Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

Overview

General Information

Sample URL:	https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483
Analysis ID:	1431946
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML title does not match URL

Suspicious form URL found

Classification

×

Process Tree

System is w10x64

chrome.exe (PID: 332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2020,i,2194234812516978810,3701196606030679472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

HTTP Parser: Title: MailWizz does not match URL

Source: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

HTTP Parser: Form action: /index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

Source: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

HTTP Parser: No favicon

Source: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

HTTP Parser: No <meta name="author".. found

Source: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.197.180.115:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.180.115:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.197.180.115
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.128
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.128
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.128
Source: unknown	TCP traffic detected without corresponding DNS query: 208.111.136.128
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/bootstrap.min.css?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/adminlte.css?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/css/style.css?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/css/skin-blue.css?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/cache/591dbfd1/jquery.min.js HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/bootstrap.min.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css?av=9ec570bf HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/ionicons/2.0.1/css/ionicons.min.css?av=9ec570bf HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://qhs-rx.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/knockout.min.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/notify.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/adminlte.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/cookie.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /assets/js/app.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /frontend/assets/js/app.js?av=9ec570bf HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: qhs-rx.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: qhs-rx.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B

Source: global traffic	DNS traffic detected: DNS query: qhs-rx.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: chromecache_71.2.dr	String found in binary or memory: http://almsaeedstudio.com
Source: chromecache_69.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: chromecache_60.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_60.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_61.2.dr, chromecache_77.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_69.2.dr	String found in binary or memory: http://ionicons.com/
Source: chromecache_59.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_71.2.dr, chromecache_74.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_74.2.dr	String found in binary or memory: http://www.almsaeedstudio.com
Source: chromecache_59.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_59.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_71.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:300
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-mPCLQ7A.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-oPCI.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AUi-qJCY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHh30AXC-q.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAUi-qJCY.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwaPGR_p.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwaPGR_p.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_FQft1dw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI3wi_Gwft.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_FQft1dw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI5wq_Gwft.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_Gwft.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
Source: chromecache_64.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
Source: chromecache_78.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_78.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_78.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_78.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_78.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_67.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfABc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCBc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCRc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfChc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_75.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_69.2.dr	String found in binary or memory: https://github.com/driftyco/ionicons
Source: chromecache_69.2.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: chromecache_70.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_71.2.dr	String found in binary or memory: https://github.com/lipis/bootstrap-social
Source: chromecache_61.2.dr, chromecache_77.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_69.2.dr	String found in binary or memory: https://twitter.com/benjsperry
Source: chromecache_69.2.dr	String found in binary or memory: https://twitter.com/ionicframework
Source: chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	String found in binary or memory: https://www.mailwizz.com)
Source: chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	String found in binary or memory: https://www.mailwizz.com/
Source: chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	String found in binary or memory: https://www.mailwizz.com/license/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 23.197.180.115:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.180.115:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/45@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2020,i,2194234812516978810,3701196606030679472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2020,i,2194234812516978810,3701196606030679472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483	3%	Virustotal		Browse
https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://qhs-rx.com/frontend/assets/cache/591dbfd1/jquery.min.js	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/notify.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/knockout.min.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/css/adminlte.css?av=9ec570bf	0%	Avira URL Cloud	safe
https://www.mailwizz.com)	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/css/skin-blue.css?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/cookie.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/frontend/assets/css/style.css?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/app.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/bootstrap.min.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/js/adminlte.js?av=9ec570bf	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://www.almsaeedstudio.com	0%	Avira URL Cloud	safe
https://qhs-rx.com/assets/css/bootstrap.min.css?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/frontend/assets/js/app.js?av=9ec570bf	0%	Avira URL Cloud	safe
https://qhs-rx.com/favicon.ico	0%	Avira URL Cloud	safe
http://almsaeedstudio.com	0%	Avira URL Cloud	safe
http://www.almsaeedstudio.com	0%	Virustotal		Browse
http://almsaeedstudio.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdnjs.cloudflare.com	104.17.25.14	true	false		high
www.google.com	172.217.15.196	true	false		high
qhs-rx.com	69.64.48.35	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://qhs-rx.com/assets/js/knockout.min.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483	false		unknown
https://qhs-rx.com/assets/js/notify.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/frontend/assets/cache/591dbfd1/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/css/adminlte.css?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/css/skin-blue.css?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/js/cookie.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/frontend/assets/css/style.css?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/js/app.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/js/bootstrap.min.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css?av=9ec570bf	false		high
https://qhs-rx.com/assets/js/adminlte.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/frontend/assets/js/app.js?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://qhs-rx.com/assets/css/bootstrap.min.css?av=9ec570bf	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css?av=9ec570bf	false		high
https://qhs-rx.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/lipis/bootstrap-social	chromecache_71.2.dr	false		high
http://fontawesome.io	chromecache_60.2.dr	false		high
https://github.com/google/material-design-icons	chromecache_69.2.dr	false		high
https://www.mailwizz.com/	chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	false		high
https://www.mailwizz.com/license/	chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	false		high
https://twitter.com/benjsperry	chromecache_69.2.dr	false		high
https://www.mailwizz.com)	chromecache_56.2.dr, chromecache_76.2.dr, chromecache_68.2.dr	false	Avira URL Cloud: safe	low
http://knockoutjs.com/	chromecache_59.2.dr	false		high
http://opensource.org/licenses/MIT	chromecache_71.2.dr, chromecache_74.2.dr	false		high
http://ionicons.com/	chromecache_69.2.dr	false		high
http://www.json.org/json2.js	chromecache_59.2.dr	false		high
https://github.com/driftyco/ionicons	chromecache_69.2.dr	false		high
https://twitter.com/ionicframework	chromecache_69.2.dr	false		high
http://fontawesome.io/license	chromecache_60.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_59.2.dr	false		high
http://getbootstrap.com)	chromecache_61.2.dr, chromecache_77.2.dr	false	Avira URL Cloud: safe	low
http://www.almsaeedstudio.com	chromecache_74.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_61.2.dr, chromecache_77.2.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_70.2.dr	false		high
http://creativecommons.org/licenses/by/4.0/	chromecache_69.2.dr	false		high
http://almsaeedstudio.com	chromecache_71.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.217.15.196	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
69.64.48.35	qhs-rx.com	United States		30083	AS-30083-GO-DADDY-COM-LLCUS	false
104.17.25.14	cdnjs.cloudflare.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431946
Start date and time:	2024-04-26 03:28:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/45@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.165.195, 173.194.216.84, 192.178.50.78, 34.104.35.123, 142.250.217.234, 142.250.217.163, 192.178.50.42, 142.250.217.170, 142.250.64.170, 142.250.217.202, 142.250.64.202, 192.178.50.74, 142.250.64.138, 172.217.165.202, 142.250.189.138, 172.217.3.74, 20.12.23.50, 72.21.81.240, 20.166.126.56, 192.229.211.108, 20.3.187.198, 142.251.35.227
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, fonts.gstatic.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 56

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5598
Entropy (8bit):	5.045758621960802
Encrypted:	false
SSDEEP:	96:R6FligI/LYTDs9jxTJ9bptJxplNJZT76r3yJ37E/9+OSIE:ROEgEnxtxTODQOk
MD5:	7EA0D3C764C478BBC3C9AE6D0B001CAD
SHA1:	19BA17B7FD02563B89F03FF6F1D8576539FF1392
SHA-256:	EB611854A404011A74A21D0D982954C5A220C582B894B25C3C04B9474BA24DE4
SHA-512:	2B9E87A3D7654E1824A1621966F8E42876BA0A4B6B1519416B2D5867162F7657B216CA56A421C4D6FD544355FCC6EA847C99930CAB52DDAF823734691F680A47
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/notify.js?av=9ec570bf
Preview:	/*. This file is part of the MailWizz EMA application.. . @package MailWizz EMA. * @author Serban George Cristian <cristian.serban@mailwizz.com>. * @link https://www.mailwizz.com/. * @copyright MailWizz EMA (https://www.mailwizz.com). * @license https://www.mailwizz.com/license/. * @since 1.0. */.;(function( $, window, document, undefined ){...var notify = function() {......var messages = {....error: [],....warning: [],....info: [],....success: [],...};......var options = {....container: '#notify-container',....errorClass: 'alert alert-block alert-danger',....warningClass: 'alert alert-block alert-warning',....infoClass: 'alert alert-block alert-info',....successClass: 'alert alert-block alert-success',....htmlWrapper: '<div class="{CLASS}">{CONTENT}</div>',....htmlCloseButton: '<button type="button" class="close" data-dismiss="alert">.</button>',....htmlHeading: '<p>{CONTENT}</p>',....errorHeading: '',....warningHeading: '',....infoHeading: '',....successHeading: '',........_me

Chrome Cache Entry: 57

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3588
Entropy (8bit):	4.9403671605209665
Encrypted:	false
SSDEEP:	48:X15xJ5RVul1BR0XQj6v6mnmEWY1rkDrjm81T8kSEV:X15xJ/s6v6mnaY1rCj11T8kSe
MD5:	736DC5A80D350F34661EEB11EC02C7EE
SHA1:	AD568E0FEF2C72BDF111E8E1F55E9245FD45AD30
SHA-256:	D028883419FBC261A8588DE03FCBA282DEBB5E92853974D69BCA9F5DF9F4904D
SHA-512:	C5CE496F5C7AAE559BEBD1D709D1CD634ECC4649B72FAB77122445B5502DC8275B3886D4BB16BED5ED8E4A2D74D4EF6273D5623B12C510C754E246828E38B2EC
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/css/skin-blue.css?av=9ec570bf
Preview:	/. Skin: Blue. * ----------. */..skin-blue .main-header .navbar {. background-color: #ebf6f8;.}..skin-blue .main-header .navbar .nav > li > a {. color: #008ca9;.}..skin-blue .main-header .navbar .nav > li > a:hover,..skin-blue .main-header .navbar .nav > li > a:active,..skin-blue .main-header .navbar .nav > li > a:focus,..skin-blue .main-header .navbar .nav .open > a,..skin-blue .main-header .navbar .nav .open > a:hover,..skin-blue .main-header .navbar .nav .open > a:focus,..skin-blue .main-header .navbar .nav > .active > a {. background: rgba(0, 140, 169, 0.1);. color: #008ca9;.}..skin-blue .main-header .navbar .sidebar-toggle {. color: #008ca9;.}..skin-blue .main-header .navbar .sidebar-toggle:hover {. color: #008ca9;. background: rgba(0, 140, 169, 0.1);.}..skin-blue .main-header .navbar .sidebar-toggle {. color: #008ca9;.}..skin-blue .main-header .navbar .sidebar-toggle:hover {. color: #008ca9;. background-color: #c5e5eb;.}.@media (max-width: 767px) {. .skin-blue .main

Chrome Cache Entry: 58

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	16326
Entropy (8bit):	4.910678093929767
Encrypted:	false
SSDEEP:	384:ELqQF5+71U5iEChoiD+r460ZsA3GhZK+qKDQt19N3UV1xhbbBH3MFQ6+Fw:ELqQF5c0TBHcFOFw
MD5:	0704FE77A703921A5520C4EF079B3AC4
SHA1:	C8D27D838B3E0F80232E76FFC0EC2C8AF08727CE
SHA-256:	6A6249EB2886276D28435052D388FE35557EA936825D1E06629849EC700BFD95
SHA-512:	0892E10AD1A4DBD454D9056E064456D0D11151B0FB4C3BA28189FA58A5DEBC864F07584C54ABAAFB351D24CAEBE2ECB8F70DBC0B0FAAB889FCEBA70A94F8F6D4
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/frontend/assets/css/style.css?av=9ec570bf
Preview:	body {. font-family: "Open Sans", Verdana, Arial, Helvetica, sans-serif;. color: #3a3a3a;. background-color: #FFFFFF;.}..content-wrapper {. background-color: #FFFFFF;. padding: 30px 0 0 0;.}.h1,.h2 h3,.h4,.h5 {. font-family: "Helvetica Neue", Arial, Helvetica, sans-serif;. padding: 0 0 0 0;. margin: 0 0 0 0;.}..ctrl-site.act-index .row-large {. margin-left: 0!important;. margin-right: 0!important;.}..ctrl-site.act-index .content {. padding: 0!important;.}..ctrl-site.act-index .container-fluid-large {. width: 100%!important;. padding-left: 0;. padding-right: 0;. left: 0!important;.}.h1.page-heading {. padding-top: 0;. margin-top: 0;. font-size: 30px;.}.h1.page-heading small {. font-size: 12px;.}..related-articles {. margin-top: 10px;.}..related-articles .article {. margin-bottom: 10px;. font-size: 12px;. border-bottom: 1px dotted #c2c2c2;. padding-bottom: 5px;. min-height: 90px;. border-right: 1px dotted #c2c2c2;.}..related-articles .article .title {. font-siz

Chrome Cache Entry: 59

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (564)
Category:	downloaded
Size (bytes):	59822
Entropy (8bit):	5.351314059784889
Encrypted:	false
SSDEEP:	1536:Xc7Kf0IQxkPe1JzEWsKjgTJ3kkO1SY332Bhbsq3FqE:nO+tK4ZdsE
MD5:	FA8662C7A8415D0355F444EAFF534845
SHA1:	B60C2C301C280378B4D51769CB20A46E65989C73
SHA-256:	972F13893B7056C0567637A44EA4C994B1B3DD1B20E185EBF3478AE9086D74CB
SHA-512:	BA97CEF5E309D1E02604FEAB10AAE4C9862ED6F767D2078A97B1DCD5A7F06EA4E005C9003563F1CDC3DA084F93280D625A77008D6ADF814368F495BF69254982
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/knockout.min.js?av=9ec570bf
Preview:	/!. Knockout JavaScript library v3.4.0. * (c) Steven Sanderson - http://knockoutjs.com/. * License: MIT (http://www.opensource.org/licenses/mit-license.php). */..(function() {(function(n){var x=this\|\|(0,eval)("this"),u=x.document,M=x.navigator,v=x.jQuery,F=x.JSON;(function(n){"function"===typeof define&&define.amd?define(["exports","require"],n):"object"===typeof exports&&"object"===typeof module?n(module.exports\|\|exports):n(x.ko={})})(function(N,O){function J(a,c){return null===a\|\|typeof a in T?a===c:!1}function U(b,c){var d;return function(){d\|\|(d=a.a.setTimeout(function(){d=n;b()},c))}}function V(b,c){var d;return function(){clearTimeout(d);d=a.a.setTimeout(b,c)}}function W(a,.c){c&&c!==I?"beforeChange"===c?this.Kb(a):this.Ha(a,c):this.Lb(a)}function X(a,c){null!==c&&c.k&&c.k()}function Y(a,c){var d=this.Hc,e=d[s];e.R\|\|(this.lb&&this.Ma[c]?(d.Pb(c,a,this.Ma[c]),this.Ma[c]=null,--this.lb):e.r[c]\|\|d.Pb(c,a,e.s?{ia:a}:d.uc(a)))}function K(b,c,d,e){a.d[b]={init:function(b,g,k,l,m){va

