 5d 13 75 30 f3 8c fc e1 7e c6 01 79 93 1d 90 de fb 91 dc 4f 30 e0 bc 49 d0 6c 78 01 31 1e 28 3f 47 0d ca db 00 00 00 1a 66 63 54 4c 00 00 00 01 00 00 00 0e 00 00 00 10 00 00 00 02 00 00 00 00 00 0a 00 64 00 01 65 f8 56 01 00 00 00 48 66 64 41 54 00 00 00 02 18 d3 7d cb 5b 0d 00 20 Data Ascii: PNGIHDR:acTL=tRNSv8fcTLdVPIDATm Pvrf,JP80cZo"(p]u0~yO0Ilx1(?GfcTLdeVHfdAT}[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:58 UTC	671	OUT	GET /websurvey/image/faviconV2.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:57:59 UTC	483	IN	HTTP/1.1 200 OK x-request-id: 7955b692-15f5-445c-9f82-eceaf12c13dc x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"276-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 276 date: Thu, 25 Apr 2024 16:57:59 GMT server: websurvey x-envoy-upstream-service-time: 1 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:57:59 UTC	276	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 4b 50 4c 54 45 00 00 00 00 55 ff 00 5b ff 00 5a ff 00 5a ff 00 5a ff 00 58 ff 00 56 ff 00 56 ff 00 59 ff 00 59 ff 00 57 ff 00 58 ff 00 57 ff 00 59 ff 00 58 ff 00 58 ff 00 59 ff 00 57 ff 00 58 ff 00 58 ff 00 58 ff 00 58 ff 00 58 ff ff ff ff b6 f5 1c b9 00 00 00 17 74 52 4e 53 00 09 0e 22 33 36 37 3b 3e 4d 53 55 66 69 81 82 88 aa b2 c5 ca cc dd 50 fc 49 38 00 00 00 01 62 4b 47 44 18 9b 69 85 1e 00 00 00 54 49 44 41 54 28 cf 63 60 a0 0c b0 89 8a 8a b2 62 93 e0 14 17 17 e7 24 4e 82 89 07 0c f8 30 8c 62 11 07 03 51 0c 33 08 49 88 60 95 e0 65 66 66 17 13 13 e3 c0 90 e0 84 53 43 57 82 91 8b 9b 9b 5f 50 50 18 6b b0 0b 41 82 85 04 09 01 51 30 60 25 37 5d 00 Data Ascii: PNGIHDRKPLTEU[ZZZXVVYYWXWYXXYWXXXXXtRNS"367;>MSUfiPI8bKGDiTIDAT(c`b$N0bQ3I`effSCW_PPkAQ0`%7]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:59 UTC	707	OUT	GET /websurvey/2/app/img/taken_icon.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:58:00 UTC	477	IN	HTTP/1.1 200 OK x-request-id: 0c57722a-8b9a-4263-9108-789742f440af x-content-type-options: nosniff x-xss-protection: 1; mode=block last-modified: Tue, 23 Apr 2024 11:11:58 GMT accept-ranges: bytes x-session-token: 89f59222-6e07-40c3-82d1-f49df5bebefb content-type: image/png content-length: 3683 date: Thu, 25 Apr 2024 16:57:59 GMT server: websurvey x-envoy-upstream-service-time: 16 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:58:00 UTC	3683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 3b 00 00 00 ec 08 06 00 00 00 0b 90 01 e4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 0d f8 49 44 41 54 78 5e ed dd 79 88 55 65 18 80 f1 d7 09 35 4d db d4 a4 48 d4 34 b4 74 b4 72 14 ca 16 08 83 c0 4a 2a a2 3f cc 40 c2 8c c2 c8 ca c1 2c 1d 73 6c 91 4a c9 34 6d c1 a8 a4 a0 28 26 ca 28 a2 08 b2 a2 74 5c b3 29 cb 05 34 6d 45 2b 97 22 6d 79 3f cf 67 d3 34 73 e7 9c bb 8c f7 fb de e7 07 71 df 73 4d c7 39 77 ce e3 39 77 39 a7 dd 5f ff 10 00 88 5c 45 72 0b 00 51 23 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 Data Ascii: PNGIHDR;sRGBgAMAapHYs+IDATx^yUe5MH4trJ*?@,slJ4m(&(t\)4mE+"my?g4sqsM9w9w9_\ErQ#vL vL vL vL vL vL vL vL vL vL vL v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49736	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:59 UTC	681	OUT	GET /websurvey/css/webfonts/icomoon.woff HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://feedback.inmoment.eu sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:58:00 UTC	499	IN	HTTP/1.1 200 OK x-request-id: bfc721d9-981f-4fc3-be45-cf06930262b8 x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"9584-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: application/x-font-woff content-length: 9584 date: Thu, 25 Apr 2024 16:57:59 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:58:00 UTC	9584	IN	Data Raw: 77 4f 46 46 4f 54 54 4f 00 00 25 70 00 0a 00 00 00 00 25 28 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 46 46 20 00 00 00 f4 00 00 1f ed 00 00 1f ed bf f8 24 8d 4f 53 2f 32 00 00 20 e4 00 00 00 60 00 00 00 60 08 23 03 4f 63 6d 61 70 00 00 21 44 00 00 01 74 00 00 01 74 65 1d 62 b2 67 61 73 70 00 00 22 b8 00 00 00 08 00 00 00 08 00 00 00 10 68 65 61 64 00 00 22 c0 00 00 00 36 00 00 00 36 ff b1 23 96 68 68 65 61 00 00 22 f8 00 00 00 24 00 00 00 24 04 07 02 42 68 6d 74 78 00 00 23 1c 00 00 00 f0 00 00 00 f0 68 4e 06 b4 6d 61 78 70 00 00 24 0c 00 00 00 06 00 00 00 06 00 3c 50 00 