Chrome Cache Entry: 60

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27303)
Category:	downloaded
Size (bytes):	27466
Entropy (8bit):	4.752060795123139
Encrypted:	false
SSDEEP:	384:Qi5yWeTUKW+KlkJ5de2UYmydfwYUas8l8yQ/8c:Dlr+Klk3YlKfwYUf8l8yQ/T
MD5:	4FBD15CB6047AF93373F4F895639C8BF
SHA1:	12D6861075DE8E293265FF6FF03B1F3ADCB44C76
SHA-256:	DDD92F10AD162C7449EFF0ACAF40598C05B1111739587EDB75E5326B6697C5D5
SHA-512:	F8BE32CBA15170319B5C9F663C6F0C4FFDD4083CF047D80F7B214D302B489ECA25FBEE66DDB9366D758A7598EFC9B9A886B02C9F751AE71F207CB9DB1356243A
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css?av=9ec570bf
Preview:	/!. Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.5.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.5.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

Chrome Cache Entry: 61

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65366)
Category:	downloaded
Size (bytes):	99961
Entropy (8bit):	5.103690141294514
Encrypted:	false
SSDEEP:	768:rnB72vDPZJF1Y13kGxw+snfkzaZbZb3PxNCMpm0Fr89YjMXdQJaQ:j6p1Y13NwTk+fPM4891XE
MD5:	8A7442CA6BEDD62CEC4881040B9A9E83
SHA1:	E2D2B846E9EA72A1985458A3748AAB4E01A8FB3A
SHA-256:	E9503448692B738DD260FBD7F7CABF2E11F09B600FA97E6EB3A56EBA5B1A7E9B
SHA-512:	057FD1D2E51DF045DB3DADBD41FAC2B31839C4F651F897CCD24E8AEB3162CA04E37B50977F11DC96B50A25B94EE2525EA2B2539862788E38F43636D0B5B4D192
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/css/bootstrap.min.css?av=9ec570bf
Preview:	/!. Bootstrap v3.1.1 (http://getbootstrap.com). * Copyright 2011-2014 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /../! normalize.css v3.0.0 \| MIT License \| git.io/normalize */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background:0 0}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box-

Chrome Cache Entry: 62

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32086)
Category:	downloaded
Size (bytes):	95786
Entropy (8bit):	5.393689635062045
Encrypted:	false
SSDEEP:	1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzm6:ENMyqhJvN32cBC7M6Whca98HrB
MD5:	8101D596B2B8FA35FE3A634EA342D7C3
SHA1:	D6C1F41972DE07B09BFA63D2E50F9AB41EC372BD
SHA-256:	540BC6DEC1DD4B92EA4D3FB903F69EABF6D919AFD48F4E312B163C28CFF0F441
SHA-512:	9E1634EB02AB6ACDFD95BF6544EEFA278DFDEC21F55E94522DF2C949FB537A8DFEAB6BCFECF69E6C82C7F53A87F864699CE85F0068EE60C56655339927EEBCDB
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/frontend/assets/cache/591dbfd1/jquery.min.js
Preview:	/! jQuery v1.11.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

Chrome Cache Entry: 63

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 2 colors
Category:	dropped
Size (bytes):	198
Entropy (8bit):	1.9172424882027073
Encrypted:	false
SSDEEP:	3:3/nlrXllvlNl/FXl1ll1lPflQQC/PcelVoX55/w/P3wlz:J1xlF6vHa55/6gz
MD5:	FF82D748B4ADD52E4DD7C8F0B58B89F2
SHA1:	EA69CEBF29F461D7831368697F303EA4F0C69A2D
SHA-256:	DE88C1F678413736E858B27974CD5D2181B3DF891B8999DD93835384B0CA2D8F
SHA-512:	4A5BF02B465CE7D5AED54E9800ED320EB929DDAA6C3ED5B3454D61B93B1EC7496AC1BBB529BE8B2F30A0BF339D452EC3A1F2FDA81F4F32C2D978584D146C48E8
Malicious:	false
Reputation:	low
Preview:	......................(....... ...........@.....................:..........#.......w.......#..........................................................................................................

Chrome Cache Entry: 64

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7254
Entropy (8bit):	5.334962535444676
Encrypted:	false
SSDEEP:	192:437U337+lin3liykj3kOpie3pirTiM3Tiw7zO79a6oAnBiuX4QP:43s3iA3AyKnMCMrmomw+F
MD5:	8749E6D6C19DD95CDFC3E3C303492900
SHA1:	41CF6B40E12097D9545DF2294364E3FEB6896C81
SHA-256:	0D9740A58F2FEE125EDF28CEA3CB1D2C98971BB6F2BDCE19635575B3DA4725A0
SHA-512:	9C3DBE64E1BC17D2ABDF27E86536B7B30C349946A5E309A4A09F34F5D0E5BB336FB5E2E1CF1EB329064BACED691802AB9592AC8EA2963D186AF46387D76E45CD
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Lato:100,100i,300,300i,400,400i,700,700i,900,900i&av=9ec570bf"
Preview:	/* latin-ext /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 100;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-mPCLQ7A.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 100;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u-w4BMUTPHjxsIPx-oPCI.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Lato';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/lato/v24/S6u_w4BMUTPHjxsI9w2_FQft1dw.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF

Chrome Cache Entry: 65

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 2 colors
Category:	downloaded
Size (bytes):	198
Entropy (8bit):	1.9172424882027073
Encrypted:	false
SSDEEP:	3:3/nlrXllvlNl/FXl1ll1lPflQQC/PcelVoX55/w/P3wlz:J1xlF6vHa55/6gz
MD5:	FF82D748B4ADD52E4DD7C8F0B58B89F2
SHA1:	EA69CEBF29F461D7831368697F303EA4F0C69A2D
SHA-256:	DE88C1F678413736E858B27974CD5D2181B3DF891B8999DD93835384B0CA2D8F
SHA-512:	4A5BF02B465CE7D5AED54E9800ED320EB929DDAA6C3ED5B3454D61B93B1EC7496AC1BBB529BE8B2F30A0BF339D452EC3A1F2FDA81F4F32C2D978584D146C48E8
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/favicon.ico
Preview:	......................(....... ...........@.....................:..........#.......w.......#..........................................................................................................

Chrome Cache Entry: 66

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 33092, version 1.0
Category:	downloaded
Size (bytes):	33092
Entropy (8bit):	7.993894754675653
Encrypted:	true
SSDEEP:	768:c+2lFKscxQAuDJ5m/xiYEQNMJjFaf0TteqKt:cZlhcxJuDa/xiMMJhaItzKt
MD5:	057478083C1D55EA0C2182B24F6DD72F
SHA1:	CAF557CD276A76992084EFC4C8857B66791A6B7F
SHA-256:	BB2F90081933C0F2475883CA2C5CFEE94E96D7314A09433FFFC42E37F4CFFD3B
SHA-512:	98FF4416DB333E5A5A8F8F299C393DD1A50F574A2C1C601A0724A8EA7FB652F6EC0BA2267390327185EBEA55F5C5049AB486D88B4C5FC1585A6A975238507A15
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Preview:	wOF2.......D......6...............................a......Z?HVAR...`?STAT.8'2..F/~.....\|.M....0....6.$.... ..x..<..[.%Q.i.<.N..t.Yx..5.A...\|..g#l....5.....D.Bt.......l.Y].)..(..H.s..V..ruM....[.....I.0h.v.Hc.R..]....`$.I)G.+.}....E%.H..\|..%nEE.....+.x..7\|........[..V....[.......0...CA.._....)2.$.....s_fw....+.V.H.B.<?.?..mloc..1.Q....a.r#...)......\|.F>..../6-.......t......>......tO.:f@b....u.I(.Bc..b....7.?A.....vE.}...kb]W7.h..$@......T1t.8.._?...~..,..I..."Y...1..s.V........R.Bf2..I....s.........u.P.&..D./"2qf....p.sv..)b5.yR.$MR3.@.E../>{w.....f...cN...2.v.....]>..Ow...9/!v...r..1.4.n.w...T......=...hRH!.....2`...u..82L...S.v.ik^.V.....@..N....d{..{...NN"'.H...H$..H.<..{?..x.....zv.}.~.N)4.g...X.....8\|}...e,%.:..;.Q..88...@..=UVHe....g..zD?..U...~.J...oMoP..6B"Y.{BN...vY<.o..r.7.7j%.Z%.'...]...........YK...,.a-;.M....>\.......%'+8Z.1K.y...9.(;.5 ..M..L.(..9...T)........hx..i2Y...m..{ulY...d......")^.,.n.~..r..S.o.$.....6=.i...N.....q0 ....

Chrome Cache Entry: 67

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	16791
Entropy (8bit):	5.340651755522299
Encrypted:	false
SSDEEP:	192:N/dB0q4e6uyfrbqGIwYMH17o/A85q1H6uy2rbqGIwYRe1qh/ZFgqsC6uyrrbqGIA:ZFuq9PUhq915Cq9C
MD5:	91AC03E451A4BAAE0CF9B1704A46298E
SHA1:	89F3C96528C24B8CFAAD5B25EB6D7B650944EB7F
SHA-256:	3309A12DA2ED18DB77A65BFD52B4FB97A0DFD77E4F22889BD708A010FFD2F9C3
SHA-512:	D78D4569B84F52CF05D081D0999B8FB7A140A9F253AD3ABC1A91121CF93431247003A79D47CC2E090594EC53EC85948383EBBAB22CA950043D53226BB9F7B227
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Open+Sans:300,400,700&av=9ec570bf"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Open Sans';. font-style: normal;

Chrome Cache Entry: 68

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	469
Entropy (8bit):	4.972810346353041
Encrypted:	false
SSDEEP:	12:UJSFQeWdKls1YGl3yePD3xvzzAMS22ylKRRHVPH:ivKlX1eNHAMp2ySR1PH
MD5:	5154609F598BE8D873FF615D521B6D60
SHA1:	55165AF84A2129E8432F1E96326EE686A07392BD
SHA-256:	0AD96C8BCA01A84D8B932DA6E7CB095707BCE86F4844ACD88925B295A7422F2F
SHA-512:	97902BC6DAB9D1052F24D4DBFFACE250B6F7C4D394E15DE127E7DAEEF41DC7D6F3DA99F5C28B5345F3A4F5AD4BDAB94C448010D84B0CE7EB6A8C84607EB076FF
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/frontend/assets/js/app.js?av=9ec570bf
Preview:	/*. This file is part of the MailWizz EMA application.. . @package MailWizz EMA. * @author Serban George Cristian <cristian.serban@mailwizz.com>. * @link https://www.mailwizz.com/. * @copyright MailWizz EMA (https://www.mailwizz.com). * @license https://www.mailwizz.com/license/. * @since 1.0. */.jQuery(document).ready(function($){. . // since 1.6.4 . $('.ctrl-lists form').on('submit', function(){. $(this).css({opacity: .5});. });. .});.

Chrome Cache Entry: 69

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (50806)
Category:	downloaded
Size (bytes):	51284
Entropy (8bit):	4.573984507129134
Encrypted:	false
SSDEEP:	384:048l+hhJhjRqFdtYRjJIjsjaHnNfc2C4741mf5HRzL:04DhhjQFduRjJ7uHFcu7Smf5xzL
MD5:	0D6763B67616CB9183F3931313D42971
SHA1:	F0459300E39155DF7AA5E94B3BDB8C8594F49A60
SHA-256:	DE2BBD8E0B32F53A53C1729BEDB350CEA59E9115FBA4F2BED8E2E3DD1F76D9FA
SHA-512:	240A635919DFA2715E18163BB78CAAF125ABD40EB155810980EFD430860E371691DC2F461132948342E16AB6C99DC133245E4D9A2BFE3EBE5036E96BF352E319
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css?av=9ec570bf
Preview:	@charset "UTF-8";/!. Ionicons, v2.0.0. Created by Ben Sperry for the Ionic Framework, http://ionicons.com/. https://twitter.com/benjsperry https://twitter.com/ionicframework. MIT License: https://github.com/driftyco/ionicons.. Android-style icons originally built by Google.s. Material Design Icons: https://github.com/google/material-design-icons. used under CC BY http://creativecommons.org/licenses/by/4.0/. Modified icons to fit ionicon.s grid from original../@font-face{font-family:"Ionicons";src:url("../fonts/ionicons.eot?v=2.0.0");src:url("../fonts/ionicons.eot?v=2.0.0#iefix") format("embedded-opentype"),url("../fonts/ionicons.ttf?v=2.0.0") format("truetype"),url("../fonts/ionicons.woff?v=2.0.0") format("woff"),url("../fonts/ionicons.svg?v=2.0.0#Ionicons") format("svg");font-weight:normal;font-style:normal}.ion,.ionicons,.ion-alert:before,.ion-alert-circled:before,.ion-android-add:before,.ion-android-add-circle:before,.ion-android-alarm-clock:before,.ion-android-alert:

Chrome Cache Entry: 70

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4938
Entropy (8bit):	4.0610177180520655
Encrypted:	false
SSDEEP:	96:cIBtgSBvwbu1D+2y2O5tMENRk4QUFNNmHJ1sltgRVK1:cIBqSBYq1a2y2itMEf/QS2UIi1
MD5:	449DD3907404CEAD5D8BA6203B3550DC
SHA1:	C9BB690411C3F46145F8EA137E6783929D8C27AA
SHA-256:	3585A42757908BA2ACE27F41B01256F6CF4FFB9679F7AC0FF8957817D5CCFDE1
SHA-512:	AF975D70F9BB4F5C9E10CA9A3F3DA7C71400DEFF2F8BD0CAA3958CA21D5E4CBA60C013317461851DA8891E75514824949FB2616D058F795358661D28797F5990
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/cookie.js?av=9ec570bf
Preview:	/!. JavaScript Cookie v2.1.3. * https://github.com/js-cookie/js-cookie. . Copyright 2006, 2015 Klaus Hartl & Fagner Brack. * Released under the MIT license. */.;(function (factory) {. var registeredInModuleLoader = false;. if (typeof define === 'function' && define.amd) {. define(factory);. registeredInModuleLoader = true;. }. if (typeof exports === 'object') {. module.exports = factory();. registeredInModuleLoader = true;. }. if (!registeredInModuleLoader) {. var OldCookies = window.Cookies;. var api = window.Cookies = factory();. api.noConflict = function () {. window.Cookies = OldCookies;. return api;. };. }.}(function () {. function extend () {. var i = 0;. var result = {};. for (; i < arguments.length; i++) {. var attributes = arguments[ i ];. for (var key in attributes) {. result[key] = attributes[key];. }

Chrome Cache Entry: 71

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	210752
Entropy (8bit):	5.019988873290521
Encrypted:	false
SSDEEP:	6144:lDd8jBdBCPExnNr15VeZai31/UpWtF3UtKaGRVElCKWohubj0eF9Fud1gq557aPs:lDd8jBdBCPExnNr15VvWtF3aKaGRVElN
MD5:	01F8DB2276C0B4C5D5A502CA9BF43759
SHA1:	AB5722BE0ECE9EB4E4BD6C769AB25B5676960911
SHA-256:	D3F66D9BCCBA43D10358A37DED977507E077B86354677ED726109C2A00393142
SHA-512:	0F83924CC83EBA5192C4EC5F35A6F4DEB575051680C5D3A57BBE4AFA4D2A18237631490546494620C7B94731B062A915E55EF34FAA4E53DEF4138652BFE02444
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/css/adminlte.css?av=9ec570bf
Preview:	./!. AdminLTE v2.3.6. * Author: Almsaeed Studio. . Website: Almsaeed Studio <http://almsaeedstudio.com>. License: Open source - MIT. * Please visit http://opensource.org/licenses/MIT for more information.!/.@import url(https://fonts.googleapis.com/css?family=Montserrat:300,400,700);./. * Core: General Layout Style. * -------------------------. /.html,.body {. min-height: 100%;.}..layout-boxed html,..layout-boxed body {. height: 100%;.}.body {. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;. font-family: 'Montserrat', sans-serif;. font-weight: 400;. overflow-x: hidden;. overflow-y: auto;.}./ Layout */..wrapper {. min-height: 100%;. position: relative;. overflow: hidden;.}..wrapper:before,..wrapper:after {. content: " ";. display: table;.}..wrapper:after {. clear: both;.}..layout-boxed .wrapper {. max-width: 1250px;. margin: 0 auto;. min-height: 100%;. box-shadow: 0 0 8px rgba(0, 0, 0, 0.5);. position: relative;.}..l

Chrome Cache Entry: 72

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:	768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 73

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:l36nJdjRR:ZG9
MD5:	4485A2BAFD72B3EB2371C9B1286BBDF3
SHA1:	502BABAD61CDB4D2CFA39D15AE3D23395E9AD97B
SHA-256:	9C6EF9763E8B7231452141B50CEC16E9281C6E18E11298FE1DE104E9B6E9406F
SHA-512:	44A5F2B4CFE613600459D4D0F762A0A3885BEC43D82FD4F094C7D98D75580580FE395A1178AF32BEFB523777355176E66BFAD9DC4703BB6FD156F2E8D82D14B5
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwna-QtXX8XnjBIFDQlsRZgSBQ05l8Fr?alt=proto
Preview:	ChIKBw0JbEWYGgAKBw05l8FrGgA=

Chrome Cache Entry: 74

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9373)
Category:	downloaded
Size (bytes):	9774
Entropy (8bit):	5.247988101918291
Encrypted:	false
SSDEEP:	192:FQVn5yyXgGyPE0cmi8NSWqqpULv/cE9OAZFvnsTNYRUivUv:FQVjPeNSRZ/H8MmNjv
MD5:	ADD5B3F0900365F3B4240664DA17760E
SHA1:	7CBD53BFCF830E7C150D6BB55EFCC2832E7543E7
SHA-256:	42338BC162A705B04953FC72340216DBEFB55CF12EC1A6E7CAD04E5E680E26BC
SHA-512:	A18E3C2B06A156AC1852AD26C3C7E11482F76B5263853ADFB3A4011BCD628A466938E5E68F1666F4A8599AF27BFBAD074264F0CEA52E339C1F8360AC8C80041D
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/adminlte.js?av=9ec570bf
Preview:	/! AdminLTE app.js. ================. * Main JS application file for AdminLTE v2. This file. * should be included in all pages. It controls some layout. * options and implements exclusive AdminLTE plugins.. . @Author Almsaeed Studio. * @Support <http://www.almsaeedstudio.com>. * @Email <abdullah@almsaeedstudio.com>. * @version 2.3.6. * @license MIT <http://opensource.org/licenses/MIT>. */.function _init(){"use strict";$.AdminLTE.layout={activate:function(){var a=this;a.fix(),a.fixSidebar(),$(window,".wrapper").resize(function(){a.fix(),a.fixSidebar()})},fix:function(){var a=$(".main-header").outerHeight()+$(".main-footer").outerHeight(),b=$(window).height(),c=$(".sidebar").height();if($("body").hasClass("fixed"))$(".content-wrapper, .right-side").css("min-height",b-$(".main-footer").outerHeight());else{var d;b>=c?($(".content-wrapper, .right-side").css("min-height",b-a),d=b-a):($(".content-wrapper, .right-side").css("min-height",c),d=c);var e=$($.AdminLTE.options.controlSideba

Chrome Cache Entry: 75

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	8732
Entropy (8bit):	5.391947353968344
Encrypted:	false
SSDEEP:	192:pNa5N4NXNO3qNWNIXNENFQNDN8NW3XNtNGqN+lNn1NhN6ND3eNhNzTNsNVnNFNqN:vafWdMQcMCFe5Kkdjjwn73Az03FaVNr+
MD5:	C63492A79EC1D8A78013E948CFCBB870
SHA1:	81777F6625EEE4BA7C2CE91124996C2217A32CE4
SHA-256:	634EE2714F31338B7D877EC553062F3ACC336A9DEAA81D1735DE58FCB8DE6AF8
SHA-512:	328870ED88113A41AE03F6896CCB27B1946A4134339362AD7C68CCC1F2CB0A668479942B5858BC24E032A5223030698F07354A931B7F10205742BEB5597ECB16
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Roboto:300,400,700,900&av=9ec570bf"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2) format('woff2');. unicode-ra

Chrome Cache Entry: 76

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2294
Entropy (8bit):	4.809775474933601
Encrypted:	false
SSDEEP:	48:EKlX1eNgMh5mssfxKssWphSRuRIjuFpEyiH0i9kaH7nnF+yKeesyKeeLkuBY:RdvxKpYhSRgaMJiH0i9rnF/KeaKeke
MD5:	FCE662FE3DD4BD3BE35B6C3ABEC80FF9
SHA1:	F76E098AD417541EF91067C3DE79A52A9B19F9C3
SHA-256:	81B55A53574A03BF7AA7847D9C12DA1A44F2EF01F6ECEF5BF5F818426150CD78
SHA-512:	AE6BF581C3AF9BDB240F7C5B2A519263AFAEABF2FB32E2DE7BD9A5A80E82204E15777D28E666DA250C1428F4C7D372F1672D89FBF80AEB15C643F3BD8E782C4A
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/app.js?av=9ec570bf
Preview:	/*. This file is part of the MailWizz EMA application.. . @package MailWizz EMA. * @author Serban George Cristian <cristian.serban@mailwizz.com>. * @link https://www.mailwizz.com/. * @copyright MailWizz EMA (https://www.mailwizz.com). * @license https://www.mailwizz.com/license/. * @since 1.0. */.jQuery(document).ready(function($){.. ajaxData = {};. if ($('meta[name=csrf-token-name]').length && $('meta[name=csrf-token-value]').length) {. var csrfTokenName = $('meta[name=csrf-token-name]').attr('content');. var csrfTokenValue = $('meta[name=csrf-token-value]').attr('content');. ajaxData[csrfTokenName] = csrfTokenValue;. }.. // input/select/textarea fields help text. $('.has-help-text').popover();. $(document).on('blur', '.has-help-text', function(e) {. if ($(this).data('bs.popover')) {. // this really doesn't want to behave correct unless forced this way!. $(this).data('bs.popover').destroy();. $('.popo

Chrome Cache Entry: 77

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28941)
Category:	downloaded
Size (bytes):	29110
Entropy (8bit):	5.098131946780992
Encrypted:	false
SSDEEP:	768:jryxMjJYkskKzykVtCb+9C8agZMdyKHfivbOCtFKH:3HbjZC7w
MD5:	BA847811448EF90D98D272AECCEF2A95
SHA1:	5814E91BB6276F4DE8B7951C965F2F190A03978D
SHA-256:	898D05A17F2CFC5120DDCDBA47A885C378C0B466F30F0700E502757E24B403A1
SHA-512:	BCED99D9331614757643273441A2B8921103382949AB0E510F386C453EC2A2359DA39680D8A169E6BCBE7531844EAF5F598560F0D133D3FA3A9F6C7502B148DF
Malicious:	false
Reputation:	low
URL:	https://qhs-rx.com/assets/js/bootstrap.min.js?av=9ec570bf
Preview:	/!. Bootstrap v3.1.1 (http://getbootstrap.com). * Copyright 2011-2014 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one(a.support.transition.end,function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b()})}(jQuery),+function(a){"use strict";var b='[data-dismiss="alert"]',c=function(c){a(c).on("click",b,this.close)};c.prototype.close=function(b){function c(){f.trigger("closed.bs.alert").remove()}var d=a(this),e=d.attr("

Chrome Cache Entry: 78

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5160
Entropy (8bit):	5.435572929114572
Encrypted:	false
SSDEEP:	96:AOOWlwOOWZFZOhOOWMOOWhVc+udOOWSZNAOOLlwOOLZFZOhOOLMOOLhVc+udOOLF:XlHQYrtNSGlaQh2tsSflDQ8PtRST
MD5:	12021F68B16D4BF9BAE3F4F854F56836
SHA1:	47DBACBDD374F89EB3A3687C273EB6D0995CA480
SHA-256:	43BDC741A39D63EA7941307ED84368023175DDDC6F79748578FCC312CF91B874
SHA-512:	927A122D0CFCDF580AA7FBDB6BE3857326524EAF8B376EC760C0475EA4274AB2A7CEACBDEB5D8A55192F8F43590EC63D7155E0EFA4DC9320B5526C7EC0E1246C
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Montserrat:300,400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese /.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./ latin-ext */.@font-face {. font-f