6e 61 6d 65 00 00 24 14 00 00 01 39 00 00 01 39 44 18 b4 d6 70 6f 73 74 00 00 25 50 00 00 00 20 00 00 00 20 00 03 00 00 01 00 04 04 00 01 01 01 08 69 63 Data Ascii: wOFFOTTO%p%(CFF $OS/2 ``#Ocmap!Dttebgasp"head"66#hhea"$$Bhmtx#hNmaxp$<Pname$99Dpost%P ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49738	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:57:59 UTC	373	OUT	GET /websurvey/2/views/errors.html HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:58:00 UTC	500	IN	HTTP/1.1 200 OK x-request-id: b051d7ef-ace6-4e67-aae2-648ef2c2a5d9 x-content-type-options: nosniff x-xss-protection: 1; mode=block last-modified: Tue, 23 Apr 2024 11:12:00 GMT accept-ranges: bytes x-session-token: a039e7de-c315-4227-adf9-cd78e47b3f1b vary: accept-encoding content-type: text/html content-length: 1707 date: Thu, 25 Apr 2024 16:57:59 GMT server: websurvey x-envoy-upstream-service-time: 11 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:58:00 UTC	1707	IN	Data Raw: 3c 64 69 76 20 6d 73 2d 6d 61 69 6e 2d 69 6d 61 67 65 3d 22 6c 6f 67 6f 2e 75 72 6c 22 2f 3e 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 6d 70 74 41 72 65 61 20 65 72 72 6f 72 41 72 65 61 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 49 6d 61 67 65 22 20 6e 67 2d 63 6c 61 73 73 3d 22 7b 27 65 78 70 69 72 65 64 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 35 31 30 2c 20 27 74 61 6b 65 6e 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 35 30 38 2c 20 20 27 74 61 6b 65 6e 32 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 34 32 31 2c 20 27 63 6f 6f 6b 69 65 44 69 73 61 62 6c 65 64 27 3a 65 72 72 6f 72 53 74 61 74 75 73 43 6f 64 65 3d 3d 34 31 32 2c 20 27 74 69 6d 65 6f 75 74 27 3a 65 72 72 6f 72 Data Ascii: <div ms-main-image="logo.url"/><div class="promptArea errorArea"><div class="errorImage" ng-class="{'expired':errorStatusCode==510, 'taken':errorStatusCode==508, 'taken2':errorStatusCode==421, 'cookieDisabled':errorStatusCode==412, 'timeout':error

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49740	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:58:00 UTC	373	OUT	GET /websurvey/image/faviconV2.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:58:01 UTC	483	IN	HTTP/1.1 200 OK x-request-id: f893f4de-3af9-4bda-945f-3ce7cfb0939d x-content-type-options: nosniff x-xss-protection: 1; mode=block cache-control: max-age=315360000 accept-ranges: bytes etag: W/"276-1713870720000" last-modified: Tue, 23 Apr 2024 11:12:00 GMT content-type: image/png content-length: 276 date: Thu, 25 Apr 2024 16:58:01 GMT server: websurvey x-envoy-upstream-service-time: 0 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:58:01 UTC	276	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 03 00 00 00 d7 a9 cd ca 00 00 00 4b 50 4c 54 45 00 00 00 00 55 ff 00 5b ff 00 5a ff 00 5a ff 00 5a ff 00 58 ff 00 56 ff 00 56 ff 00 59 ff 00 59 ff 00 57 ff 00 58 ff 00 57 ff 00 59 ff 00 58 ff 00 58 ff 00 59 ff 00 57 ff 00 58 ff 00 58 ff 00 58 ff 00 58 ff 00 58 ff ff ff ff b6 f5 1c b9 00 00 00 17 74 52 4e 53 00 09 0e 22 33 36 37 3b 3e 4d 53 55 66 69 81 82 88 aa b2 c5 ca cc dd 50 fc 49 38 00 00 00 01 62 4b 47 44 18 9b 69 85 1e 00 00 00 54 49 44 41 54 28 cf 63 60 a0 0c b0 89 8a 8a b2 62 93 e0 14 17 17 e7 24 4e 82 89 07 0c f8 30 8c 62 11 07 03 51 0c 33 08 49 88 60 95 e0 65 66 66 17 13 13 e3 c0 90 e0 84 53 43 57 82 91 8b 9b 9b 5f 50 50 18 6b b0 0b 41 82 85 04 09 01 51 30 60 25 37 5d 00 Data Ascii: PNGIHDRKPLTEU[ZZZXVVYYWXWYXXYWXXXXXtRNS"367;>MSUfiPI8bKGDiTIDAT(c`b$N0bQ3I`effSCW_PPkAQ0`%7]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49743	35.158.27.166	443	6772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:58:00 UTC	378	OUT	GET /websurvey/2/app/img/taken_icon.png HTTP/1.1 Host: feedback.inmoment.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 16:58:01 UTC	477	IN	HTTP/1.1 200 OK x-request-id: 9b5b7b2d-7779-4dfe-a56b-b6d259840e32 x-content-type-options: nosniff x-xss-protection: 1; mode=block last-modified: Tue, 23 Apr 2024 11:11:58 GMT accept-ranges: bytes x-session-token: a54eec34-16bf-4a32-a75d-e097bbb5a44a content-type: image/png content-length: 3683 date: Thu, 25 Apr 2024 16:58:00 GMT server: websurvey x-envoy-upstream-service-time: 16 access-control-expose-headers: x-request-id,x-page-load-id connection: close