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 03:29:48.217638016 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 03:29:57.445282936 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.445363998 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.445436001 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.445741892 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.445807934 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.445916891 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.445941925 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.445950031 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.446166039 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.446191072 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.795192957 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.795658112 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.795713902 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.797375917 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.797472954 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.797744989 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.798274040 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.798300982 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.798599005 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.798696995 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.798846006 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.798862934 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.799840927 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.799918890 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.800849915 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.800923109 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.828280926 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 03:29:57.843605995 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.843630075 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:57.843672991 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:57.888592958 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.328875065 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.328943968 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.328965902 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.329019070 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.329083920 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.329119921 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.329157114 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.329214096 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.331531048 CEST	49736	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.331573963 CEST	443	49736	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.368943930 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.369010925 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.369203091 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.369793892 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.369868040 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.369940042 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.370698929 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.370773077 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.370850086 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.371397018 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.371423006 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.371654987 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.372055054 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.372072935 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.372129917 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.374299049 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.375030041 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.375065088 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.375838995 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.375874043 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.376600027 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.376630068 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.376818895 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.376835108 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.377029896 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.377046108 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.416136026 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.496525049 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.496535063 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.496613026 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.497159958 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.497257948 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.497545958 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.501130104 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.501168966 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.501528978 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.501543999 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.714322090 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714384079 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714404106 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714423895 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714449883 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.714487076 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.714502096 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714545012 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714565992 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714615107 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.714628935 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.714682102 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.714751005 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715389967 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.715416908 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715673923 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715722084 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715743065 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.715758085 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715799093 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.715814114 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715833902 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.715852022 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.715873957 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.716594934 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.719193935 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.719371080 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.719799042 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.722750902 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.723246098 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.723295927 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.723459005 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.723687887 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.723707914 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.725174904 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.725234985 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.725474119 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.726228952 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.726309061 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.726732969 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.726939917 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.726962090 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.726969957 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.727190971 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.729589939 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.729872942 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.729891062 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.736594915 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.736666918 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.737369061 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.737567902 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.737728119 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.737740040 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.737773895 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.737953901 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.737973928 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.741293907 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.741348982 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.741877079 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.741950035 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.742243052 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.742249966 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.760159969 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.762284040 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.763667107 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.763736010 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.763885975 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.763894081 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.764007092 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.764062881 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.765465975 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.765533924 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.765625954 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.765695095 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.768148899 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.768345118 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.768434048 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.768565893 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.768582106 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.768790960 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.768953085 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.769237995 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.769247055 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:58.780096054 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.780103922 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.794056892 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.811120033 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.811134100 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:58.876703978 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.876734972 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.876780987 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.876816034 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.876847029 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.876869917 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.876894951 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.876996040 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.878026009 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.878070116 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.878093004 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.878120899 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.878150940 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.878181934 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.878199100 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.879456997 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.879501104 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.879602909 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:58.879616976 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:58.879688025 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.038683891 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.038747072 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.038778067 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.038815975 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.038830996 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.038873911 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.038947105 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.038995028 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.039005995 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.039132118 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.039176941 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.040087938 CEST	49735	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.040131092 CEST	443	49735	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.041002035 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.041100025 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.041168928 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.042294979 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.042347908 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.055365086 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.055423021 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.055486917 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.055540085 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.055572033 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.055597067 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.055627108 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.056902885 CEST	49740	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.056931973 CEST	443	49740	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.058090925 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.058168888 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.058253050 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.059325933 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.059432030 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.060161114 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060233116 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060281038 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060319901 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060349941 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.060357094 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060417891 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060453892 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.060476065 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060477972 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.060491085 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.060544014 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.060575962 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061204910 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061247110 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061269045 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.061283112 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061383963 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061441898 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.061455965 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061505079 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.061868906 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061942101 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.061981916 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062036037 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062040091 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062050104 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062092066 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062109947 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062141895 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062163115 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062211037 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062211037 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062218904 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062223911 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062246084 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062305927 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062340975 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062349081 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062370062 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062382936 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062644958 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062685966 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062693119 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062704086 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.062941074 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.062947989 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063047886 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063128948 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063182116 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.063194990 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063314915 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063350916 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.063376904 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.063586950 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063635111 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063642025 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.063651085 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.063694000 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.063702106 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064357042 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064403057 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064421892 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.064430952 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064471006 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064471960 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.064490080 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.064529896 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.065190077 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.065299034 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.065342903 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.065366983 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.065375090 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.065411091 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.065418959 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066111088 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066159010 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.066165924 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066219091 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066256046 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066303968 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.066317081 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.066356897 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.067049980 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067121029 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067158937 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067173958 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.067183018 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067225933 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.067614079 CEST	49748	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.067641973 CEST	443	49748	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067899942 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.067974091 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.068011045 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.068025112 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.068033934 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.068090916 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.068098068 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.068124056 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.068165064 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.071577072 CEST	49747	443	192.168.2.4	104.17.25.14
Apr 26, 2024 03:29:59.071590900 CEST	443	49747	104.17.25.14	192.168.2.4
Apr 26, 2024 03:29:59.216433048 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.216506958 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.216573000 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.216590881 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.216622114 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.216649055 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.216670990 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.217349052 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.217392921 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.217430115 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.217437983 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.217470884 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.226924896 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.226998091 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227018118 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227058887 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227061987 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227092028 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227129936 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227168083 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227169037 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227169037 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227202892 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227377892 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227407932 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227418900 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227454901 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227479935 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227528095 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227556944 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227581978 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227593899 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227593899 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227611065 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227622032 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227750063 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227792025 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.227798939 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227839947 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.227890968 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.228346109 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.228394032 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.228441954 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.228456020 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.228482008 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.230360985 CEST	49743	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.230370998 CEST	443	49743	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.231192112 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.231267929 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.231359005 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.232887030 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.232924938 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.236999989 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237083912 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237106085 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237133980 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237149954 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237166882 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237186909 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237189054 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237291098 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237344027 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237366915 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237379074 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237396955 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237857103 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237909079 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237936020 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.237942934 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.237967014 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.238045931 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.238051891 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.238100052 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.238141060 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.250180960 CEST	49742	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.250204086 CEST	443	49742	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.250523090 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.250590086 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.250668049 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.251220942 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.251249075 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.282510042 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.375468016 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.375713110 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.375731945 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.376210928 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.376580000 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.376662970 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.376712084 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.379234076 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.379302979 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.379328012 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.379401922 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.379462004 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.379462957 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.380588055 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.380631924 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.380650997 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.380665064 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.380691051 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.380711079 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.389297962 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.389333010 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.389370918 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.389380932 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.389404058 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.389415979 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.389421940 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.389446974 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.389458895 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.390777111 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.390824080 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.390837908 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.390847921 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.390872955 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.390891075 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.392399073 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.392441988 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.392463923 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.392469883 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.392503023 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.392517090 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.397419930 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.397675037 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.397736073 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.398878098 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.399210930 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.399322033 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.399334908 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.399391890 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.407524109 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.407581091 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.407610893 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.407651901 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.407680035 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.407720089 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.420141935 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.426314116 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.442404032 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.541182041 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.541233063 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.541277885 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.541340113 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.541376114 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.541521072 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.542676926 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.542721033 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.542766094 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.542778969 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.542807102 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.542824030 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.543971062 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.544013023 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.544047117 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.544058084 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.544083118 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.544121981 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.545392990 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.545449018 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.545465946 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.545483112 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.545511007 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.545527935 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.547041893 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.547084093 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.547113895 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.547138929 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.547172070 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.547188997 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.550868034 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.550929070 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.550956964 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.551019907 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.551053047 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.551091909 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.551196098 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.551424980 CEST	49741	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.551456928 CEST	443	49741	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.551918983 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.552020073 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.552119017 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.552593946 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.552630901 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.565977097 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.566251040 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.566308022 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.567754984 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.567848921 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.568873882 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.568964958 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.569181919 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.569210052 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.570772886 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.570820093 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.570863962 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.570902109 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.570938110 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.570957899 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.588661909 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.588893890 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.588924885 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.592113972 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.592175961 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.592485905 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.592550039 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.592606068 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.609354973 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.636149883 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.641494036 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.641519070 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.689691067 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.703192949 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.703247070 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.703279972 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.703327894 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.703361988 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.703383923 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704245090 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.704302073 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.704313993 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704356909 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.704377890 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704514027 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.704567909 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704601049 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704634905 CEST	443	49739	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.704657078 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704693079 CEST	49739	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704948902 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.704989910 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.705087900 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.705352068 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.705374956 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.732264042 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.732332945 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.732498884 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.732564926 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.732566118 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.732866049 CEST	49750	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.732906103 CEST	443	49750	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874078989 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874128103 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874147892 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874186993 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874198914 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.874229908 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874249935 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.874270916 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.874270916 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.874270916 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.874289989 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.875232935 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.875279903 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.875298977 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.875308037 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.875336885 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.889610052 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.901983023 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902010918 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902019978 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902050018 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902106047 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.902165890 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902214050 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.902271986 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.921027899 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.922972918 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.923022032 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.923042059 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.923084974 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.923120022 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.923144102 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.923284054 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.923343897 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.931617975 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.940884113 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.940907955 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.942440987 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.962980986 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.963443041 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:29:59.963746071 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:29:59.966463089 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:29:59.966517925 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:29:59.966610909 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:29:59.966846943 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:29:59.966877937 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.004139900 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.029222012 CEST	49751	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.029279947 CEST	443	49751	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.034553051 CEST	49752	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.034603119 CEST	443	49752	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.035537958 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.035589933 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.035619974 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.035644054 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.035676003 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.035856962 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.036364079 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.036418915 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.036432981 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.036448956 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.036497116 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.036546946 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.036645889 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.039681911 CEST	49749	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.039705992 CEST	443	49749	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.043953896 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.044244051 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.044262886 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.045355082 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.046117067 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.046288967 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.046298027 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.088150024 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.092264891 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.223484039 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.223540068 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.223685980 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.223747015 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.225017071 CEST	49753	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.225038052 CEST	443	49753	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.306441069 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.307014942 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:00.307070971 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.308729887 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.308805943 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:00.311269999 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:00.311363935 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.346179008 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.346255064 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:00.346482992 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.349373102 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.349402905 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:00.359042883 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:00.359062910 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:00.379322052 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.379481077 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.379549980 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.380983114 CEST	49754	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:00.380997896 CEST	443	49754	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:00.403424978 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:00.776138067 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:00.776277065 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.817104101 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.817140102 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:00.817507029 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:00.857043982 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:00.900137901 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.208704948 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.208861113 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.208899975 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.208955050 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.208992004 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.208992004 CEST	49758	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.209018946 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.209038973 CEST	443	49758	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.249905109 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.249963999 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.250058889 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.250576019 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.250608921 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.673871994 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.673962116 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.678546906 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.678575039 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.678916931 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.682559967 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:01.724159002 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:01.983026981 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:01.983125925 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:01.983208895 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:01.988136053 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:01.988168001 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.090143919 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:02.090302944 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:02.091041088 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:02.091628075 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:02.091628075 CEST	49761	443	192.168.2.4	23.197.180.115
Apr 26, 2024 03:30:02.091665030 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:02.091690063 CEST	443	49761	23.197.180.115	192.168.2.4
Apr 26, 2024 03:30:02.323441982 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.325130939 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.325148106 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.326248884 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.327244997 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.327420950 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.327675104 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.368148088 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.388865948 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.665751934 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.665899992 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:02.666224957 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.666836977 CEST	49762	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:02.666873932 CEST	443	49762	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.123049021 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.123130083 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.123229980 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.123441935 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.123471022 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.461560011 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.462243080 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.462302923 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.465913057 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.465996981 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.476212978 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.476361036 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.476385117 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.476625919 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.530075073 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.530107021 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.576953888 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.797070980 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.797262907 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:03.797331095 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.798774004 CEST	49763	443	192.168.2.4	69.64.48.35
Apr 26, 2024 03:30:03.798811913 CEST	443	49763	69.64.48.35	192.168.2.4
Apr 26, 2024 03:30:08.824208021 CEST	80	49723	208.111.136.128	192.168.2.4
Apr 26, 2024 03:30:08.824975014 CEST	49723	80	192.168.2.4	208.111.136.128
Apr 26, 2024 03:30:08.829284906 CEST	49723	80	192.168.2.4	208.111.136.128
Apr 26, 2024 03:30:08.955502987 CEST	80	49723	208.111.136.128	192.168.2.4
Apr 26, 2024 03:30:10.302277088 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:10.302372932 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:10.302436113 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:11.642110109 CEST	49757	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:11.642165899 CEST	443	49757	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:23.269623041 CEST	80	49724	208.111.136.128	192.168.2.4
Apr 26, 2024 03:30:23.269718885 CEST	49724	80	192.168.2.4	208.111.136.128
Apr 26, 2024 03:30:23.269763947 CEST	49724	80	192.168.2.4	208.111.136.128
Apr 26, 2024 03:30:23.396308899 CEST	80	49724	208.111.136.128	192.168.2.4
Apr 26, 2024 03:30:59.811233997 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:59.811279058 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:30:59.811345100 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:59.811562061 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:30:59.811575890 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:00.139303923 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:00.139614105 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:31:00.139630079 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:00.140074968 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:00.140494108 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:31:00.140564919 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:00.185112000 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:31:10.141124964 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:10.141205072 CEST	443	49772	172.217.15.196	192.168.2.4
Apr 26, 2024 03:31:10.141330004 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:31:11.946059942 CEST	49772	443	192.168.2.4	172.217.15.196
Apr 26, 2024 03:31:11.946093082 CEST	443	49772	172.217.15.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 03:29:55.370639086 CEST	53	51840	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:55.381177902 CEST	53	56932	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:56.366862059 CEST	53	55403	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:57.209471941 CEST	52521	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:57.209706068 CEST	64975	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:57.376245022 CEST	53	64975	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:57.444679022 CEST	53	52521	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:58.367465019 CEST	63389	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:58.367964029 CEST	61556	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:58.492738962 CEST	53	63389	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:58.493437052 CEST	53	50689	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:58.493616104 CEST	53	61556	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:59.285959005 CEST	53	63615	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:59.767285109 CEST	53985	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:59.767678976 CEST	58879	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:29:59.892762899 CEST	53	53985	1.1.1.1	192.168.2.4
Apr 26, 2024 03:29:59.893438101 CEST	53	58879	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:00.913894892 CEST	53	53441	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:02.863111973 CEST	53261	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:30:02.863421917 CEST	60433	53	192.168.2.4	1.1.1.1
Apr 26, 2024 03:30:03.070585012 CEST	53	53261	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:03.072212934 CEST	53	60433	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:09.562764883 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 03:30:13.658493996 CEST	53	60514	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:32.451280117 CEST	53	55708	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:55.206990004 CEST	53	63937	1.1.1.1	192.168.2.4
Apr 26, 2024 03:30:55.287997007 CEST	53	64010	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 03:29:57.209471941 CEST	192.168.2.4	1.1.1.1	0xa5bd	Standard query (0)	qhs-rx.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:57.209706068 CEST	192.168.2.4	1.1.1.1	0x830	Standard query (0)	qhs-rx.com	65	IN (0x0001)	false
Apr 26, 2024 03:29:58.367465019 CEST	192.168.2.4	1.1.1.1	0x4567	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:58.367964029 CEST	192.168.2.4	1.1.1.1	0xfa0	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Apr 26, 2024 03:29:59.767285109 CEST	192.168.2.4	1.1.1.1	0xfec7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:59.767678976 CEST	192.168.2.4	1.1.1.1	0xa791	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 03:30:02.863111973 CEST	192.168.2.4	1.1.1.1	0x9bb8	Standard query (0)	qhs-rx.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:30:02.863421917 CEST	192.168.2.4	1.1.1.1	0xb2f	Standard query (0)	qhs-rx.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 03:29:57.444679022 CEST	1.1.1.1	192.168.2.4	0xa5bd	No error (0)	qhs-rx.com		69.64.48.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:58.492738962 CEST	1.1.1.1	192.168.2.4	0x4567	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:58.492738962 CEST	1.1.1.1	192.168.2.4	0x4567	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:58.493616104 CEST	1.1.1.1	192.168.2.4	0xfa0	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Apr 26, 2024 03:29:59.892762899 CEST	1.1.1.1	192.168.2.4	0xfec7	No error (0)	www.google.com		172.217.15.196	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:29:59.893438101 CEST	1.1.1.1	192.168.2.4	0xa791	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 03:30:03.070585012 CEST	1.1.1.1	192.168.2.4	0x9bb8	No error (0)	qhs-rx.com		69.64.48.35	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:30:12.507533073 CEST	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 03:30:12.507533073 CEST	1.1.1.1	192.168.2.4	0x35ce	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:30:28.771641016 CEST	1.1.1.1	192.168.2.4	0xe140	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 03:30:28.771641016 CEST	1.1.1.1	192.168.2.4	0xe140	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:30:47.533027887 CEST	1.1.1.1	192.168.2.4	0x315	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 03:30:47.533027887 CEST	1.1.1.1	192.168.2.4	0x315	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 03:31:08.546912909 CEST	1.1.1.1	192.168.2.4	0x1588	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 03:31:08.546912909 CEST	1.1.1.1	192.168.2.4	0x1588	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

qhs-rx.com

https:

cdnjs.cloudflare.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:57 UTC	722	OUT	GET /index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 01:29:58 UTC	608	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-XSS-Protection: 1; mode=block Set-Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; path=/; HttpOnly Set-Cookie: csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B; path=/; HttpOnly X-Powered-By: PleskLin
2024-04-26 01:29:58 UTC	7636	IN	Data Raw: 31 64 63 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 63 73 72 66 5f 74 6f 6b 65 6e 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 73 72 66 2d 74 6f 6b 65 6e 2d 76 61 6c 75 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 55 64 4a 55 46 64 44 56 46 42 45 56 54 52 5a 52 6e 56 32 64 30 39 34 4d 6b 4e 76 61 45 74 49 62 33 45 35 65 48 42 5a 5a 6d 2d 74 70 41 33 6f 54 63 74 42 79 33 77 62 4b 33 5a 4c 73 75 38 79 52 76 70 62 48 36 33 7a 47 51 4b 66 68 68 6a 50 54 74 50 50 58 67 Data Ascii: 1dc7<!DOCTYPE html><html dir="ltr"><head> <meta charset="utf-8"> <meta name="csrf-token-name" content="csrf_token" /><meta name="csrf-token-value" content="QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	833	OUT	GET /assets/css/bootstrap.min.css?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:58 UTC	253	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css Content-Length: 99961 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-18679" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:58 UTC	16131	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 31 2e 31 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 34 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 0a 0a 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 30 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 Data Ascii: /! Bootstrap v3.1.1 (http://getbootstrap.com) * Copyright 2011-2014 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.0 \| MIT License \| git.io/normalize */html{font-family:sans-ser
2024-04-26 01:29:58 UTC	16384	IN	Data Raw: 2d 31 7b 6c 65 66 74 3a 38 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 70 75 73 68 2d 30 7b 6c 65 66 74 3a 30 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 32 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 31 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 39 31 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 31 30 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 33 2e 33 33 33 33 33 33 33 33 25 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 37 35 25 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 38 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 36 36 2e 36 36 36 36 36 36 36 37 25 7d 2e 63 6f 6c 2d 6c 67 2d 6f 66 66 73 65 74 2d 37 7b Data Ascii: -1{left:8.33333333%}.col-lg-push-0{left:0}.col-lg-offset-12{margin-left:100%}.col-lg-offset-11{margin-left:91.66666667%}.col-lg-offset-10{margin-left:83.33333333%}.col-lg-offset-9{margin-left:75%}.col-lg-offset-8{margin-left:66.66666667%}.col-lg-offset-7{
2024-04-26 01:29:58 UTC	16384	IN	Data Raw: 3a 66 6f 63 75 73 2c 2e 62 74 6e 2d 69 6e 66 6f 3a 61 63 74 69 76 65 2c 2e 62 74 6e 2d 69 6e 66 6f 2e 61 63 74 69 76 65 2c 2e 6f 70 65 6e 20 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 62 74 6e 2d 69 6e 66 6f 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 39 62 33 64 37 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 36 39 61 62 63 7d 2e 62 74 6e 2d 69 6e 66 6f 3a 61 63 74 69 76 65 2c 2e 62 74 6e 2d 69 6e 66 6f 2e 61 63 74 69 76 65 2c 2e 6f 70 65 6e 20 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 62 74 6e 2d 69 6e 66 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6e 6f 6e 65 7d 2e 62 74 6e 2d 69 6e 66 6f 2e 64 69 73 61 62 6c 65 64 2c 2e 62 74 6e 2d 69 6e 66 6f 5b 64 69 73 61 62 6c 65 64 Data Ascii: :focus,.btn-info:active,.btn-info.active,.open .dropdown-toggle.btn-info{color:#fff;background-color:#39b3d7;border-color:#269abc}.btn-info:active,.btn-info.active,.open .dropdown-toggle.btn-info{background-image:none}.btn-info.disabled,.btn-info[disabled
2024-04-26 01:29:58 UTC	16384	IN	Data Raw: 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 7d 2e 62 74 6e 2d 67 72 6f 75 70 3e 2e 62 74 6e 2d 67 72 6f 75 70 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 62 74 6e 2d 67 72 6f 75 70 3e 2e 62 74 6e 2d 67 72 6f 75 70 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 63 68 69 6c 64 29 3a 6e 6f 74 28 3a 6c 61 73 74 2d 63 68 69 6c 64 29 3e 2e 62 74 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 2e 62 74 6e 2d 67 72 6f 75 70 3e 2e 62 74 6e 2d 67 72 6f 75 70 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 2e 62 74 6e 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 2e 62 74 6e 2d 67 72 6f 75 70 3e 2e 62 74 6e 2d 67 72 6f 75 70 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 Data Ascii: top-left-radius:0}.btn-group>.btn-group{float:left}.btn-group>.btn-group:not(:first-child):not(:last-child)>.btn{border-radius:0}.btn-group>.btn-group:first-child>.btn:last-child,.btn-group>.btn-group:first-child>.dropdown-toggle{border-bottom-right-radiu
2024-04-26 01:29:58 UTC	16384	IN	Data Raw: 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 2e 64 69 73 61 62 6c 65 64 3e 61 3a 66 6f 63 75 73 7b 63 6f 6c 6f 72 3a 23 34 34 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 3a 68 6f 76 65 72 2c 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 20 2e 6e 61 76 62 61 72 2d 74 6f 67 67 Data Ascii: bar-inverse .navbar-nav>.disabled>a:focus{color:#444;background-color:transparent}.navbar-inverse .navbar-toggle{border-color:#333}.navbar-inverse .navbar-toggle:hover,.navbar-inverse .navbar-toggle:focus{background-color:#333}.navbar-inverse .navbar-togg
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 2e 74 61 62 6c 65 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 62 6f 64 79 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 74 68 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 33 70 78 7d 2e 70 61 6e 65 6c 3e 2e 74 61 62 6c 65 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 2e 70 61 6e 65 6c 3e 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3a 6c 61 73 74 2d 63 68 69 6c 64 3e 2e 74 61 62 6c 65 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 Data Ascii: able-responsive:first-child>.table:first-child>tbody:first-child>tr:first-child th:last-child{border-top-right-radius:3px}.panel>.table:last-child,.panel>.table-responsive:last-child>.table:last-child{border-bottom-right-radius:3px;border-bottom-left-radi
2024-04-26 01:29:59 UTC	1910	IN	Data Raw: 6f 64 61 6c 2d 66 6f 6f 74 65 72 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 63 65 6e 74 65 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 7d 2e 70 75 6c 6c 2d 72 69 67 68 74 7b 66 6c 6f 61 74 3a 72 69 67 68 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 75 6c 6c 2d 6c 65 66 74 7b 66 6c 6f 61 74 3a 6c 65 66 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 68 6f 77 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 6e 76 69 73 69 62 6c 65 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 74 65 78 74 2d 68 69 64 Data Ascii: odal-footer:after{clear:both}.center-block{display:block;margin-left:auto;margin-right:auto}.pull-right{float:right!important}.pull-left{float:left!important}.hide{display:none!important}.show{display:block!important}.invisible{visibility:hidden}.text-hid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	828	OUT	GET /assets/css/adminlte.css?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	254	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css Content-Length: 210752 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-33740" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	16130	IN	Data Raw: 0a 2f 2a 21 0a 20 2a 20 20 20 41 64 6d 69 6e 4c 54 45 20 76 32 2e 33 2e 36 0a 20 2a 20 20 20 41 75 74 68 6f 72 3a 20 41 6c 6d 73 61 65 65 64 20 53 74 75 64 69 6f 0a 20 2a 09 20 57 65 62 73 69 74 65 3a 20 41 6c 6d 73 61 65 65 64 20 53 74 75 64 69 6f 20 3c 68 74 74 70 3a 2f 2f 61 6c 6d 73 61 65 65 64 73 74 75 64 69 6f 2e 63 6f 6d 3e 0a 20 2a 20 20 20 4c 69 63 65 6e 73 65 3a 20 4f 70 65 6e 20 73 6f 75 72 63 65 20 2d 20 4d 49 54 0a 20 2a 20 20 20 20 20 20 20 20 20 20 20 50 6c 65 61 73 65 20 76 69 73 69 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0a 21 2a 2f 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 Data Ascii: /! AdminLTE v2.3.6 * Author: Almsaeed Studio * Website: Almsaeed Studio <http://almsaeedstudio.com> * License: Open source - MIT * Please visit http://opensource.org/licenses/MIT for more information!*/@import url(https://fonts
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 6e 75 20 3e 20 6c 69 2e 68 65 61 64 65 72 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 63 6c 69 70 3b 0a 7d 0a 2e 73 69 64 65 62 61 72 2d 6d 65 6e 75 20 6c 69 20 3e 20 61 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 2e 73 69 64 65 62 61 72 2d 6d 65 6e 75 20 6c 69 20 3e 20 61 20 3e 20 2e 70 75 6c 6c 2d 72 69 67 68 74 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 72 69 67 68 74 3a 20 31 30 70 78 3b 0a 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 37 70 78 3b 0a 7d 0a 2f 2a 0a 20 2a 20 43 6f 6d 70 6f 6e 65 6e 74 3a 20 43 6f 6e 74 72 6f 6c 20 73 69 64 Data Ascii: nu > li.header { overflow: hidden; text-overflow: clip;}.sidebar-menu li > a { position: relative;}.sidebar-menu li > a > .pull-right-container { position: absolute; right: 10px; top: 50%; margin-top: -7px;}/* * Component: Control sid
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 72 6e 69 6e 67 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 20 7b 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 66 33 39 63 31 32 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 66 6f 72 6d 2d 67 72 6f 75 70 2e 68 61 73 2d 77 61 72 6e 69 6e 67 20 2e 68 65 6c 70 2d 62 6c 6f 63 6b 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 33 39 63 31 32 3b 0a 7d 0a 2e 66 6f 72 6d 2d 67 72 6f 75 70 2e 68 61 73 2d 65 72 72 6f 72 20 6c 61 62 65 6c 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 65 65 33 35 32 34 3b 0a 7d 0a 2e 66 6f 72 6d 2d 67 72 6f 75 70 2e 68 61 73 2d 65 72 72 6f 72 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2c 0a 2e 66 6f 72 6d 2d 67 72 6f 75 70 2e 68 61 73 2d 65 72 72 6f 72 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 Data Ascii: rning .input-group-addon { border-color: #f39c12; box-shadow: none;}.form-group.has-warning .help-block { color: #f39c12;}.form-group.has-error label { color: #ee3524;}.form-group.has-error .form-control,.form-group.has-error .input-group-a
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 68 69 73 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 6e 65 78 74 20 6d 61 6a 6f 72 20 72 65 6c 65 61 73 65 2e 20 55 73 65 20 44 69 72 65 63 74 20 43 68 61 74 20 69 6e 73 74 65 61 64 29 2a 2f 0a 2e 63 68 61 74 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 32 30 70 78 20 35 70 78 20 31 30 70 78 3b 0a 7d 0a 2e 63 68 61 74 20 2e 69 74 65 6d 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 7d 0a 2e 63 68 61 74 20 2e 69 74 65 6d 3a 62 65 66 6f 72 65 2c 0a 2e 63 68 61 74 20 2e 69 74 65 6d 3a 61 66 74 65 72 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 20 22 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 0a 7d 0a 2e 63 68 61 74 20 2e 69 74 65 6d 3a 61 66 74 65 72 20 7b 0a 20 20 63 6c 65 61 Data Ascii: his will be removed in the next major release. Use Direct Chat instead)*/.chat { padding: 5px 20px 5px 10px;}.chat .item { margin-bottom: 10px;}.chat .item:before,.chat .item:after { content: " "; display: table;}.chat .item:after { clea
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 74 61 62 6c 65 2e 61 6c 69 67 6e 20 74 68 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 74 61 62 6c 65 2e 61 6c 69 67 6e 20 74 64 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 72 69 67 68 74 3b 0a 7d 0a 2f 2a 0a 20 2a 20 43 6f 6d 70 6f 6e 65 6e 74 3a 20 4c 61 62 65 6c 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 2f 0a 6c 61 62 65 6c 20 7b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 7d 0a 2e 6c 61 62 65 6c 2d 64 65 66 61 75 6c 74 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 64 32 64 36 64 65 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 0a 7d 0a 2f 2a 0a 20 2a 20 43 6f 6d 70 6f 6e 65 6e 74 3a 20 44 69 Data Ascii: : center;}.table.align th { text-align: left;}.table.align td { text-align: right;}/* * Component: Label * ---------------- /label { font-weight: normal;}.label-default { background-color: #d2d6de; color: #444;}/ * Component: Di
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 69 74 62 75 63 6b 65 74 3a 61 63 74 69 76 65 2c 0a 2e 62 74 6e 2d 62 69 74 62 75 63 6b 65 74 2e 61 63 74 69 76 65 2c 0a 2e 6f 70 65 6e 20 3e 20 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 62 74 6e 2d 62 69 74 62 75 63 6b 65 74 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 31 36 33 37 35 38 3b 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0a 7d 0a 2e 62 74 6e 2d 62 69 74 62 75 63 6b 65 74 3a 61 63 74 69 76 65 3a 68 6f 76 65 72 2c 0a 2e 62 74 6e 2d 62 69 74 62 75 63 6b 65 74 2e 61 63 74 69 76 65 3a 68 6f 76 65 72 2c 0a 2e 6f 70 65 6e 20 3e 20 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 2e 62 74 6e 2d 62 69 74 62 75 Data Ascii: itbucket:active,.btn-bitbucket.active,.open > .dropdown-toggle.btn-bitbucket { color: #fff; background-color: #163758; border-color: rgba(0, 0, 0, 0.2);}.btn-bitbucket:active:hover,.btn-bitbucket.active:hover,.open > .dropdown-toggle.btn-bitbu
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 5b 64 69 73 61 62 6c 65 64 5d 2e 66 6f 63 75 73 2c 0a 66 69 65 6c 64 73 65 74 5b 64 69 73 61 62 6c 65 64 5d 20 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 2e 66 6f 63 75 73 2c 0a 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 2e 64 69 73 61 62 6c 65 64 3a 61 63 74 69 76 65 2c 0a 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 5b 64 69 73 61 62 6c 65 64 5d 3a 61 63 74 69 76 65 2c 0a 66 69 65 6c 64 73 65 74 5b 64 69 73 61 62 6c 65 64 5d 20 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 3a 61 63 74 69 76 65 2c 0a 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 2e 64 69 73 61 62 6c 65 64 2e 61 63 74 69 76 65 2c 0a 2e 62 74 6e 2d 6d 69 63 72 6f 73 6f 66 74 5b 64 69 73 61 62 6c 65 64 5d 2e 61 63 74 69 76 65 2c 0a 66 69 65 6c 64 73 65 74 5b 64 69 73 Data Ascii: tn-microsoft[disabled].focus,fieldset[disabled] .btn-microsoft.focus,.btn-microsoft.disabled:active,.btn-microsoft[disabled]:active,fieldset[disabled] .btn-microsoft:active,.btn-microsoft.disabled.active,.btn-microsoft[disabled].active,fieldset[dis
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 20 6c 69 6e 65 61 72 20 30 2e 33 73 3b 0a 20 20 2d 6d 6f 7a 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 20 6c 69 6e 65 61 72 20 30 2e 33 73 3b 0a 20 20 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 20 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 20 6c 69 6e 65 61 72 20 30 2e 33 73 3b 0a 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 74 72 61 6e 73 66 6f 72 6d 20 6c 69 6e 65 61 72 20 30 2e 33 73 3b 0a 7d 0a 2e 66 63 2d 63 6f 6c 6f 72 2d 70 69 63 6b 65 72 20 3e 20 6c 69 20 2e 66 61 3a 68 6f 76 65 72 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 30 64 65 67 29 3b 0a 20 20 2d 6d 73 2d 74 72 Data Ascii: bkit-transition: -webkit-transform linear 0.3s; -moz-transition: -moz-transform linear 0.3s; -o-transition: -o-transform linear 0.3s; transition: transform linear 0.3s;}.fc-color-picker > li .fa:hover { -webkit-transform: rotate(30deg); -ms-tr
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 2e 69 6d 67 2d 73 6d 20 2b 20 2e 69 6d 67 2d 70 75 73 68 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 30 70 78 3b 0a 7d 0a 2e 69 6d 67 2d 6d 64 20 7b 0a 20 20 77 69 64 74 68 3a 20 36 30 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 36 30 70 78 3b 0a 7d 0a 2e 69 6d 67 2d 6d 64 20 2b 20 2e 69 6d 67 2d 70 75 73 68 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 37 30 70 78 3b 0a 7d 0a 2e 69 6d 67 2d 6c 67 20 7b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 70 78 3b 0a 7d 0a 2e 69 6d 67 2d 6c 67 20 2b 20 2e 69 6d 67 2d 70 75 73 68 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 31 30 70 78 3b 0a 7d 0a 2e 69 6d 67 2d 62 6f 72 64 65 72 65 64 20 Data Ascii: px !important;}.img-sm + .img-push { margin-left: 40px;}.img-md { width: 60px; height: 60px;}.img-md + .img-push { margin-left: 70px;}.img-lg { width: 100px; height: 100px;}.img-lg + .img-push { margin-left: 110px;}.img-bordered
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 39 20 2e 73 6d 61 6c 6c 2d 62 6f 78 20 3e 20 2e 69 6e 6e 65 72 20 2e 6d 69 64 64 6c 65 2c 0a 2e 62 6f 78 65 73 2d 6d 77 2d 77 72 61 70 70 65 72 2e 72 6f 77 20 2e 63 6f 6c 2d 78 73 2d 31 20 2e 73 6d 61 6c 6c 2d 62 6f 78 20 3e 20 2e 69 6e 6e 65 72 20 2e 6d 69 64 64 6c 65 2c 0a 2e 62 6f 78 65 73 2d 6d 77 2d 77 72 61 70 70 65 72 2e 72 6f 77 20 2e 63 6f 6c 2d 78 73 2d 31 30 20 2e 73 6d 61 6c 6c 2d 62 6f 78 20 3e 20 2e 69 6e 6e 65 72 20 2e 6d 69 64 64 6c 65 2c 0a 2e 62 6f 78 65 73 2d 6d 77 2d 77 72 61 70 70 65 72 2e 72 6f 77 20 2e 63 6f 6c 2d 78 73 2d 31 31 20 2e 73 6d 61 6c 6c 2d 62 6f 78 20 3e 20 2e 69 6e 6e 65 72 20 2e 6d 69 64 64 6c 65 2c 0a 2e 62 6f 78 65 73 2d 6d 77 2d 77 72 61 70 70 65 72 2e 72 6f 77 20 2e 63 6f 6c 2d 78 73 2d 31 32 20 2e 73 6d 61 6c 6c Data Ascii: 9 .small-box > .inner .middle,.boxes-mw-wrapper.row .col-xs-1 .small-box > .inner .middle,.boxes-mw-wrapper.row .col-xs-10 .small-box > .inner .middle,.boxes-mw-wrapper.row .col-xs-11 .small-box > .inner .middle,.boxes-mw-wrapper.row .col-xs-12 .small