2024-04-25 16:58:01 UTC	3683	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 3b 00 00 00 ec 08 06 00 00 00 0b 90 01 e4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 0d f8 49 44 41 54 78 5e ed dd 79 88 55 65 18 80 f1 d7 09 35 4d db d4 a4 48 d4 34 b4 74 b4 72 14 ca 16 08 83 c0 4a 2a a2 3f cc 40 c2 8c c2 c8 ca c1 2c 1d 73 6c 91 4a c9 34 6d c1 a8 a4 a0 28 26 ca 28 a2 08 b2 a2 74 5c b3 29 cb 05 34 6d 45 2b 97 22 6d 79 3f cf 67 d3 34 73 e7 9c bb 8c f7 fb de e7 07 71 df 73 4d c7 39 77 ce e3 39 77 39 a7 dd 5f ff 10 00 88 5c 45 72 0b 00 51 23 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 00 4c 20 76 Data Ascii: PNGIHDR;sRGBgAMAapHYs+IDATx^yUe5MH4trJ*?@,slJ4m(&(t\)4mE+"my?g4sqsM9w9w9_\ErQ#vL vL vL vL vL vL vL vL vL vL vL v

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49750	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 16:58:08 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714064256051&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-25 16:58:08 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-25 16:58:08 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-25 16:58:08 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2907C72796DF4BA29D48226F96ED9F14 Ref B: LAX311000113051 Ref C: 2024-04-25T16:58:08Z Date: Thu, 25 Apr 2024 16:58:08 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714064288.c09d724

Target ID:	0
Start time:	18:57:45
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:57:49
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=1988,i,17382038956107092195,18040501313747568172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:57:51
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5 HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/css/third-party.min.css HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5 HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/jslib/third-party.min.js?v=1269 HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/jslib/appDirectives.min.js?v=1269 HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/remove.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/close-white.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/powered-by-inmoment-gray.svg HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/remove.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/close-white.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/info.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/spinner.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /websurvey/css/webfonts/calibri-webfont.woff HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://feedback.inmoment.eusec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/css/webfonts/calibrib-webfont.woff HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://feedback.inmoment.eusec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/views/errors.html HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /x-session-token: bd479d89-973f-4ead-86a2-90f42772e6f5sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/powered-by-inmoment-gray.svg HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/info.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/spinner.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/faviconV2.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/error?_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/app/img/taken_icon.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/css/webfonts/icomoon.woff HTTP/1.1Host: feedback.inmoment.euConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://feedback.inmoment.eusec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://feedback.inmoment.eu/websurvey/2/retrieveCss.css?themeId=null&s;=null&_s=bd479d89-973f-4ead-86a2-90f42772e6f5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/views/errors.html HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/image/faviconV2.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websurvey/2/app/img/taken_icon.png HTTP/1.1Host: feedback.inmoment.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: feedback.inmoment.eu
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Windows Analysis Report
https://feedback.inmoment.eu/websurvey/2/begin?gateway=Noram_SDX_B2B&ukey=6b720cff-f010-4539-979e-11d939ba962e