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	834	OUT	GET /frontend/assets/css/style.css?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	252	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css Content-Length: 16326 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-3fc6" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	16132	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 4f 70 65 6e 20 53 61 6e 73 22 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 7d 0a 2e 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 33 30 70 78 20 30 20 30 20 30 3b 0a 7d 0a 68 31 2c 0a 68 32 20 68 33 2c 0a 68 34 2c 0a 68 35 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c Data Ascii: body { font-family: "Open Sans", Verdana, Arial, Helvetica, sans-serif; color: #3a3a3a; background-color: #FFFFFF;}.content-wrapper { background-color: #FFFFFF; padding: 30px 0 0 0;}h1,h2 h3,h4,h5 { font-family: "Helvetica Neue", Arial,
2024-04-26 01:29:59 UTC	194	IN	Data Raw: 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 34 70 78 3b 0a 7d 0a 66 6f 6f 74 65 72 20 75 6c 2e 6c 69 6e 6b 73 20 6c 69 20 2b 20 6c 69 20 7b 0a 20 20 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 33 61 33 61 33 61 3b 0a 7d 0a 62 6f 64 79 2e 63 74 72 6c 2d 6c 69 73 74 73 20 66 6f 6f 74 65 72 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 62 6f 64 79 2e 63 74 72 6c 2d 6c 69 73 74 73 2e 61 63 74 2d 62 6c 6f 63 6b 5f 61 64 64 72 65 73 73 20 66 6f 6f 74 65 72 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a Data Ascii: ; line-height: 14px;}footer ul.links li + li { border-left: 1px solid #3a3a3a;}body.ctrl-lists footer { display: none;}body.ctrl-lists.act-block_address footer { display: block;}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	829	OUT	GET /assets/css/skin-blue.css?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	250	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css Content-Length: 3588 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-e04" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	3588	IN	Data Raw: 2f 2a 0a 20 2a 20 53 6b 69 6e 3a 20 42 6c 75 65 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 2f 0a 2e 73 6b 69 6e 2d 62 6c 75 65 20 2e 6d 61 69 6e 2d 68 65 61 64 65 72 20 2e 6e 61 76 62 61 72 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 62 66 36 66 38 3b 0a 7d 0a 2e 73 6b 69 6e 2d 62 6c 75 65 20 2e 6d 61 69 6e 2d 68 65 61 64 65 72 20 2e 6e 61 76 62 61 72 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 38 63 61 39 3b 0a 7d 0a 2e 73 6b 69 6e 2d 62 6c 75 65 20 2e 6d 61 69 6e 2d 68 65 61 64 65 72 20 2e 6e 61 76 62 61 72 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 3a 68 6f 76 65 72 2c 0a 2e 73 6b 69 6e 2d 62 6c 75 65 20 2e 6d 61 69 6e 2d 68 65 61 64 65 72 20 2e 6e 61 76 62 61 72 20 2e 6e Data Ascii: /* * Skin: Blue * ---------- */.skin-blue .main-header .navbar { background-color: #ebf6f8;}.skin-blue .main-header .navbar .nav > li > a { color: #008ca9;}.skin-blue .main-header .navbar .nav > li > a:hover,.skin-blue .main-header .navbar .n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	823	OUT	GET /frontend/assets/cache/591dbfd1/jquery.min.js HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	267	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: application/javascript Content-Length: 95786 Last-Modified: Thu, 08 Feb 2024 05:07:05 GMT Connection: close ETag: "65c46179-1762a" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	16117	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 31 2e 31 31 2e 31 20 7c 20 28 63 29 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e Data Ascii: /! jQuery v1.11.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a win
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c 2c 66 2c 63 29 2c 21 63 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 68 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 66 62 28 61 2c 62 29 2e 6c 65 6e 67 74 68 3e 30 7d 7d 29 2c 63 6f 6e 74 61 69 6e 73 3a 68 62 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 28 62 2e 74 65 78 74 43 6f 6e 74 65 6e 74 7c 7c 62 2e 69 6e 6e 65 72 54 65 78 74 7c 7c 65 28 62 29 29 2e 69 6e 64 65 78 4f 66 28 61 29 3e 2d 31 7d 7d 29 2c 6c 61 6e 67 3a 68 62 28 66 75 6e 63 Data Ascii: &&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),!c.pop()}}),has:hb(function(a){return function(b){return fb(a,b).length>0}}),contains:hb(function(a){return function(b){return(b.textContent\|\|b.innerText\|\|e(b)).indexOf(a)>-1}}),lang:hb(func
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 28 66 3d 67 5b 62 5d 2c 6e 75 6c 6c 3d 3d 66 26 26 28 66 3d 67 5b 6d 2e 63 61 6d 65 6c 43 61 73 65 28 62 29 5d 29 29 3a 66 3d 67 2c 66 7d 7d 66 75 6e 63 74 69 6f 6e 20 52 28 61 2c 62 2c 63 29 7b 69 66 28 6d 2e 61 63 63 65 70 74 44 61 74 61 28 61 29 29 7b 76 61 72 20 64 2c 65 2c 66 3d 61 2e 6e 6f 64 65 54 79 70 65 2c 67 3d 66 3f 6d 2e 63 61 63 68 65 3a 61 2c 68 3d 66 3f 61 5b 6d 2e 65 78 70 61 6e 64 6f 5d 3a 6d 2e 65 78 70 61 6e 64 6f 3b 69 66 28 67 5b 68 5d 29 7b 69 66 28 62 26 26 28 64 3d 63 3f 67 5b 68 5d 3a 67 5b 68 5d 2e 64 61 74 61 29 29 7b 6d 2e 69 73 41 72 72 61 79 28 62 29 3f 62 3d 62 2e 63 6f 6e 63 61 74 28 6d 2e 6d 61 70 28 62 2c 6d 2e 63 61 6d 65 6c 43 61 73 65 29 29 3a 62 20 69 6e 20 64 3f 62 3d 5b 62 5d 3a 28 62 3d 6d 2e 63 61 6d 65 6c 43 61 Data Ascii: (f=g[b],null==f&&(f=g[m.camelCase(b)])):f=g,f}}function R(a,b,c){if(m.acceptData(a)){var d,e,f=a.nodeType,g=f?m.cache:a,h=f?a[m.expando]:m.expando;if(g[h]){if(b&&(d=c?g[h]:g[h].data)){m.isArray(b)?b=b.concat(m.map(b,m.camelCase)):b in d?b=[b]:(b=m.camelCa
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 20 75 62 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 3d 30 2c 66 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 21 3d 3d 4b 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 62 7c 7c 22 2a 22 29 3a 74 79 70 65 6f 66 20 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 21 3d 3d 4b 3f 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 62 7c 7c 22 2a 22 29 3a 76 6f 69 64 20 30 3b 69 66 28 21 66 29 66 6f 72 28 66 3d 5b 5d 2c 63 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 7c 7c 61 3b 6e 75 6c 6c 21 3d 28 64 3d 63 5b 65 5d 29 3b 65 2b 2b 29 21 62 7c 7c 6d 2e 6e 6f 64 65 4e 61 6d 65 28 64 2c 62 29 3f 66 2e 70 75 73 68 28 64 29 3a 6d 2e 6d 65 72 67 65 28 66 2c 75 62 28 64 2c 62 Data Ascii: ction ub(a,b){var c,d,e=0,f=typeof a.getElementsByTagName!==K?a.getElementsByTagName(b\|\|""):typeof a.querySelectorAll!==K?a.querySelectorAll(b\|\|""):void 0;if(!f)for(f=[],c=a.childNodes\|\|a;null!=(d=c[e]);e++)!b\|\|m.nodeName(d,b)?f.push(d):m.merge(f,ub(d,b
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 2e 35 2d 4d 61 74 68 2e 63 6f 73 28 61 2a 4d 61 74 68 2e 50 49 29 2f 32 7d 7d 2c 6d 2e 66 78 3d 5a 62 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 2c 6d 2e 66 78 2e 73 74 65 70 3d 7b 7d 3b 76 61 72 20 24 62 2c 5f 62 2c 61 63 3d 2f 5e 28 3f 3a 74 6f 67 67 6c 65 7c 73 68 6f 77 7c 68 69 64 65 29 24 2f 2c 62 63 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5b 2b 2d 5d 29 3d 7c 29 28 22 2b 53 2b 22 29 28 5b 61 2d 7a 25 5d 2a 29 24 22 2c 22 69 22 29 2c 63 63 3d 2f 71 75 65 75 65 48 6f 6f 6b 73 24 2f 2c 64 63 3d 5b 69 63 5d 2c 65 63 3d 7b 22 2a 22 3a 5b 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 74 68 69 73 2e 63 72 65 61 74 65 54 77 65 65 6e 28 61 2c 62 29 2c 64 3d 63 2e 63 75 72 28 29 2c 65 3d 62 63 2e 65 78 65 Data Ascii: ){return.5-Math.cos(aMath.PI)/2}},m.fx=Zb.prototype.init,m.fx.step={};var $b,_b,ac=/^(?:toggle\|show\|hide)$/,bc=new RegExp("^(?:([+-])=\|)("+S+")([a-z%])$","i"),cc=/queueHooks$/,dc=[ic],ec={"*":[function(a,b){var c=this.createTween(a,b),d=c.cur(),e=bc.exe
2024-04-26 01:29:59 UTC	14133	IN	Data Raw: 67 20 69 6e 20 68 29 69 66 28 68 5b 67 5d 26 26 68 5b 67 5d 2e 74 65 73 74 28 65 29 29 7b 69 2e 75 6e 73 68 69 66 74 28 67 29 3b 62 72 65 61 6b 7d 69 66 28 69 5b 30 5d 69 6e 20 63 29 66 3d 69 5b 30 5d 3b 65 6c 73 65 7b 66 6f 72 28 67 20 69 6e 20 63 29 7b 69 66 28 21 69 5b 30 5d 7c 7c 61 2e 63 6f 6e 76 65 72 74 65 72 73 5b 67 2b 22 20 22 2b 69 5b 30 5d 5d 29 7b 66 3d 67 3b 62 72 65 61 6b 7d 64 7c 7c 28 64 3d 67 29 7d 66 3d 66 7c 7c 64 7d 72 65 74 75 72 6e 20 66 3f 28 66 21 3d 3d 69 5b 30 5d 26 26 69 2e 75 6e 73 68 69 66 74 28 66 29 2c 63 5b 66 5d 29 3a 76 6f 69 64 20 30 7d 66 75 6e 63 74 69 6f 6e 20 50 63 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 2c 66 2c 67 2c 68 2c 69 2c 6a 3d 7b 7d 2c 6b 3d 61 2e 64 61 74 61 54 79 70 65 73 2e 73 6c 69 63 65 28 29 3b Data Ascii: g in h)if(h[g]&&h[g].test(e)){i.unshift(g);break}if(i[0]in c)f=i[0];else{for(g in c){if(!i[0]\|\|a.converters[g+" "+i[0]]){f=g;break}d\|\|(d=g)}f=f\|\|d}return f?(f!==i[0]&&i.unshift(f),c[f]):void 0}function Pc(a,b,c,d){var e,f,g,h,i,j={},k=a.dataTypes.slice();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	817	OUT	GET /assets/js/bootstrap.min.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	266	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: application/javascript Content-Length: 29110 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-71b6" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	16118	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 31 2e 31 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 34 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 0a 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 42 6f 6f 74 73 74 72 61 70 27 73 20 4a 61 76 61 53 63 72 69 70 74 20 72 65 71 75 69 72 65 73 20 6a 51 75 65 72 79 22 Data Ascii: /! Bootstrap v3.1.1 (http://getbootstrap.com) * Copyright 2011-2014 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery"
2024-04-26 01:29:59 UTC	12992	IN	Data Raw: 74 6f 72 3f 74 68 69 73 2e 5f 6f 70 74 69 6f 6e 73 3d 61 2e 65 78 74 65 6e 64 28 7b 7d 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2c 7b 74 72 69 67 67 65 72 3a 22 6d 61 6e 75 61 6c 22 2c 73 65 6c 65 63 74 6f 72 3a 22 22 7d 29 3a 74 68 69 73 2e 66 69 78 54 69 74 6c 65 28 29 7d 2c 62 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 44 65 66 61 75 6c 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 2e 44 45 46 41 55 4c 54 53 7d 2c 62 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 4f 70 74 69 6f 6e 73 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 61 2e 65 78 74 65 6e 64 28 7b 7d 2c 74 68 69 73 2e 67 65 74 44 65 66 61 75 6c 74 73 28 29 2c 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 64 61 74 61 28 29 2c 62 29 2c 62 2e 64 65 6c 61 79 26 26 22 Data Ascii: tor?this._options=a.extend({},this.options,{trigger:"manual",selector:""}):this.fixTitle()},b.prototype.getDefaults=function(){return b.DEFAULTS},b.prototype.getOptions=function(b){return b=a.extend({},this.getDefaults(),this.$element.data(),b),b.delay&&"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	104.17.25.14	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	593	OUT	GET /ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css?av=9ec570bf HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 01:29:59 UTC	954	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-6b4a" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 102901 Expires: Wed, 16 Apr 2025 01:29:58 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7iovYsrPfjfeLxx7fmELVB92gPzFUnP2d7b5r9c1fuYRgmsZpmoCIuP1oE%2FWTsT%2BmS7lvh2%2FtWWqL3NmFSpcvHE7gTPDgQTk%2FA61%2FO8DOtIbg%2B%2BOOM%2B9Qhs7PZLmIYlXlPNcpIGB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 87a2ce0fac81224b-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 01:29:59 UTC	415	IN	Data Raw: 36 62 34 61 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 35 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 65 6f 74 3f 76 3d 34 2e 35 Data Ascii: 6b4a/! Font Awesome 4.5.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.5
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 35 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 35 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 35 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 74 28 27 73 76 67 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 66 61 7b 64 69 73 70 Data Ascii: l('../fonts/fontawesome-webfont.woff?v=4.5.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.5.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.5.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{disp
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 73 70 69 6e 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 Data Ascii: {0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(35
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 66 61 2d 73 74 61 63 6b 2d 31 78 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 2e 66 61 2d 73 74 61 63 6b 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 69 6e 76 65 72 73 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 66 61 2d 67 6c 61 73 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 30 22 7d 2e 66 61 2d 6d 75 73 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 31 22 7d 2e 66 61 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 32 22 7d 2e 66 61 2d 65 6e 76 65 6c 6f 70 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e Data Ascii: n:absolute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{con
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 34 22 7d 2e 66 61 2d 68 65 61 64 70 68 6f 6e 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 35 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 36 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 37 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 38 22 7d 2e 66 61 2d 71 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 39 22 7d 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 61 22 7d 2e 66 61 2d 74 61 67 3a 62 65 Data Ascii: :before{content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:be
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 39 22 7d 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 61 22 7d 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 62 22 7d 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 63 22 7d 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 64 22 7d 2e 66 61 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 65 22 7d 2e 66 61 2d 66 61 73 74 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 35 30 22 7d 2e 66 61 2d 73 74 65 70 2d 66 6f 72 77 Data Ascii: t-backward:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forw
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 74 3a 22 5c 66 30 37 30 22 7d 2e 66 61 2d 77 61 72 6e 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 31 22 7d 2e 66 61 2d 70 6c 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 32 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 33 22 7d 2e 66 61 2d 72 61 6e 64 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 34 22 7d 2e 66 61 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 35 22 7d 2e 66 61 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 36 22 7d 2e 66 61 2d 63 68 Data Ascii: t:"\f070"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-ch
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 22 7d 2e 66 61 2d 73 71 75 61 72 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 36 22 7d 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 37 22 7d 2e 66 61 2d 70 68 6f 6e 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 38 22 7d 2e 66 61 2d 74 77 69 74 74 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 39 22 7d 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 2d 66 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 61 22 7d 2e 66 61 2d 67 69 74 68 75 62 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 62 22 7d 2e 66 61 2d 75 6e 6c 6f 63 6b 3a 62 Data Ascii: "}.fa-square-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:b
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 2d 66 6c 6f 70 70 79 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 37 22 7d 2e 66 61 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 38 22 7d 2e 66 61 2d 6e 61 76 69 63 6f 6e 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 72 65 6f 72 64 65 72 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 62 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 39 22 7d 2e 66 61 2d 6c 69 73 74 2d 75 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 61 22 7d 2e 66 61 2d 6c 69 73 74 2d 6f 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 62 22 7d 2e 66 61 2d 73 74 72 69 6b 65 74 68 72 6f 75 67 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 63 22 7d 2e 66 61 2d 75 6e 64 Data Ascii: -floppy-o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-und
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 70 61 73 74 65 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 63 6c 69 70 62 6f 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 61 22 7d 2e 66 61 2d 6c 69 67 68 74 62 75 6c 62 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 62 22 7d 2e 66 61 2d 65 78 63 68 61 6e 67 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 63 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 64 6f 77 6e 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 64 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 75 70 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 65 22 7d 2e 66 61 2d 75 73 65 72 2d 6d 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 30 22 7d 2e 66 61 2d 73 74 65 74 68 6f 73 63 6f Data Ascii: paste:before,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethosco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	104.17.25.14	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:58 UTC	585	OUT	GET /ajax/libs/ionicons/2.0.1/css/ionicons.min.css?av=9ec570bf HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://qhs-rx.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 01:29:59 UTC	940	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 01:29:58 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03ea8-c854" Last-Modified: Mon, 04 May 2020 16:11:20 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 102901 Expires: Wed, 16 Apr 2025 01:29:58 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y6OGLB39pRm8RrRecDXUHDKdKwfGuVSpKblybznNIFfnhFRP4wDfhg7Ea%2FmamXPXOvcAqLKDGWWUmQpG944chPhNeoooTTPIoqsoSgkBQqKIZzkpvJkPF8H8iuOzpI6TjHTCiYQm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 87a2ce0fae6f9acf-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 01:29:59 UTC	429	IN	Data Raw: 37 63 30 36 0d 0a 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2f 2a 21 0a 20 20 49 6f 6e 69 63 6f 6e 73 2c 20 76 32 2e 30 2e 30 0a 20 20 43 72 65 61 74 65 64 20 62 79 20 42 65 6e 20 53 70 65 72 72 79 20 66 6f 72 20 74 68 65 20 49 6f 6e 69 63 20 46 72 61 6d 65 77 6f 72 6b 2c 20 68 74 74 70 3a 2f 2f 69 6f 6e 69 63 6f 6e 73 2e 63 6f 6d 2f 0a 20 20 68 74 74 70 73 3a 2f 2f 74 77 69 74 74 65 72 2e 63 6f 6d 2f 62 65 6e 6a 73 70 65 72 72 79 20 20 68 74 74 70 73 3a 2f 2f 74 77 69 74 74 65 72 2e 63 6f 6d 2f 69 6f 6e 69 63 66 72 61 6d 65 77 6f 72 6b 0a 20 20 4d 49 54 20 4c 69 63 65 6e 73 65 3a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 64 72 69 66 74 79 63 6f 2f 69 6f 6e 69 63 6f 6e 73 0a 0a 20 20 41 6e 64 72 6f 69 64 2d 73 74 79 6c 65 20 69 Data Ascii: 7c06@charset "UTF-8";/*! Ionicons, v2.0.0 Created by Ben Sperry for the Ionic Framework, http://ionicons.com/ https://twitter.com/benjsperry https://twitter.com/ionicframework MIT License: https://github.com/driftyco/ionicons Android-style i
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 4d 6f 64 69 66 69 65 64 20 69 63 6f 6e 73 20 74 6f 20 66 69 74 20 69 6f 6e 69 63 6f 6e e2 80 99 73 20 67 72 69 64 20 66 72 6f 6d 20 6f 72 69 67 69 6e 61 6c 2e 0a 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 49 6f 6e 69 63 6f 6e 73 22 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 66 6f 6e 74 73 2f 69 6f 6e 69 63 6f 6e 73 2e 65 6f 74 3f 76 3d 32 2e 30 2e 30 22 29 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 66 6f 6e 74 73 2f 69 6f 6e 69 63 6f 6e 73 2e 65 6f 74 3f 76 3d 32 2e 30 2e 30 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 75 72 6c 28 22 2e 2e 2f 66 6f 6e 74 73 2f 69 6f 6e 69 63 6f 6e 73 2e 74 74 66 3f 76 3d 32 2e 30 2e 30 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 Data Ascii: Modified icons to fit ionicons grid from original.*/@font-face{font-family:"Ionicons";src:url("../fonts/ionicons.eot?v=2.0.0");src:url("../fonts/ionicons.eot?v=2.0.0#iefix") format("embedded-opentype"),url("../fonts/ionicons.ttf?v=2.0.0") format("true
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 64 2d 63 61 72 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 61 72 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 61 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 65 63 6b 62 6f 78 2d 62 6c 61 6e 6b 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 65 63 6b 62 6f 78 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 65 63 6b 62 6f 78 2d 6f 75 74 6c 69 6e 65 2d 62 6c 61 6e 6b 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 63 68 65 63 6b 6d 61 72 6b 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 Data Ascii: d-car:before,.ion-android-cart:before,.ion-android-chat:before,.ion-android-checkbox:before,.ion-android-checkbox-blank:before,.ion-android-checkbox-outline:before,.ion-android-checkbox-outline-blank:before,.ion-android-checkmark-circle:before,.ion-androi
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 6d 69 63 72 6f 70 68 6f 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6d 69 63 72 6f 70 68 6f 6e 65 2d 6f 66 66 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6d 6f 72 65 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6d 6f 72 65 2d 76 65 72 74 69 63 61 6c 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6e 61 76 69 67 61 74 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 2d 6e 6f 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 2d 6f 66 66 Data Ascii: microphone:before,.ion-android-microphone-off:before,.ion-android-more-horizontal:before,.ion-android-more-vertical:before,.ion-android-navigate:before,.ion-android-notifications:before,.ion-android-notifications-none:before,.ion-android-notifications-off
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 76 6f 6c 75 6d 65 2d 75 70 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 77 61 6c 6b 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 77 61 72 6e 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 77 61 74 63 68 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 6e 64 72 6f 69 64 2d 77 69 66 69 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 70 65 72 74 75 72 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 72 63 68 69 76 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 72 72 6f 77 2d 64 6f 77 6e 2d 61 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 72 72 6f 77 2d 64 6f 77 6e 2d 62 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 72 72 6f 77 2d 64 6f 77 6e 2d 63 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 61 72 72 6f 77 2d 65 78 70 61 6e 64 3a Data Ascii: volume-up:before,.ion-android-walk:before,.ion-android-warning:before,.ion-android-watch:before,.ion-android-wifi:before,.ion-aperture:before,.ion-archive:before,.ion-arrow-down-a:before,.ion-arrow-down-b:before,.ion-arrow-down-c:before,.ion-arrow-expand:
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 2d 77 6f 72 6b 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 61 74 62 75 62 62 6c 65 73 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 63 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 63 6b 6d 61 72 6b 2d 63 69 72 63 6c 65 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 63 6b 6d 61 72 6b 2d 72 6f 75 6e 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 6c 69 70 62 6f 61 72 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 63 6c 6f 63 6b 3a 62 65 66 Data Ascii: -working:before,.ion-chatbubbles:before,.ion-checkmark:before,.ion-checkmark-circled:before,.ion-checkmark-round:before,.ion-chevron-down:before,.ion-chevron-left:before,.ion-chevron-right:before,.ion-chevron-up:before,.ion-clipboard:before,.ion-clock:bef
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 75 6f 79 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 68 65 6c 70 2d 63 69 72 63 6c 65 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 68 6f 6d 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 63 65 63 72 65 61 6d 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6d 61 67 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6d 61 67 65 73 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6e 66 6f 72 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 6e 69 63 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 61 6c 61 72 6d 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 61 6c 61 72 6d 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 61 6c 62 75 6d 73 3a 62 65 Data Ascii: uoy:before,.ion-help-circled:before,.ion-home:before,.ion-icecream:before,.ion-image:before,.ion-images:before,.ion-information:before,.ion-information-circled:before,.ion-ionic:before,.ion-ios-alarm:before,.ion-ios-alarm-outline:before,.ion-ios-albums:be
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 69 6f 73 2d 63 61 6c 63 75 6c 61 74 6f 72 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 6c 63 75 6c 61 74 6f 72 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 6c 65 6e 64 61 72 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 6d 65 72 61 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 72 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 61 72 74 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 68 61 74 62 6f 78 65 73 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 63 Data Ascii: ios-calculator:before,.ion-ios-calculator-outline:before,.ion-ios-calendar:before,.ion-ios-calendar-outline:before,.ion-ios-camera:before,.ion-ios-camera-outline:before,.ion-ios-cart:before,.ion-ios-cart-outline:before,.ion-ios-chatboxes:before,.ion-ios-c
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 64 72 61 67 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 65 6d 61 69 6c 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 65 6d 61 69 6c 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 65 79 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 65 79 65 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 66 61 73 74 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 66 61 73 74 66 6f 72 77 61 72 64 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 66 69 6c 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 66 69 6c 69 6e 67 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 Data Ascii: ne:before,.ion-ios-drag:before,.ion-ios-email:before,.ion-ios-email-outline:before,.ion-ios-eye:before,.ion-ios-eye-outline:before,.ion-ios-fastforward:before,.ion-ios-fastforward-outline:before,.ion-ios-filing:before,.ion-ios-filing-outline:before,.ion-i
2024-04-26 01:29:59 UTC	1369	IN	Data Raw: 74 62 75 6c 62 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 69 67 68 74 62 75 6c 62 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 69 73 74 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 69 73 74 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 63 61 74 69 6f 6e 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 63 61 74 69 6f 6e 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 63 6b 65 64 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 63 6b 65 64 2d 6f 75 74 6c 69 6e 65 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 6f 70 3a 62 65 66 6f 72 65 2c 2e 69 6f 6e 2d 69 6f 73 2d 6c 6f 6f 70 2d 73 74 72 6f 6e 67 3a 62 65 66 6f Data Ascii: tbulb:before,.ion-ios-lightbulb-outline:before,.ion-ios-list:before,.ion-ios-list-outline:before,.ion-ios-location:before,.ion-ios-location-outline:before,.ion-ios-locked:before,.ion-ios-locked-outline:before,.ion-ios-loop:before,.ion-ios-loop-strong:befo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:59 UTC	816	OUT	GET /assets/js/knockout.min.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	266	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:59 GMT Content-Type: application/javascript Content-Length: 59822 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-e9ae" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	16118	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4b 6e 6f 63 6b 6f 75 74 20 4a 61 76 61 53 63 72 69 70 74 20 6c 69 62 72 61 72 79 20 76 33 2e 34 2e 30 0a 20 2a 20 28 63 29 20 53 74 65 76 65 6e 20 53 61 6e 64 65 72 73 6f 6e 20 2d 20 68 74 74 70 3a 2f 2f 6b 6e 6f 63 6b 6f 75 74 6a 73 2e 63 6f 6d 2f 0a 20 2a 20 4c 69 63 65 6e 73 65 3a 20 4d 49 54 20 28 68 74 74 70 3a 2f 2f 77 77 77 2e 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 6d 69 74 2d 6c 69 63 65 6e 73 65 2e 70 68 70 29 0a 20 2a 2f 0a 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 78 3d 74 68 69 73 7c 7c 28 30 2c 65 76 61 6c 29 28 22 74 68 69 73 22 29 2c 75 3d 78 2e 64 6f 63 75 6d 65 6e 74 2c 4d 3d 78 2e 6e 61 76 69 67 61 74 6f 72 2c 76 3d 78 2e 6a 51 75 65 Data Ascii: /! Knockout JavaScript library v3.4.0 * (c) Steven Sanderson - http://knockoutjs.com/ * License: MIT (http://www.opensource.org/licenses/mit-license.php) */(function() {(function(n){var x=this\|\|(0,eval)("this"),u=x.document,M=x.navigator,v=x.jQue
2024-04-26 01:29:59 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 4b 5b 61 5d 26 26 0a 74 68 69 73 2e 4b 5b 61 5d 2e 6c 65 6e 67 74 68 7d 2c 53 63 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 69 66 28 62 29 72 65 74 75 72 6e 20 74 68 69 73 2e 4b 5b 62 5d 26 26 74 68 69 73 2e 4b 5b 62 5d 2e 6c 65 6e 67 74 68 7c 7c 30 3b 76 61 72 20 63 3d 30 3b 61 2e 61 2e 44 28 74 68 69 73 2e 4b 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 64 69 72 74 79 22 21 3d 3d 61 26 26 28 63 2b 3d 62 2e 6c 65 6e 67 74 68 29 7d 29 3b 72 65 74 75 72 6e 20 63 7d 2c 74 62 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 63 29 7b 72 65 74 75 72 6e 21 74 68 69 73 2e 65 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 7c 7c 21 74 68 69 73 2e 65 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 28 61 2c 63 29 7d 2c Data Ascii: nction(a){return this.K[a]&&this.K[a].length},Sc:function(b){if(b)return this.K[b]&&this.K[b].length\|\|0;var c=0;a.a.D(this.K,function(a,b){"dirty"!==a&&(c+=b.length)});return c},tb:function(a,c){return!this.equalityComparer\|\|!this.equalityComparer(a,c)},
2024-04-26 01:30:00 UTC	16384	IN	Data Raw: 26 67 28 62 2c 63 2c 21 68 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3d 7b 7d 2c 65 3d 5b 5d 3b 61 2e 61 2e 44 28 62 2c 66 75 6e 63 74 69 6f 6e 20 5a 28 68 29 7b 69 66 28 21 64 5b 68 5d 29 7b 76 61 72 20 66 3d 0a 61 2e 67 65 74 42 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 28 68 29 3b 66 26 26 28 66 2e 61 66 74 65 72 26 26 28 65 2e 70 75 73 68 28 68 29 2c 61 2e 61 2e 71 28 66 2e 61 66 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 69 66 28 62 5b 63 5d 29 7b 69 66 28 2d 31 21 3d 3d 61 2e 61 2e 6f 28 65 2c 63 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 6f 6d 62 69 6e 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 62 69 6e 64 69 6e 67 73 2c 20 62 65 63 61 75 73 65 20 74 68 65 79 20 68 61 76 65 20 61 Data Ascii: &g(b,c,!h)}function l(b){var c=[],d={},e=[];a.a.D(b,function Z(h){if(!d[h]){var f=a.getBindingHandler(h);f&&(f.after&&(e.push(h),a.a.q(f.after,function(c){if(b[c]){if(-1!==a.a.o(e,c))throw Error("Cannot combine the following bindings, because they have a
2024-04-26 01:30:00 UTC	10936	IN	Data Raw: 72 20 65 3d 63 28 29 2c 66 3d 61 2e 6a 2e 75 28 62 29 3b 61 2e 68 2e 45 61 28 65 2c 64 2c 22 76 61 6c 75 65 22 2c 66 29 7d 3b 21 61 2e 61 2e 43 7c 7c 22 69 6e 70 75 74 22 21 3d 62 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 22 74 65 78 74 22 21 3d 62 2e 74 79 70 65 7c 7c 0a 22 6f 66 66 22 3d 3d 62 2e 61 75 74 6f 63 6f 6d 70 6c 65 74 65 7c 7c 62 2e 66 6f 72 6d 26 26 22 6f 66 66 22 3d 3d 62 2e 66 6f 72 6d 2e 61 75 74 6f 63 6f 6d 70 6c 65 74 65 7c 7c 2d 31 21 3d 61 2e 61 2e 6f 28 65 2c 22 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 22 29 7c 7c 28 61 2e 61 2e 70 28 62 2c 22 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 67 3d 21 30 7d 29 2c 61 2e 61 2e 70 28 62 2c 22 66 6f 63 75 73 22 2c 66 75 6e 63 Data Ascii: r e=c(),f=a.j.u(b);a.h.Ea(e,d,"value",f)};!a.a.C\|\|"input"!=b.tagName.toLowerCase()\|\|"text"!=b.type\|\|"off"==b.autocomplete\|\|b.form&&"off"==b.form.autocomplete\|\|-1!=a.a.o(e,"propertychange")\|\|(a.a.p(b,"propertychange",function(){g=!0}),a.a.p(b,"focus",func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:59 UTC	810	OUT	GET /assets/js/notify.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	265	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:59 GMT Content-Type: application/javascript Content-Length: 5598 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-15de" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	5598	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0a 20 2a 0a 20 2a 20 40 70 61 63 6b 61 67 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 0a 20 2a 20 40 61 75 74 68 6f 72 20 53 65 72 62 61 6e 20 47 65 6f 72 67 65 20 43 72 69 73 74 69 61 6e 20 3c 63 72 69 73 74 69 61 6e 2e 73 65 72 62 61 6e 40 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 3e 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 2f 0a 20 2a 20 40 63 6f 70 79 72 69 67 68 74 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 29 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 Data Ascii: /** * This file is part of the MailWizz EMA application. * * @package MailWizz EMA * @author Serban George Cristian <cristian.serban@mailwizz.com> * @link https://www.mailwizz.com/ * @copyright MailWizz EMA (https://www.mailwizz.com) * @license htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:59 UTC	812	OUT	GET /assets/js/adminlte.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	265	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:59 GMT Content-Type: application/javascript Content-Length: 9774 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-262e" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	9774	IN	Data Raw: 2f 2a 21 20 41 64 6d 69 6e 4c 54 45 20 61 70 70 2e 6a 73 0a 20 2a 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 0a 20 2a 20 4d 61 69 6e 20 4a 53 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 66 69 6c 65 20 66 6f 72 20 41 64 6d 69 6e 4c 54 45 20 76 32 2e 20 54 68 69 73 20 66 69 6c 65 0a 20 2a 20 73 68 6f 75 6c 64 20 62 65 20 69 6e 63 6c 75 64 65 64 20 69 6e 20 61 6c 6c 20 70 61 67 65 73 2e 20 49 74 20 63 6f 6e 74 72 6f 6c 73 20 73 6f 6d 65 20 6c 61 79 6f 75 74 0a 20 2a 20 6f 70 74 69 6f 6e 73 20 61 6e 64 20 69 6d 70 6c 65 6d 65 6e 74 73 20 65 78 63 6c 75 73 69 76 65 20 41 64 6d 69 6e 4c 54 45 20 70 6c 75 67 69 6e 73 2e 0a 20 2a 0a 20 2a 20 40 41 75 74 68 6f 72 20 20 41 6c 6d 73 61 65 65 64 20 53 74 75 64 69 6f 0a 20 2a 20 40 53 75 70 70 6f 72 74 20 3c 68 74 Data Ascii: /! AdminLTE app.js ================ * Main JS application file for AdminLTE v2. This file * should be included in all pages. It controls some layout * options and implements exclusive AdminLTE plugins. * * @Author Almsaeed Studio * @Support <ht

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:59 UTC	810	OUT	GET /assets/js/cookie.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:29:59 UTC	265	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:29:59 GMT Content-Type: application/javascript Content-Length: 4938 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-134a" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:29:59 UTC	4938	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 43 6f 6f 6b 69 65 20 76 32 2e 31 2e 33 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 73 2d 63 6f 6f 6b 69 65 2f 6a 73 2d 63 6f 6f 6b 69 65 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 35 20 4b 6c 61 75 73 20 48 61 72 74 6c 20 26 20 46 61 67 6e 65 72 20 42 72 61 63 6b 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 3b 28 66 75 6e 63 74 69 6f 6e 20 28 66 61 63 74 6f 72 79 29 20 7b 0a 20 20 20 20 76 61 72 20 72 65 67 69 73 74 65 72 65 64 49 6e 4d 6f 64 75 6c 65 4c 6f 61 64 65 72 20 3d 20 66 61 6c 73 65 3b 0a 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 64 65 66 69 6e 65 20 3d 3d Data Ascii: /! JavaScript Cookie v2.1.3 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */;(function (factory) { var registeredInModuleLoader = false; if (typeof define ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:29:59 UTC	807	OUT	GET /assets/js/app.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:30:00 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:30:00 GMT Content-Type: application/javascript Content-Length: 2294 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT Connection: close ETag: "5e231d5c-8f6" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-04-26 01:30:00 UTC	2294	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0a 20 2a 0a 20 2a 20 40 70 61 63 6b 61 67 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 0a 20 2a 20 40 61 75 74 68 6f 72 20 53 65 72 62 61 6e 20 47 65 6f 72 67 65 20 43 72 69 73 74 69 61 6e 20 3c 63 72 69 73 74 69 61 6e 2e 73 65 72 62 61 6e 40 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 3e 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 2f 0a 20 2a 20 40 63 6f 70 79 72 69 67 68 74 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 29 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 Data Ascii: /** * This file is part of the MailWizz EMA application. * * @package MailWizz EMA * @author Serban George Cristian <cristian.serban@mailwizz.com> * @link https://www.mailwizz.com/ * @copyright MailWizz EMA (https://www.mailwizz.com) * @license htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:30:00 UTC	816	OUT	GET /frontend/assets/js/app.js?av=9ec570bf HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:30:00 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:30:00 GMT Content-Type: application/javascript Content-Length: 469 Connection: close X-Accel-Version: 0.01 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT ETag: "1d5-59c6b4ebd0f00" Accept-Ranges: bytes X-Powered-By: PleskLin
2024-04-26 01:30:00 UTC	469	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0a 20 2a 0a 20 2a 20 40 70 61 63 6b 61 67 65 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 0a 20 2a 20 40 61 75 74 68 6f 72 20 53 65 72 62 61 6e 20 47 65 6f 72 67 65 20 43 72 69 73 74 69 61 6e 20 3c 63 72 69 73 74 69 61 6e 2e 73 65 72 62 61 6e 40 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 3e 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 2f 0a 20 2a 20 40 63 6f 70 79 72 69 67 68 74 20 4d 61 69 6c 57 69 7a 7a 20 45 4d 41 20 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 61 69 6c 77 69 7a 7a 2e 63 6f 6d 29 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 Data Ascii: /** * This file is part of the MailWizz EMA application. * * @package MailWizz EMA * @author Serban George Cristian <cristian.serban@mailwizz.com> * @link https://www.mailwizz.com/ * @copyright MailWizz EMA (https://www.mailwizz.com) * @license htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	23.197.180.115	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:30:00 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 01:30:01 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=106448 Date: Fri, 26 Apr 2024 01:30:01 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49761	23.197.180.115	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:30:01 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 01:30:02 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=106479 Date: Fri, 26 Apr 2024 01:30:02 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 01:30:02 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49762	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:30:02 UTC	850	OUT	GET /favicon.ico HTTP/1.1 Host: qhs-rx.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:30:02 UTC	292	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:30:02 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 198 Connection: close X-Accel-Version: 0.01 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT ETag: "c6-59c6b4ebd0f00" Accept-Ranges: bytes X-Powered-By: PleskLin
2024-04-26 01:30:02 UTC	198	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 00 00 00 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ad 87 3a 00 f5 f5 f5 00 ff ff 00 00 aa 23 00 00 8a ef 00 00 ab 77 00 00 ab bb 00 00 aa 23 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 bb 15 00 00 ba d5 00 00 aa d5 00 00 93 1d 00 00 bb f5 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ( @:#w#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49763	69.64.48.35	443	3332	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 01:30:03 UTC	550	OUT	GET /favicon.ico HTTP/1.1 Host: qhs-rx.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: mwsid=ae3g6am8blqj2gt0k4eqv5k0mh; csrf_token=3f8399b79b2cb45822f58d614d78dc4528f1ff18s%3A88%3A%22QUdJUFdDVFBEVTRZRnV2d094MkNvaEtIb3E5eHBZZm-tpA3oTctBy3wbK3ZLsu8yRvpbH63zGQKfhhjPTtPPXg%3D%3D%22%3B
2024-04-26 01:30:03 UTC	292	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 01:30:03 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 198 Connection: close X-Accel-Version: 0.01 Last-Modified: Sat, 18 Jan 2020 14:59:40 GMT ETag: "c6-59c6b4ebd0f00" Accept-Ranges: bytes X-Powered-By: PleskLin
2024-04-26 01:30:03 UTC	198	IN	Data Raw: 00 00 01 00 01 00 10 10 02 00 00 00 00 00 b0 00 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 01 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ad 87 3a 00 f5 f5 f5 00 ff ff 00 00 aa 23 00 00 8a ef 00 00 ab 77 00 00 ab bb 00 00 aa 23 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 ff ff 00 00 bb 15 00 00 ba d5 00 00 aa d5 00 00 93 1d 00 00 bb f5 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ( @:#w#

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 332, Parent PID: 4208

General

Target ID:	0
Start time:	03:29:49
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3332, Parent PID: 332

General

Target ID:	2
Start time:	03:29:53
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2020,i,2194234812516978810,3701196606030679472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6352, Parent PID: 4208

General

Target ID:	3
Start time:	03:29:56
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://qhs-rx.com/index.php/lists/qf0856g1wm416/unsubscribe/oq197fczd8113/bt706mvd1j483"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly