Edit tour

Windows Analysis Report
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH

Overview

General Information

Sample URL:	https://claytonobrien.autos/twenty/flop/?moontBxm3SRH
Analysis ID:	1442329
Infos:

Detection

TechSupportScam

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected TechSupportScam

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2248,i,7522220006484712116,13690273053960303007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://claytonobrien.autos/twenty/flop/?moontBxm3SRH" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_69	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security
0.1.pages.csv	JoeSecurity_TechSupportScam	Yara detected TechSupportScam	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	SlashNext: detection malicious, Label: Scareware type: Phishing & Social Engineering
Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: https://claytonobrien.autos/twenty/flop/Kc13pncO.js	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/sZq0cGqH.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/4HNPHMfJ.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/nPU7rHwt.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/CW76YE4c.css	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/tJ67C7xl.css	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/3FxeivoS.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/LkPf2qhV.mp3	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/eGl8WIUk.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/Jv56WYQv.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/4kkzwAOC.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/AiRD0CDb.js	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/d2If1LR6.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/pgaK9m2J.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/7MALKGdt.png	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/HQMhxJg0.css	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/jpKzvWhY.mp3	Avira URL Cloud: Label: malware
Source: https://claytonobrien.autos/twenty/flop/6g4S4aZ8.png	Avira URL Cloud: Label: malware

Phishing

Yara detected TechSupportScam

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_69, type: DROPPED

Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	HTTP Parser: No favicon
Source: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49761 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.177.159
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /twenty/flop/?moontBxm3SRH HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /twenty/flop/HQMhxJg0.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/CW76YE4c.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/tJ67C7xl.css HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/AiRD0CDb.js HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/4HNPHMfJ.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/4kkzwAOC.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/7MALKGdt.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/4kkzwAOC.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/3FxeivoS.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/6g4S4aZ8.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/Kc13pncO.js HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/Jv56WYQv.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/nPU7rHwt.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/d2If1LR6.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/4HNPHMfJ.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/7MALKGdt.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/sZq0cGqH.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/pgaK9m2J.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/eGl8WIUk.png HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/jpKzvWhY.mp3 HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /twenty/flop/LkPf2qhV.mp3 HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: audioReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /twenty/flop/3FxeivoS.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/6g4S4aZ8.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/Jv56WYQv.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/nPU7rHwt.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/d2If1LR6.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/sZq0cGqH.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/pgaK9m2J.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /twenty/flop/eGl8WIUk.png HTTP/1.1Host: claytonobrien.autosConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: claytonobrien.autosConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FirstTimer=1

Source: global traffic	DNS traffic detected: DNS query: claytonobrien.autos
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 May 2024 23:21:15 GMTContent-Type: text/htmlContent-Length: 548Connection: closeVary: Accept-Encoding

Source: chromecache_73.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.177.159:443 -> 192.168.2.4:49761 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected TechSupportScam

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_69, type: DROPPED

Source: classification engine

Classification label: mal64.phis.win@16/51@6/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2248,i,7522220006484712116,13690273053960303007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://claytonobrien.autos/twenty/flop/?moontBxm3SRH"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2248,i,7522220006484712116,13690273053960303007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	100%	SlashNext	Scareware type: Phishing & Social Engineering
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://getbootstrap.com/)	0%	URL Reputation	safe
https://claytonobrien.autos/twenty/flop/Kc13pncO.js	100%	Avira URL Cloud	malware
https://claytonobrien.autos/favicon.ico	0%	Avira URL Cloud	safe
https://claytonobrien.autos/twenty/flop/sZq0cGqH.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/4HNPHMfJ.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/nPU7rHwt.png	100%	Avira URL Cloud	malware
https://github.com/twbs/bootstrap/blob/main/LICENSE)	0%	Avira URL Cloud	safe
https://claytonobrien.autos/twenty/flop/CW76YE4c.css	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/tJ67C7xl.css	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/3FxeivoS.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/LkPf2qhV.mp3	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/eGl8WIUk.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/Jv56WYQv.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/4kkzwAOC.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/AiRD0CDb.js	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/d2If1LR6.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/pgaK9m2J.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/7MALKGdt.png	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/HQMhxJg0.css	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/jpKzvWhY.mp3	100%	Avira URL Cloud	malware
https://claytonobrien.autos/twenty/flop/6g4S4aZ8.png	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
claytonobrien.autos	146.190.157.18	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
www.google.com	172.217.15.196	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://claytonobrien.autos/twenty/flop/nPU7rHwt.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/favicon.ico	false	Avira URL Cloud: safe	unknown
https://claytonobrien.autos/twenty/flop/CW76YE4c.css	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/sZq0cGqH.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH	true		unknown
https://claytonobrien.autos/twenty/flop/4HNPHMfJ.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/Kc13pncO.js	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/tJ67C7xl.css	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/3FxeivoS.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/LkPf2qhV.mp3	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/AiRD0CDb.js	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/eGl8WIUk.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/Jv56WYQv.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/d2If1LR6.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/4kkzwAOC.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/7MALKGdt.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/jpKzvWhY.mp3	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/HQMhxJg0.css	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/6g4S4aZ8.png	false	Avira URL Cloud: malware	unknown
https://claytonobrien.autos/twenty/flop/pgaK9m2J.png	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/blob/main/LICENSE)	chromecache_73.2.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	chromecache_73.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
146.190.157.18	claytonobrien.autos	United States	702	UUNETUS	false
172.217.15.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1442329
Start date and time:	2024-05-16 01:20:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://claytonobrien.autos/twenty/flop/?moontBxm3SRH
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@16/51@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.189.131, 142.250.217.174, 173.194.212.84, 34.104.35.123, 13.85.23.86, 199.232.214.172, 192.229.211.108, 20.242.39.171, 20.3.187.198, 142.250.217.227
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3834
Entropy (8bit):	7.661511605576764
Encrypted:	false
SSDEEP:	96:UgQ99q3GTte0IZF+gPYLRGssABY1sdaS+9:Qs680IjnPIz8Z9
MD5:	77A2FFC5545F87551D74781201DE9B3B
SHA1:	C9C3798AFD2AE95AA3BBA3C428335D49C8255B06
SHA-256:	316E6A6737BD296AB30ACA2EF7FA36F119D15786A2432D01E31FDC130272F15C
SHA-512:	CD1A966E47A63AF86E7AC34D58051EF6EA6E0BB5B8ABE14981BD088462667B5A69974B394E960C61F8ED559FB33A2C638D90C004EE13FA985A3F11455213FC2E
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/sZq0cGqH.png
Preview:	.PNG........IHDR.............R.l.....tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde" xmpMM:DocumentID="xmp.did:CC2FE32CB28311EB83B6BD6A3591FD42" xmpMM:InstanceID="xmp.iid:CC2FE32BB28311EB83B6BD6A3591FD42" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c42f55b0-556c-f647-9b5f-ce457f4ebdde" stRef:documentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k.1.....IDATx..{.]E....H.. .A....%`..

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1031
Entropy (8bit):	4.72931900456965
Encrypted:	false
SSDEEP:	24:NW8YuTW8Q8I/AI8H1Ken8H1Kmg8H1KeBs8H1K8BZQgGBZtllBZtlsQ4VKVv:NyIZ0BbzTGzRzgQ4gVv
MD5:	9787C1B52A8E8048EE75B350DE6C77B9
SHA1:	3EE845402FA270BD0C5DE02F6DFB429B1F0F5EA0
SHA-256:	A9467B47A2CFB243848585FAA9CC177EEC190CC96B361270B5C2067043CE0951
SHA-512:	983DCFBB53090B41444E953ECB191B361B442DF256D0DC60BE5C6D4242A4CD8994D004C851EF6F672941758E812F8F7665CC86DBE9CBC9F63837847B649F613B
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/Kc13pncO.js
Preview:	$(document).ready(function () {. let audioElement = document.createElement('audio');. audioElement.setAttribute('src', 'LkPf2qhV.mp3');.. audioElement.addEventListener('ended', function () {. this.play();. }, false);... $('.map').click(function () {. audioElement.play();.. });.. $('.black').click(function () {. audioElement.play();.. });... $('#footer').click(function () {. audioElement.play();.. });.. $('#poptxt').click(function () {. audioElement.play();.. });... $("#txts1").click(function () {. $('#poptxt').fadeOut('fast');.. });.. $("#footer").click(function () {. $('#poptxt').fadeOut('fast');. $("#poptxt").delay(2000).fadeIn(800);. });.. $("#mycanvas").click(function () {. $('#poptxt').fadeOut('fast');. $("#poptxt").delay(2000).fadeIn(800);. });.});..$("#footer").fadeIn('slow'). .css({top: 752, position: 'absolute'}). .animate({top: 685}, 800, function

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 47 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1045
Entropy (8bit):	6.248239976068452
Encrypted:	false
SSDEEP:	24:A1h6A1aWwjx82lY2T3PQVvmdN2yJ3V5L75Gs5eq46col:e11LNn2bQpEbJ3fH5ThOol
MD5:	BF2B460590FBB9D8E9611A6E9006B816
SHA1:	561E1DAB259D61E798B3CE380527B71B61074FF3
SHA-256:	EE4BC5FE81FA7C1E8497D79C9C8A96485DF217092D334E9B48FA8840FED11D03
SHA-512:	ACC9773B532BFF6A1284B78324D9BD51117A6EBFC0C549224BA4B703540DE8869AB1EFF1CCE8CC4FCA00C5B4F47D34FC27FAB27246873326CEE49D2DD5E877C0
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/7MALKGdt.png
Preview:	.PNG........IHDR.../..........{@.....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:2413D6EDFC2911EA865EEF9650A38354" xmpMM:DocumentID="xmp.did:2413D6EEFC2911EA865EEF9650A38354"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2413D6EBFC2911EA865EEF9650A38354" stRef:documentID="xmp.did:2413D6ECFC2911EA865EEF9650A38354"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.....0......b..".#............N$..B2.U..inw.8p.^g......i......e...x.......<x......J.........[.._....C..

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 148 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	6.88298948245023
Encrypted:	false
SSDEEP:	24:y1hBWwh82lYSKwFTh6nVmT3woyJ3V2aTL00bGiz+C8Ar48QWuib9AI:wOvnLUTOkcrJ3xLDjSKk8QWuiZAI
MD5:	5BFBCD30CE3355F8DE3FB0536DE70715
SHA1:	51FD9C511BC0D2E0E3FB23955575EACD94D5B9E5
SHA-256:	DFCC16FD49167F62D2ACB07ED991FB0535F5CA863C5C15CFA20CFD76C1B1CFBE
SHA-512:	FD13FD45B9D87BA42E596166AC10E8C2B05F7499C1F6D84D05375F721902C5202652AF29AD6E303830D96C50442E28BB5F00891C9C3B4FABED4509BCDD72429C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a4d48e96-283c-5641-9d61-94bb93d5c56f" xmpMM:DocumentID="xmp.did:DDE0735ECD4811EC979EB2D7C3DCFAC8" xmpMM:InstanceID="xmp.iid:DDE0735DCD4811EC979EB2D7C3DCFAC8" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8C9D9376B9A911EC8C58862D4505AB72" stRef:documentID="xmp.did:8C9D9377B9A911EC8C58862D4505AB72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.......IDATx..Y.n.@.,.zR....c.@.~G.W......p.<

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 840 x 598, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	22417
Entropy (8bit):	7.949794988976709
Encrypted:	false
SSDEEP:	384:bxeLmKo955NjMgVhZ9R5j7IEeoQzULfDTINOa91p6sk6zn/4UaTOeXl0+qH:bx00bj3VrNEEVQz8wOep/T4UUOeXunH
MD5:	048DEB04F1600AC3874FAF0E9838B55E
SHA1:	3EAA26246EC9AFB90F20F74F842BEB2F44741BB8
SHA-256:	543C3ED2EBB3E5DB5A5DCF6F8EFA615DA6A81FE4EB84B2BA95FEF12996F3FCDF
SHA-512:	A9581856990EBC2347FD0C031E9F40D4A8F8827E0590AB7FEAF25F64DE9AE0480AE1C255CA31AC4137FEE01833791991E94D478B26464927900155C0A2B3C596
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H...V.....U.W.....gAMA......a.....sRGB.........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <exif:PixelYDimension>598</exif:PixelYDimension>. <exif:PixelXDimension>840</exif:PixelXDimension>. <exif:UserComment>Screenshot</exif:UserComment>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>...+E....PLTE.....................!%)............,{..........8;?/26...................^`b...=...T'WY]......beg..................IKN...................?AE8F....qsu......ikm...............fhj......EHJ B....yz{......o~.............ryz......................QSUvwy.........fff026\|}~...TWY...oqs............moq...................MPR...............kmo.........lz}................uz}.........Z\_.................uvx........z..............3..........

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17558
Entropy (8bit):	7.965280918156402
Encrypted:	false
SSDEEP:	384:n1RiTAhyHQqaoDvIkGLi9WIEBudd3hTs1JyWKohqrN6o:1ATPQqdvQ+GshCyWLhqrYo
MD5:	6E3D6800EEF9CFF4B94ABC025255EB2B
SHA1:	7D606044AF2F4FB7F10CAD9E88A3E0647C0F2B38
SHA-256:	B2901F408265C7A9D8D5CFE0C8865E27289949848862945F8A3EDA85898100BE
SHA-512:	4AE4304F3151E161B57754AABDDE9AB1DD24639726D03C40FAC2BC12A99287692F03AAF9672D12AAECFC1C5333EC6183E8D39A86405D26390A42F46AE644C057
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,...,.....y}.u....sRGB.........gAMA......a.....pHYs..........o.d..D+IDATx^......!.. ....c$......7...w.B...eqX`Y.a.eq...........S]..h`w.{...=.3..]]U.....d..."J....{.B.../P#..4.Z.m..@....Y.2t..W...3..$...o........]..c.1?.........._.!..3...PS.Mc$>[..=.y...{.>.N.^..4..8.........>.A.\|..vJ..;Pa.1....C......]..\|........N.O_..+..}../T...6@..0.}.\.9.s.p^...G..o.`L...C..?..:~.....'.7.G9.qZ.}. .....TF..4....U.)<..+.g.w.....]A......P.@..%._.....y.y..>../AH..T.wPW..dn.!&...ch..s..T.8.Ax..L....Gu.~.l{...p..2....#..&....#.Ek....GY....h....t.........P...]Q.!X..+]f\v/........K.'tH.`S...^..+]..`.P...b...X.z.v..=p.B.t.'........E.o.^fTm..AY/.K..{].........v..X.7P...V...]-..Z..r..!........+_..9.......5.....wP7..&...6..YP..~.6r...D.s..U."A...p.P...(.I...._W'Ap..dY..t....@]..uJW/Ap..[....r..bx.g.u...tu...Ae.....v...@......N......l]...#....... <.T..O..........7Yw.....R.........6..]P.yM.".z....k..]O..Rp..:.....>....X.]G..j+.....n:.U.R.-..7.O..y!...

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	349
Entropy (8bit):	7.047569859646336
Encrypted:	false
SSDEEP:	6:6v/lhPfnY+7nDsphbAX6jNYCIh61Uw49/J3BYwmPYYSU+59AyROJwWgZPOIwCMR9:6v/74+U3AANXIsUDdI3+XtRZPONCMROO
MD5:	7454C652E0733D92DE6C920C2D646AE0
SHA1:	34A5BD8C7401F95E346895B0E5CCFFBF0E9AD638
SHA-256:	44F752B0BD2E48052D538BC6ACA5379F3630CA64DA945F794690DDF47E8EAEF7
SHA-512:	DDE6D40BEC105003CB93C52DD3322C26985FECC7FF1EAB79547FB7F0365AB2FB7B1CBA96AED81958C08627FC6C0BA6034BCEC53B1B66705D7B04202E7F8B5B59
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............s+....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Q1.E@.e..jQ..3hTJ.J......$J..h)$B).t$._.&....).x....y.w...uu]7.......8..(.e.3MS.e.H.0.#."....Q...QU5.C.@.<...$.Bx..x.8.m.n..'r .}.....x.8..i.q.-........0..9O.A...............a.O..{.W..<......1V..0.O.....I..`.!L.....i....6.B#....~....p..Nq.....IEND.B`.

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	7.4589736302173035
Encrypted:	false
SSDEEP:	192:W64drtCBpuLFODWH2BD/qbH+udcWFbeJG+F4Z6omIqZGRxx2:W6wrtzFODr7qbLTFAf012
MD5:	0139BC5BDF466894EC687696E2DC65CD
SHA1:	5C0A326BFBD3CA27E73D36D8EA3FDFD8F8C53B1B
SHA-256:	13EE09EFEF992EC899CA28DEA08D00886FCE5E8B3AD6C19E6C753A899BCFDAEA
SHA-512:	038E865EA9E15A1EB92558860C65782F1D9A477143F853C90688A0164716CFDEEE72C091C026E553650B5649594101175D275F993E66AB4320ACD16EC5E0D352
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs...;...;.d'P.....tEXtSoftware.www.inkscape.org..<... .IDATx...]..ya...lf.0.@..603.N.h..X?.......M.....&&Zc...K55.Tkj5...V....2.ZL..(.>.Pz.)..P.../.Y.3......]....%O.!....~...k.s-...$.]..<.z....I~#.cI..._I......p...:.w%./......>....u...\|.T..6...$..&yMv....K.sI..m...A....%..I.-...CI.s.?..I.]...$..........G...p.o>....{U....Ws..{"....$..d...^..M.k?v.w%yC.....7...'yKN.y.'..$_...w....P_.i...yo..N."..oO.t:.I~,..L."o..$.+...5.....$/.....e/I.o../g....Lr.....dw..}.. .;...`..l.O..s7.g...$.;.'~AW..<k....f\|U...~....J.]S]..7.....y8......x~v?...C.D..3.E.......^4....pq_......M..>..y..^.e..>....x ..h..e..c]......jF......Z.g.+y.u...^.....8V....v.....\|.e/.+..K../...q'...[.;...x.o..xn._............$.^.b....=e<.. Y.m...#.^.o.r~...q'.`......\|).....8K..38......R...'w....~..<u<...-..?/...r..[....w...`k..o.{...O.'fp8#...l...y.y..-38X;.....Vo...... ..fp.9d...5.....V..&O~".{.<.r.uu.L.....kp.v.._.>.L..o.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85586
Entropy (8bit):	5.366114407321627
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWpJCW6G9a98Hr2
MD5:	5BDFF511953F53715FE9DBFF8FD8CD87
SHA1:	7D2C5DB769791888E5F2B560AB64D28D7C39D77E
SHA-256:	E8132FCDF66783A6F9D5AC51D4C3ABB7178E6375ADAEA3412AA85966C155CC27
SHA-512:	F077EAEC3CCFE011FFFD673EA4D52ACBAA160CC70E2A0257288EF57CDD64B240C9FF5288169572E533199A88121583620F11003D19C14E3F02FB083FB695DAAB
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/AiRD0CDb.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 47 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	6.248239976068452
Encrypted:	false
SSDEEP:	24:A1h6A1aWwjx82lY2T3PQVvmdN2yJ3V5L75Gs5eq46col:e11LNn2bQpEbJ3fH5ThOol
MD5:	BF2B460590FBB9D8E9611A6E9006B816
SHA1:	561E1DAB259D61E798B3CE380527B71B61074FF3
SHA-256:	EE4BC5FE81FA7C1E8497D79C9C8A96485DF217092D334E9B48FA8840FED11D03
SHA-512:	ACC9773B532BFF6A1284B78324D9BD51117A6EBFC0C549224BA4B703540DE8869AB1EFF1CCE8CC4FCA00C5B4F47D34FC27FAB27246873326CEE49D2DD5E877C0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.../..........{@.....tEXtSoftware.Adobe ImageReadyq.e<...#iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:2413D6EDFC2911EA865EEF9650A38354" xmpMM:DocumentID="xmp.did:2413D6EEFC2911EA865EEF9650A38354"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2413D6EBFC2911EA865EEF9650A38354" stRef:documentID="xmp.did:2413D6ECFC2911EA865EEF9650A38354"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.....0......b..".#............N$..B2.U..inw.8p.^g......i......e...x.......<x......J.........[.._....C..

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	17558
Entropy (8bit):	7.965280918156402
Encrypted:	false
SSDEEP:	384:n1RiTAhyHQqaoDvIkGLi9WIEBudd3hTs1JyWKohqrN6o:1ATPQqdvQ+GshCyWLhqrYo
MD5:	6E3D6800EEF9CFF4B94ABC025255EB2B
SHA1:	7D606044AF2F4FB7F10CAD9E88A3E0647C0F2B38
SHA-256:	B2901F408265C7A9D8D5CFE0C8865E27289949848862945F8A3EDA85898100BE
SHA-512:	4AE4304F3151E161B57754AABDDE9AB1DD24639726D03C40FAC2BC12A99287692F03AAF9672D12AAECFC1C5333EC6183E8D39A86405D26390A42F46AE644C057
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/eGl8WIUk.png
Preview:	.PNG........IHDR...,...,.....y}.u....sRGB.........gAMA......a.....pHYs..........o.d..D+IDATx^......!.. ....c$......7...w.B...eqX`Y.a.eq...........S]..h`w.{...=.3..]]U.....d..."J....{.B.../P#..4.Z.m..@....Y.2t..W...3..$...o........]..c.1?.........._.!..3...PS.Mc$>[..=.y...{.>.N.^..4..8.........>.A.\|..vJ..;Pa.1....C......]..\|........N.O_..+..}../T...6@..0.}.\.9.s.p^...G..o.`L...C..?..:~.....'.7.G9.qZ.}. .....TF..4....U.)<..+.g.w.....]A......P.@..%._.....y.y..>../AH..T.wPW..dn.!&...ch..s..T.8.Ax..L....Gu.~.l{...p..2....#..&....#.Ek....GY....h....t.........P...]Q.!X..+]f\v/........K.'tH.`S...^..+]..`.P...b...X.z.v..=p.B.t.'........E.o.^fTm..AY/.K..{].........v..X.7P...V...]-..Z..r..!........+_..9.......5.....wP7..&...6..YP..~.6r...D.s..U."A...p.P...(.I...._W'Ap..dY..t....@]..uJW/Ap..[....r..bx.g.u...tu...Ae.....v...@......N......l]...#....... <.T..O..........7Yw.....R.........6..]P.yM.".z....k..]O..Rp..:.....>....X.]G..j+.....n:.U.R.-..7.O..y!...

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	11276
Entropy (8bit):	4.383465097096348
Encrypted:	false
SSDEEP:	192:sQfIIBAWESRn9UURDuFRnEuEvyUynSXq/eLdid:FBAWESR9UURKFRnEuEqUyuq/eLI
MD5:	7F8F5D90F8D2DA0D20BA6B5ACD31911E
SHA1:	6A485FBCD64BD7854681B1078AB05245BFDE1BAA
SHA-256:	66A56A98EBA506893D0913C432A1AC1A0FA118B5E3BD6F0F3E3A8845D5FEAEE3
SHA-512:	10AF10F9EDFB9F884FEA421AF1B216209574C28985771E4AEBFD5DCC69B1F7D88333375CA994E546D490B840D8A474C2869FE3D83B147BDAAE26FAA28E2264A3
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/?moontBxm3SRH
Preview:	.<!DOCTYPE html>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. <meta content="width=device-width,initial-scale=1,maximum-scale=2,shrink-to-fit=no" name="viewport">. <title>Facebook</title>. <link rel="stylesheet" href="HQMhxJg0.css">. <link rel="stylesheet" type="text/css" href="CW76YE4c.css">. <link rel="stylesheet" type="text/css" href="tJ67C7xl.css">. <script src="AiRD0CDb.js"></script>. <script type="text/javascript">. $(document).ready(function () {. let audioElement = document.createElement('audio');. audioElement.setAttribute('src', 'jpKzvWhY.mp3');.. audioElement.addEventListener('ended', function () {. this.play();. }, false);... $('#mycanvas').click(function () {. audioElement.play();. });. });. </script>...</head>.<body id="mycanvas" class="map" style="cursor: none;">.<div class="bg-img">. <img src="

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	133
Entropy (8bit):	4.43759646590899
Encrypted:	false
SSDEEP:	3:UHFmGOCXLTt7HCIMMdDjWyeHFrwHMoveHFoH/5FNs5FU/M:Uc8/NdeFF67veHaHxFoj
MD5:	CEB97A8F9570E9AD7251685256E6CEAB
SHA1:	75F9AD33F89C709750EC795AF89CD20B666892DF
SHA-256:	B79773862ABAD2F91B42042F713F5D60FE17768421DBC1C6534E5D36A0C9A2B3
SHA-512:	08B620A2AEF96833F504B915F9DB879AF2B780C57F168C302A0F2AC550877B3109E3BE75CA6B578058425CF1AB5309FF8D77B6AFA4412673207661069E130986
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/CW76YE4c.css
Preview:	body {. background: #f0f2f5;.}...bg-img {. position: absolute;. top: -1px;. left: 0;. width: 100%;. height: 100%;.}

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1906 x 931, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	193376
Entropy (8bit):	7.9671747960078605
Encrypted:	false
SSDEEP:	3072:dL9qnbMFJjpfAq+OuSwdq72u5Ns2CHvtY+Vyc6lAHEjRb+mw2M6DCbQy:dAnbKJLhAiLNUvD8hKCRbEz
MD5:	532B382DC7CD778BBD45559C93052083
SHA1:	5B25E754CE2F2387001D783977A1855E0FEE0946
SHA-256:	57E5D6EEBC06F95F82B24D2DC420B2BD38A17246237E2E60B118809AE07A6875
SHA-512:	EC0AE3A2BAF53DD2517EE147121C3EA62A5E56C09EC9042A6A27C1DE3C3694240DBF650D50CE0F7215B34CA70227C58EA25C36CF8F87F020760D4454938322FC
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...r.........y.......gAMA......a.....sRGB.........pHYs.................PLTE.................................................. ...........................(&&..{2./..........................s........\A?@wxy...JHI...pop...........h........G........}.Nhgg...778............cgmB41IT] .......;%..Y.P...J+....q...g./..T7,......f;-H.....ZYZ.6`A6QQR..........q...aab...}...bO@=.q...6........oOB.[.B.zQ\f...xq_.S).S......~......l5...y......{u....?\2....~0]#..uSw...Q.s2.pG../..d.`aJA...xXK:S^.i[ON.....~.....y..wB8HQ..t0.mV.bT~O9.mBgYT..X.I".i....S...d..l/.@.Z..w.C....r..,.Y=i.....C.c. ?.\|d.rg..v....u.s..........T.g.cG.......zK............}sc\.{.xb...a/......ng.rit~....u....5../>+>t..1..[........f,....V..6U9;....[......r,d..Mnz.k...4jS..h\|.rL...s..UZPp..U*.D..;@.:.})l.s.2.c...M......IDATx..k.........YU.Ar.LH..`..H"...H.O.:..n....,`il6..e..1j,.@.......d.`..f.\|3..O.H."...e..8...och.:.I.....`.....V....H.R.}..K

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 791 x 565, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	22478
Entropy (8bit):	7.951646306305701
Encrypted:	false
SSDEEP:	384:gEuGbsetSPeI+gKZ39OcVZdDnUyC8HB3af5eDXlUQsGOOwDQgsfcb1vgE:gEudetv6KZ3htTQqeGOfD2f6T
MD5:	22AFB315F7A6BB5301D9D0689C13E65C
SHA1:	5569C77B5FCBCA791DB576A7A7B55E9EC8959B2C
SHA-256:	FCF3789D368F21A583DAF581EAC991C157C6CD2788E5D128CE226A357E7FE756
SHA-512:	FAA9C95FF34CA44A93E6E82CD1CFDE3C6FBCED0C922FDA2A822545BCD1DC4757A2C43F7017F068EA5C38E4355A65E5703407969B38EA974302404F903E337D11
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/nPU7rHwt.png
Preview:	.PNG........IHDR.......5.............gAMA......a.....sRGB.........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <exif:PixelYDimension>565</exif:PixelYDimension>. <exif:PixelXDimension>791</exif:PixelXDimension>. <exif:UserComment>Screenshot</exif:UserComment>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..w^....PLTE........................!%)......*u.026...]_b8;?......MPRlu}EHJ...WY]...cfh..................?AE...IKOyz\|.......TWY...,{.......................QSV.................moq.........._ac......fhjhjl...=......T'...Z\_........................................8F.vwykmo........{\|~......\|}.....................fff...iln............uvx..........stu...qsu4..bdf....................oqs...................................................~......

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (631)
Category:	downloaded
Size (bytes):	214882
Entropy (8bit):	4.797927448887052
Encrypted:	false
SSDEEP:	1536:5agJ+cD+Pxy98q8+GcD5qXbIwI9uASjjvuQTDNdpR620vob96v7jTYqj9YMH:5HAy98q8mD4h0vA6v7jTYqj9Yk
MD5:	F3967998A03EA5F37013FFCC15DA846F
SHA1:	6220C374E07520399604A6931E3128A4715FE8CB
SHA-256:	5B90902B0C67CB6FD2543C9FDDF415E0706D5C6C44A42A6D70844B1772F0ED00
SHA-512:	6C9D02EDAABBEF7067FC3F1FC5CA5DC21F5C6D970D9FF0EAA5010B6DB2E57C01AD403477FC46E478B46D3EF64222DBDCAB742B12CE7E3AD2126F3C07DFA549F8
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/HQMhxJg0.css
Preview:	/!. Bootstrap v4.6.0 (https://getbootstrap.com/). * Copyright 2011-2021 The Bootstrap Authors. * Copyright 2011-2021 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE). */.:root {. --blue: #007bff;. --indigo: #6610f2;. --purple: #6f42c1;. --pink: #e83e8c;. --red: #dc3545;. --orange: #fd7e14;. --yellow: #ffc107;. --green: #28a745;. --teal: #20c997;. --cyan: #17a2b8;. --white: #fff;. --gray: #6c757d;. --gray-dark: #343a40;. --primary: #007bff;. --secondary: #6c757d;. --success: #28a745;. --info: #17a2b8;. --warning: #ffc107;. --danger: #dc3545;. --light: #f8f9fa;. --dark: #343a40;. --breakpoint-xs: 0;. --breakpoint-sm: 576px;. --breakpoint-md: 768px;. --breakpoint-lg: 992px;. --breakpoint-xl: 1200px;. --font-family-sans-serif: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", "Liberation Sans", sans-serif, "Apple Color Emoji

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	16995
Entropy (8bit):	4.652510770550131
Encrypted:	false
SSDEEP:	384:FAnjZ4EagDcBFXsZ4mRF5azFOuFg21pNmj/WFaFoFwFEFgFwte69:Onj6EagDMFXsZnRF5azFOuFPZmjOFaFe
MD5:	B791A6D4261769DBFC148A2790E45F03
SHA1:	0D483A6101285DA5DF5F1E3B72AC7DCFDECCCCCA
SHA-256:	AB8384F9B69D6341D98A2AB863767DCFD2CF8FD4045A59DBF9FC3A9F660F6B4D
SHA-512:	8CB1247B1C2528F431F15947BC26D500BF40EA7B31C8C40D3F5BBD3AC6593D7F735304BF11BD5A54268985D492F95A11125C2DFAFE83BD80B2382093C7F46E56
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/tJ67C7xl.css
Preview:	body {. overflow-y: hidden;. font-family: 'Open Sans', sans-serif;.}..a:hover {. text-decoration: none !important;.}...form-check-input {. position: absolute;. margin-top: 0px !important;. margin-left: -1.25rem;.}...#new_sche {. width: 160px !important;.}..#new_height {. height: 431px;.}..:-webkit-full-screen .pro_box3 {. top: 18%;.}..:-webkit-full-screen .pro_box2 {. top: 19%;.}..:-webkit-full-screen .pro_box {. top: 20%;.}..:-webkit-full-screen #pop_up_new {. top: 11%;.}..:-webkit-full-screen #poptxt {. top: 29%;.}..:-webkit-full-screen #footer {. bottom: 0 !important;. top: 815px !important;.}...#pop_up_new {. position: absolute;. top: 6%;. z-index: 999999;. margin: 0 auto;. left: 0;. right: 0;. background: #1a73e8;. width: 443px;. text-align: left;. padding-top: 31px;. display: none;. color: #FFFFFF;. padding-left: 20px;. padding-right: 20px;. border-radius: 5px;.}..#pop_up_new p {. font-we

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	364
Entropy (8bit):	7.161449027375991
Encrypted:	false
SSDEEP:	6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
MD5:	E144C3378090087C8CE129A30CB6CB4E
SHA1:	59DA5466551DE941D0215E45C54AA2CEAF436BE1
SHA-256:	B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
SHA-512:	3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/3FxeivoS.png
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....\|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI\|...3MS0.,{.wq.w.$.>\|....0.u.{........IEND.B`.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
Category:	downloaded
Size (bytes):	8650
Entropy (8bit):	6.575282017307294
Encrypted:	false
SSDEEP:	192:E1UC7RmOkA1Z9Etnoa/yNKccNkdSKKKKKKKq:E1UARmOvdO9yNX5u
MD5:	591A90571498A046B979043A88A574B8
SHA1:	220B4A0F8A226AE4EDB4B927F1DA1E7E503C5621
SHA-256:	E5CF7987F8EDA377DA9CE7BB1AED3144ECCC244CAC88C225D3C3D2F7A1226494
SHA-512:	732EFEE536E3D2D125C94013C82399A0CC7848A161D6FECE10C89817F4F82B2F8E851DF96B0E47C8AAD2446CA025F05A63D982DDEA97A347ACFDA56EC751F5BD
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/jpKzvWhY.mp3:2f771ca85ea7f1:0
Preview:	ID3......ITPE1.......SoundJay.com Sound Effects.TSSE.......Lavf59.22.100.............P.................................Info.......(..!w..........%%%++11188>>>DDJJJQQWWW]]cccjjpppvv\|\|\|........................................................Lavc59.26............$........!w.W....................Pd...%......... ....xB...K...4................N..\..[..z.'sV.-..j.]22L..#.4..9..um.t[...:k...:k...5.][n.5.][n.5.]Q.......&.j.X..\|........C..3....7.6..v.j'.....3..{O^C...jV+?...............y.C...1y..Rd)...D..=..... ....=5o...P..4.....$.z......3........1.C.:..4!.{O.y...z...h......6....@..P....I.0...&.?.......e1.A.......&x-.V...f.&+@.............&.A.&....)...r............~...........4%.9%...Sd......Rd...IY.=..... .....%7......4.......ccdX.&I$.O/.._M}.....-?..&....bY$I....B!.O................6".\&..a......6...Q..;.w1..M.tf.=+...:..Q.........ElGR........I7_..0.....8.......D.C.x.....).]...I&..F./..Rd....IL....... .....%3.v....4...........;...<\|.D.{GV.d..<\|....S.O......B...N.

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3834
Entropy (8bit):	7.661511605576764
Encrypted:	false
SSDEEP:	96:UgQ99q3GTte0IZF+gPYLRGssABY1sdaS+9:Qs680IjnPIz8Z9
MD5:	77A2FFC5545F87551D74781201DE9B3B
SHA1:	C9C3798AFD2AE95AA3BBA3C428335D49C8255B06
SHA-256:	316E6A6737BD296AB30ACA2EF7FA36F119D15786A2432D01E31FDC130272F15C
SHA-512:	CD1A966E47A63AF86E7AC34D58051EF6EA6E0BB5B8ABE14981BD088462667B5A69974B394E960C61F8ED559FB33A2C638D90C004EE13FA985A3F11455213FC2E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............R.l.....tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde" xmpMM:DocumentID="xmp.did:CC2FE32CB28311EB83B6BD6A3591FD42" xmpMM:InstanceID="xmp.iid:CC2FE32BB28311EB83B6BD6A3591FD42" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c42f55b0-556c-f647-9b5f-ce457f4ebdde" stRef:documentID="xmp.did:c42f55b0-556c-f647-9b5f-ce457f4ebdde"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k.1.....IDATx..{.]E....H.. .A....%`..

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 840 x 598, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	22417
Entropy (8bit):	7.949794988976709
Encrypted:	false
SSDEEP:	384:bxeLmKo955NjMgVhZ9R5j7IEeoQzULfDTINOa91p6sk6zn/4UaTOeXl0+qH:bx00bj3VrNEEVQz8wOep/T4UUOeXunH
MD5:	048DEB04F1600AC3874FAF0E9838B55E
SHA1:	3EAA26246EC9AFB90F20F74F842BEB2F44741BB8
SHA-256:	543C3ED2EBB3E5DB5A5DCF6F8EFA615DA6A81FE4EB84B2BA95FEF12996F3FCDF
SHA-512:	A9581856990EBC2347FD0C031E9F40D4A8F8827E0590AB7FEAF25F64DE9AE0480AE1C255CA31AC4137FEE01833791991E94D478B26464927900155C0A2B3C596
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/d2If1LR6.png
Preview:	.PNG........IHDR...H...V.....U.W.....gAMA......a.....sRGB.........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <exif:PixelYDimension>598</exif:PixelYDimension>. <exif:PixelXDimension>840</exif:PixelXDimension>. <exif:UserComment>Screenshot</exif:UserComment>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>...+E....PLTE.....................!%)............,{..........8;?/26...................^`b...=...T'WY]......beg..................IKN...................?AE8F....qsu......ikm...............fhj......EHJ B....yz{......o~.............ryz......................QSUvwy.........fff026\|}~...TWY...oqs............moq...................MPR...............kmo.........lz}................uz}.........Z\_.................uvx........z..............3..........

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Audio file with ID3 version 2.3.0, contains:\012- MPEG ADTS, layer III, v2, 64 kbps, 22.05 kHz, Monaural
Category:	downloaded
Size (bytes):	200832
Entropy (8bit):	7.695958183565904
Encrypted:	false
SSDEEP:	6144:4lsFCVxSmdxiWKwHtlYMKrXFTNRp+TSAU1M:4lHVx5ihwHvYrDRhAU2
MD5:	0116152611DD51432E852781F8CC7E82
SHA1:	2408D3D281B25649894F78A4E19F7F8A8AC735F9
SHA-256:	FC59BBB18F923747B9CD3F3B23537FF09C5AD2FDFC1505A4800A3F269A234E65
SHA-512:	4378F49A8E77BA6F34DC8B0F738B1FDBFA1E686CFB60C07E83B9D76F4EAB1CCF444785FEE5B9932DA77E42FA189BB14FFCAFAC3D9C9965CBF276C2D06AA94CB0
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/LkPf2qhV.mp3:2f771ca85eb74d:0
Preview:	ID3.....ITPE1...&...IVONA Reader - Microsoft Zira DesktopTIT2.......Important SecurityTALB.......WarningCOMM...........License: UnknownTRCK.......1APIC.......image/png..IVONA Reader..PNG........IHDR...d...d.....p.T...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	364
Entropy (8bit):	7.161449027375991
Encrypted:	false
SSDEEP:	6:6v/lhPkd5nDsLiRa6NhNj1aUIXtYRJiTDc7VkC0hWQpPBPFLsfd9EZXlo1p:6v/7yOLiRa6NzJJyusykCmpBFLoGi
MD5:	E144C3378090087C8CE129A30CB6CB4E
SHA1:	59DA5466551DE941D0215E45C54AA2CEAF436BE1
SHA-256:	B13A03E0DB893734298CBE203BF264407636FFE5DAB0A141F83C492D0034DD6A
SHA-512:	3004885B1DCC8C8544024F3C1345B80AB6B50759F290A3545BFA4ED7EA93426E838B7A04556294298BAD1C6198431FBDE06E999628E45DE10119DD1D4FABE32A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.\...E@.....TB...-n$...(....5T.7.x.=ZQ...l(n#....WL....N..rY..WY.%I..0.UU/N....\|.,K...)...mEQ,.b].p.....8.u]..<....'...ih.....8`.8.........eY..^.o=..........4M..EQ?.B...a.v...q.e..A.^.W.E.4......e.}......+.0........+......m.TI\|...3MS0.,{.wq.w.$.>\|....0.u.{........IEND.B`.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	25871
Entropy (8bit):	7.94435159360093
Encrypted:	false
SSDEEP:	768:1jncD3TNUM1xISZ8ONnAfSTFPDYj6z6Xn+N:xnw3RUyISpnAfSTFMj6z0nC
MD5:	2C497DFFF84BD8C5AF9254C9D6278CE1
SHA1:	667E72E7BA6F00A54629E28133317022D4B59AF6
SHA-256:	B2DC4153EE7019C70A1095D5D1304D540E3BBA045D99E141F63E5B13362E5A4E
SHA-512:	6138813720D378234F497ED844A6815DF8E78D923B470CE58B9B8819EE87B7118DC79498D02FC5BA6A438094CDE6173A9F348F20503BFBF933081D32B8FD2AD6
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/Jv56WYQv.png
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<... .IDATx..w.^E.....B..$..:.H...(H..HU.JUT.W`m.....H......i.H....k..K @..l...<k.d...3w....9....s...3g..!D.X.8....NC.....oB.!...m...{@w?2..Z*...B.......[NKd..B.!....O.=.s.K..B...6..Z_.<....B.!J...>......BD.=..B.\Y.....Y!.(.Z..Qm.:~;...B......fh...!....B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B.....!.fA`)`<0...z.9..=.[.X8......;.y....m..7...W.W....].Qp.....,.Lh..$.DC.......Hf]kL.../b...}..)..B.A..!.1.X.........).Y.<.......Y%D...@..t.......V.&.%S.U".....5........(!....B...}..K..F.4.......K..4J.2..........)6...KiP...<.........."!J...B....f..?WOk...........1BwR..((Z...~.......Oi.p.".3pCC^Lk...A..Qw....;.;./.....{.Z.v.....-.D...l.M......6.'.z.j.....-.D]..M.;`[..i...c6p7.3p..DZs...-.D.Y..LCVKl.(...=.B.J......Z....8.)l..(.-........x!.-B.C..Q...v...>

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	349
Entropy (8bit):	7.047569859646336
Encrypted:	false
SSDEEP:	6:6v/lhPfnY+7nDsphbAX6jNYCIh61Uw49/J3BYwmPYYSU+59AyROJwWgZPOIwCMR9:6v/74+U3AANXIsUDdI3+XtRZPONCMROO
MD5:	7454C652E0733D92DE6C920C2D646AE0
SHA1:	34A5BD8C7401F95E346895B0E5CCFFBF0E9AD638
SHA-256:	44F752B0BD2E48052D538BC6ACA5379F3630CA64DA945F794690DDF47E8EAEF7
SHA-512:	DDE6D40BEC105003CB93C52DD3322C26985FECC7FF1EAB79547FB7F0365AB2FB7B1CBA96AED81958C08627FC6C0BA6034BCEC53B1B66705D7B04202E7F8B5B59
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/6g4S4aZ8.png
Preview:	.PNG........IHDR...............s+....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.Q1.E@.e..jQ..3hTJ.J......$J..h)$B).t$._.&....).x....y.w...uu]7.......8..(.e.3MS.e.H.0.#."....Q...QU5.C.@.<...$.Bx..x.8.m.n..'r .}.....x.8..i.q.-........0..9O.A...............a.O..{.W..<......1V..0.O.....I..`.!L.....i....6.B#....~....p..Nq.....IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1906 x 931, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	193376
Entropy (8bit):	7.9671747960078605
Encrypted:	false
SSDEEP:	3072:dL9qnbMFJjpfAq+OuSwdq72u5Ns2CHvtY+Vyc6lAHEjRb+mw2M6DCbQy:dAnbKJLhAiLNUvD8hKCRbEz
MD5:	532B382DC7CD778BBD45559C93052083
SHA1:	5B25E754CE2F2387001D783977A1855E0FEE0946
SHA-256:	57E5D6EEBC06F95F82B24D2DC420B2BD38A17246237E2E60B118809AE07A6875
SHA-512:	EC0AE3A2BAF53DD2517EE147121C3EA62A5E56C09EC9042A6A27C1DE3C3694240DBF650D50CE0F7215B34CA70227C58EA25C36CF8F87F020760D4454938322FC
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/4HNPHMfJ.png
Preview:	.PNG........IHDR...r.........y.......gAMA......a.....sRGB.........pHYs.................PLTE.................................................. ...........................(&&..{2./..........................s........\A?@wxy...JHI...pop...........h........G........}.Nhgg...778............cgmB41IT] .......;%..Y.P...J+....q...g./..T7,......f;-H.....ZYZ.6`A6QQR..........q...aab...}...bO@=.q...6........oOB.[.B.zQ\f...xq_.S).S......~......l5...y......{u....?\2....~0]#..uSw...Q.s2.pG../..d.`aJA...xXK:S^.i[ON.....~.....y..wB8HQ..t0.mV.bT~O9.mBgYT..X.I".i....S...d..l/.@.Z..w.C....r..,.Y=i.....C.c. ?.\|d.rg..v....u.s..........T.g.cG.......zK............}sc\.{.xb...a/......ng.rit~....u....5../>+>t..1..[........f,....V..6U9;....[......r,d..Mnz.k...4jS..h\|.rL...s..UZPp..U*.D..;@.:.})l.s.2.c...M......IDATx..k.........YU.Ar.LH..`..H"...H.O.:..n....,`il6..e..1j,.@.......d.`..f.\|3..O.H."...e..8...och.:.I.....`.....V....H.R.}..K

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25871
Entropy (8bit):	7.94435159360093
Encrypted:	false
SSDEEP:	768:1jncD3TNUM1xISZ8ONnAfSTFPDYj6z6Xn+N:xnw3RUyISpnAfSTFMj6z0nC
MD5:	2C497DFFF84BD8C5AF9254C9D6278CE1
SHA1:	667E72E7BA6F00A54629E28133317022D4B59AF6
SHA-256:	B2DC4153EE7019C70A1095D5D1304D540E3BBA045D99E141F63E5B13362E5A4E
SHA-512:	6138813720D378234F497ED844A6815DF8E78D923B470CE58B9B8819EE87B7118DC79498D02FC5BA6A438094CDE6173A9F348F20503BFBF933081D32B8FD2AD6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<... .IDATx..w.^E.....B..$..:.H...(H..HU.JUT.W`m.....H......i.H....k..K @..l...<k.d...3w....9....s...3g..!D.X.8....NC.....oB.!...m...{@w?2..Z*...B.......[NKd..B.!....O.=.s.K..B...6..Z_.<....B.!J...>......BD.=..B.\Y.....Y!.(.Z..Qm.:~;...B......fh...!....B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B..-...B......B.QC...B.!j...B.!D...@.!..!Z..!..5D..!....h. ..B.....!.fA`)`<0...z.9..=.[.X8......;.y....m..7...W.W....].Qp.....,.Lh..$.DC.......Hf]kL.../b...}..)..B.A..!.1.X.........).Y.<.......Y%D...@..t.......V.&.%S.U".....5........(!....B...}..K..F.4.......K..4J.2..........)6...KiP...<.........."!J...B....f..?WOk...........1BwR..((Z...~.......Oi.p.".3pCC^Lk...A..Qw....;.;./.....{.Z.v.....-.D...l.M......6.'.z.j.....-.D]..M.;`[..i...c6p7.3p..DZs...-.D.Y..LCVKl.(...=.B.J......Z....8.)l..(.-........x!.-B.C..Q...v...>

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8350
Entropy (8bit):	7.4589736302173035
Encrypted:	false
SSDEEP:	192:W64drtCBpuLFODWH2BD/qbH+udcWFbeJG+F4Z6omIqZGRxx2:W6wrtzFODr7qbLTFAf012
MD5:	0139BC5BDF466894EC687696E2DC65CD
SHA1:	5C0A326BFBD3CA27E73D36D8EA3FDFD8F8C53B1B
SHA-256:	13EE09EFEF992EC899CA28DEA08D00886FCE5E8B3AD6C19E6C753A899BCFDAEA
SHA-512:	038E865EA9E15A1EB92558860C65782F1D9A477143F853C90688A0164716CFDEEE72C091C026E553650B5649594101175D275F993E66AB4320ACD16EC5E0D352
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/pgaK9m2J.png
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs...;...;.d'P.....tEXtSoftware.www.inkscape.org..<... .IDATx...]..ya...lf.0.@..603.N.h..X?.......M.....&&Zc...K55.Tkj5...V....2.ZL..(.>.Pz.)..P.../.Y.3......]....%O.!....~...k.s-...$.]..<.z....I~#.cI..._I......p...:.w%./......>....u...\|.T..6...$..&yMv....K.sI..m...A....%..I.-...CI.s.?..I.]...$..........G...p.o>....{U....Ws..{"....$..d...^..M.k?v.w%yC.....7...'yKN.y.'..$_...w....P_.i...yo..N."..oO.t:.I~,..L."o..$.+...5.....$/.....e/I.o../g....Lr.....dw..}.. .;...`..l.O..s7.g...$.;.'~AW..<k....f\|U...~....J.]S]..7.....y8......x~v?...C.D..3.E.......^4....pq_......M..>..y..^.e..>....x ..h..e..c]......jF......Z.g.+y.u...^.....8V....v.....\|.e/.+..K../...q'...[.;...x.o..xn._............$.^.b....=e<.. Y.m...#.^.o.r~...q'.`......\|).....8K..38......R...'w....~..<u<...-..?/...r..[....w...`k..o.{...O.'fp8#...l...y.y..-38X;.....Vo...... ..fp.9d...5.....V..&O~".{.<.r.uu.L.....kp.v.._.>.L..o.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 148 x 21, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1443
Entropy (8bit):	6.88298948245023
Encrypted:	false
SSDEEP:	24:y1hBWwh82lYSKwFTh6nVmT3woyJ3V2aTL00bGiz+C8Ar48QWuib9AI:wOvnLUTOkcrJ3xLDjSKk8QWuiZAI
MD5:	5BFBCD30CE3355F8DE3FB0536DE70715
SHA1:	51FD9C511BC0D2E0E3FB23955575EACD94D5B9E5
SHA-256:	DFCC16FD49167F62D2ACB07ED991FB0535F5CA863C5C15CFA20CFD76C1B1CFBE
SHA-512:	FD13FD45B9D87BA42E596166AC10E8C2B05F7499C1F6D84D05375F721902C5202652AF29AD6E303830D96C50442E28BB5F00891C9C3B4FABED4509BCDD72429C
Malicious:	false
Reputation:	low
URL:	https://claytonobrien.autos/twenty/flop/4kkzwAOC.png
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a4d48e96-283c-5641-9d61-94bb93d5c56f" xmpMM:DocumentID="xmp.did:DDE0735ECD4811EC979EB2D7C3DCFAC8" xmpMM:InstanceID="xmp.iid:DDE0735DCD4811EC979EB2D7C3DCFAC8" xmp:CreatorTool="Adobe Photoshop 22.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8C9D9376B9A911EC8C58862D4505AB72" stRef:documentID="xmp.did:8C9D9377B9A911EC8C58862D4505AB72"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.......IDATx..Y.n.@.,.zR....c.@.~G.W......p.<

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 791 x 565, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	22478
Entropy (8bit):	7.951646306305701
Encrypted:	false
SSDEEP:	384:gEuGbsetSPeI+gKZ39OcVZdDnUyC8HB3af5eDXlUQsGOOwDQgsfcb1vgE:gEudetv6KZ3htTQqeGOfD2f6T
MD5:	22AFB315F7A6BB5301D9D0689C13E65C
SHA1:	5569C77B5FCBCA791DB576A7A7B55E9EC8959B2C
SHA-256:	FCF3789D368F21A583DAF581EAC991C157C6CD2788E5D128CE226A357E7FE756
SHA-512:	FAA9C95FF34CA44A93E6E82CD1CFDE3C6FBCED0C922FDA2A822545BCD1DC4757A2C43F7017F068EA5C38E4355A65E5703407969B38EA974302404F903E337D11
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......5.............gAMA......a.....sRGB.........iTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <exif:PixelYDimension>565</exif:PixelYDimension>. <exif:PixelXDimension>791</exif:PixelXDimension>. <exif:UserComment>Screenshot</exif:UserComment>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..w^....PLTE........................!%)......*u.026...]_b8;?......MPRlu}EHJ...WY]...cfh..................?AE...IKOyz\|.......TWY...,{.......................QSV.................moq.........._ac......fhjhjl...=......T'...Z\_........................................8F.vwykmo........{\|~......\|}.....................fff...iln............uvx..........stu...qsu4..bdf....................oqs...................................................~......

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 01:21:01.575436115 CEST	49675	443	192.168.2.4	173.222.162.32
May 16, 2024 01:21:01.669132948 CEST	49678	443	192.168.2.4	104.46.162.224
May 16, 2024 01:21:09.585335970 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.585372925 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.585436106 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.585822105 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.585870981 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.585927963 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.586026907 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.586041927 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.586249113 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.586260080 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.972800970 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.973054886 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.973074913 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.974129915 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.974186897 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.974258900 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.974677086 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.974688053 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.975151062 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.975204945 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.975306034 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.975311041 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.975852966 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:09.975907087 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.976876020 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:09.976938963 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.027615070 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.027618885 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.027625084 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.073820114 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.345113993 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.345156908 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.345263004 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.345276117 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.345324039 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.358561039 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.358639002 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.384496927 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.384565115 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.384571075 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.384608984 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.384655952 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.386370897 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.388411999 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.388437986 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.388497114 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.389372110 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.389383078 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.390995026 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.391033888 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.391097069 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.391860962 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.391885996 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.391942024 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.392385960 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.392400980 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.393078089 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.393089056 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.394525051 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.394550085 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.394639969 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.395414114 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.395430088 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.396076918 CEST	49736	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.396096945 CEST	443	49736	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.396512985 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.396539927 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.396589994 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.402729988 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.402743101 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.428114891 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.574912071 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.574932098 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.574996948 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.575010061 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.575043917 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.608203888 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.608212948 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.608263016 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.614430904 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.614437103 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.614485979 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.634974003 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.634982109 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.635026932 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.748641968 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.751373053 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.756683111 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.763005972 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.763062954 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.771864891 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.782886028 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.782938004 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.792396069 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.792401075 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.798286915 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.801491022 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.809068918 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.809120893 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.813838959 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.822567940 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.822618008 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.840455055 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.848040104 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.848104000 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.872706890 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.872764111 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.885149002 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.885206938 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.909883022 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.909981012 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.922364950 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.922439098 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.934111118 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.934120893 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.934678078 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.934690952 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.934894085 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.934906960 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.935148001 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.935153008 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.935158014 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.935417891 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.935432911 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.935487032 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.935544968 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.935908079 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.936141968 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.936188936 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.936280966 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.936512947 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.936559916 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.936626911 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.937057018 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.937129021 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.937705994 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.937758923 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.938400030 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.938465118 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.941577911 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.941643953 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.941847086 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.944816113 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.944822073 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.945048094 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.945055008 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.945178986 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.945318937 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.945327044 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.950965881 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.951014996 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.966144085 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.966195107 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.974183083 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.974232912 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.988116980 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.988122940 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.991651058 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:10.991707087 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.996897936 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.996900082 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:10.997128010 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.000487089 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.000533104 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.018083096 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.018155098 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.035640001 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.035698891 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.044339895 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.044398069 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.084218025 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.084264040 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.084273100 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.084280014 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.084311008 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.105638027 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.105678082 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.105685949 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.105714083 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.116210938 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.116265059 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.119820118 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.119891882 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.119939089 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.121681929 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.121726990 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.122908115 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.122941971 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.122988939 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.123006105 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.123039007 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.123119116 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.123136044 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.123174906 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.123193026 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.123229027 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.130774021 CEST	49740	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.130794048 CEST	443	49740	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.135432005 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.135437965 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.135487080 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.135504007 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.135549068 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.135643005 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.135684013 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.146831989 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.146888018 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.147356987 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.147363901 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.147411108 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.147420883 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.147454977 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.150903940 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.150954008 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.159446001 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.159492016 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.161777973 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.161784887 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.161820889 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.163327932 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.163408995 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.163417101 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.163422108 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.163469076 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.164799929 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.164844990 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.172883034 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.172900915 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.172908068 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.172928095 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.172969103 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.173599005 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.173655987 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.175585032 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.175607920 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.175643921 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.175664902 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.175681114 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.175726891 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.178239107 CEST	49743	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.178252935 CEST	443	49743	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.180464029 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.180516005 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.184452057 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.184498072 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.185144901 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.185178041 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.185192108 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.185204983 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.185236931 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.185920000 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.185950994 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.186008930 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.186769009 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.186779976 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.186799049 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.186841011 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.186852932 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.186891079 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.188285112 CEST	49742	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.188294888 CEST	443	49742	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.194324970 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.194375992 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.196254015 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.196299076 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.199877024 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.199887037 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.199930906 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.204200983 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.204242945 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.211985111 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.212037086 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.215708017 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.215770006 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.225960970 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.226025105 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.229687929 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.229741096 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.237112045 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.237162113 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.244323015 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.244374037 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.249234915 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.249299049 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.254957914 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.255004883 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.262185097 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.262234926 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.265496969 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.265551090 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.272177935 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.272231102 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.275649071 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.275702000 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.282394886 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.282444000 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.289086103 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.289138079 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.292541027 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.292596102 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.295768976 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.295814991 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.295824051 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.295865059 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.295913935 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.300699949 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.300786972 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.319380999 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.319438934 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.322151899 CEST	49735	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.322174072 CEST	443	49735	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.335046053 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.335056067 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.335104942 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.344217062 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.344274044 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.354950905 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.355003119 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.356580973 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.356628895 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.367590904 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.367640018 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.367691994 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.368325949 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.368335009 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.379338980 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.379386902 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.381139994 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.381190062 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.394270897 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.394318104 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.402085066 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.402141094 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.414582014 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.414633036 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.418396950 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.418452024 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.436265945 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.436337948 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.442347050 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.442401886 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.447607040 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.447654963 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.454478979 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.454528093 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.478173018 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.478216887 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.478441000 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.478490114 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.490390062 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.490444899 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.490873098 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.490915060 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.499406099 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.499454975 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.515793085 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.515840054 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.522859097 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.522901058 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.524020910 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.524065971 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.536416054 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.536461115 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.540561914 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.540606976 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.545228004 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.545284033 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.545461893 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.545875072 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.545898914 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.546293020 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.546605110 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.546730042 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.546730042 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.557107925 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.557153940 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.563141108 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.563190937 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.565440893 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.565486908 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.571619987 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.571666002 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.581753969 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.581804037 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.588994980 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.589044094 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.589437008 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.589478970 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.592113972 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.593832970 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.604242086 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.604289055 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.606544971 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.606592894 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.615339041 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.615389109 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.615396023 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.615428925 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.615434885 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.615469933 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.615658045 CEST	49741	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.615678072 CEST	443	49741	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.618278980 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.618324995 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.625087976 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.625154018 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.638437033 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.638494015 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.651343107 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.651388884 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.657660007 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.657711029 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.665648937 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.665702105 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.669595003 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.669644117 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.677584887 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.677632093 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.685524940 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.685573101 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.689414024 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.689471960 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.697118998 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.697195053 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.700839043 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.700887918 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.708554983 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.708832026 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.715744019 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.715931892 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.719466925 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.719512939 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.726457119 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.726735115 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.727545977 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.727835894 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.727855921 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.729173899 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.729248047 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.729656935 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.729656935 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.729751110 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.730077982 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.730143070 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.737122059 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.737170935 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.744127035 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.744249105 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.747459888 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.747771978 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.754352093 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.754425049 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.762597084 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.762705088 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.765503883 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.765675068 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.772491932 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.772574902 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.772641897 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.772641897 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.773313999 CEST	49739	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.773323059 CEST	443	49739	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.784785986 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.784809113 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.832992077 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.899669886 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.899763107 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:11.899852991 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.900861979 CEST	49744	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:11.900881052 CEST	443	49744	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.084394932 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.084422112 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.084500074 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.084528923 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.085392952 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.153490067 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.153529882 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.154925108 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.154963970 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.154993057 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.155126095 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.155808926 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.155822992 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.156203985 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.156224966 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.157658100 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.157685041 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.158164978 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.158606052 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.158643007 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.159012079 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.159022093 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.159053087 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.159543037 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.159554005 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.160526037 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.160552025 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.161164999 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.161336899 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.161365986 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.161537886 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.163033962 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.163048983 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.165239096 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.165250063 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.166413069 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.166435003 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.166532040 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.166960001 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.166975975 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.171035051 CEST	49745	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.171052933 CEST	443	49745	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.357186079 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.357225895 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.359092951 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.392895937 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.411968946 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.411993027 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.414701939 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.414731026 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.416089058 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.416172028 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.417330980 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.417449951 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.431025982 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.431065083 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.435102940 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.435427904 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.435439110 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.463033915 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.463052988 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:12.506617069 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:12.519504070 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.521773100 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.522274971 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.522303104 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.523041010 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.523062944 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.523297071 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.523426056 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.523874998 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.524247885 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.524363995 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.525935888 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.525980949 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.526046038 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.526076078 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.526088953 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.526515007 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.526549101 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.526561022 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.526586056 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.526777029 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.526783943 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.527101040 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.527183056 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.527553082 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.527720928 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.528215885 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.528223991 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.529894114 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.529966116 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.536163092 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.536938906 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.537044048 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.538656950 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.549917936 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.549937010 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.550147057 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.550148010 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.550163984 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.550169945 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.550479889 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.550482035 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.550494909 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.550694942 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.551513910 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.551595926 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.577814102 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.578211069 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.590648890 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.590730906 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.590883970 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.592155933 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.592300892 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.605464935 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.636111975 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.636113882 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.729302883 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:12.729352951 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:12.729429007 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:12.733957052 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:12.733973026 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:12.795036077 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.795675993 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.795692921 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.796005964 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.796621084 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.796673059 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.797317982 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.800148964 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.800327063 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.800340891 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.800632954 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.801158905 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.801207066 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.801453114 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.844110966 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.844120026 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.874825954 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.874891996 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.874937057 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.876142979 CEST	49749	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.876161098 CEST	443	49749	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.877150059 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.877213001 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.877263069 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.879961014 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.880028963 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.880075932 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.882853031 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.882882118 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.882942915 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.884322882 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.884344101 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.884397030 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.884407997 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.884469032 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.884766102 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.884779930 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.896961927 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.897017956 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.898881912 CEST	49750	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.898890972 CEST	443	49750	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.901164055 CEST	49751	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.901180029 CEST	443	49751	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.909657001 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.909676075 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.909727097 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912116051 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912138939 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.912189960 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912570953 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.912602901 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.912657022 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912677050 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.912710905 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912919044 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.912931919 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.915129900 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.915149927 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.915311098 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.915319920 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.915364027 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.921679974 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.921750069 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.925663948 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.925714970 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.928314924 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.928375959 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.934043884 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.934118986 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.951988935 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.952039957 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.954122066 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.954181910 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.958436966 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:12.958496094 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:12.965137959 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.965203047 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:12.967233896 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:12.967289925 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.070923090 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.071042061 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.083573103 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.083627939 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.095860004 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.095941067 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.095973969 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.096004009 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.100740910 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.100816011 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.102844000 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.102936983 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.107393026 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.107460022 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.107475042 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.107501984 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.107520103 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.107558012 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.109445095 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.109489918 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.109493971 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.109533072 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.150434971 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.150465965 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.150542974 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.150574923 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.150619030 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.162888050 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.162959099 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.177398920 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.177474976 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.177532911 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.187783003 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.187846899 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.200285912 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.200373888 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.265762091 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.298017025 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.305675983 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.305690050 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.307368040 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.307388067 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.307785034 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.309530973 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.309551001 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.309906006 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.310594082 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.310671091 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.310923100 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.310986042 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.311553001 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.311613083 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.325709105 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.325730085 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.326020956 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.327919006 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.327970982 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.332109928 CEST	49752	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.332129002 CEST	443	49752	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.340356112 CEST	49753	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.340379000 CEST	443	49753	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.341733932 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.341775894 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.341830969 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.342133045 CEST	49747	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.342139959 CEST	443	49747	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.342458010 CEST	49748	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.342483044 CEST	443	49748	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.343302965 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.343314886 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.350225925 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.350239038 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.350300074 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.352236032 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.352288961 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.356112003 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.356116056 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.358755112 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.358767986 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.372065067 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.372370005 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.372427940 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.384128094 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.384180069 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.406932116 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.407010078 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.431598902 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.431660891 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.441160917 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.441226959 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.445755005 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.463757038 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.463810921 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.475126028 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.475184917 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.492110968 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.505774975 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.505839109 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.520463943 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.520515919 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.530002117 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.530047894 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.549664021 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.549721003 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.554634094 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.554699898 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.554740906 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.554811954 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.554828882 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.554847002 CEST	49755	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.554852009 CEST	443	49755	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.558829069 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.558885098 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.578001022 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.578058004 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.595729113 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.595788956 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.604161024 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.604209900 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.626038074 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.626091957 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.631529093 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.631578922 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.642437935 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.642461061 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.642508030 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.642534018 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.642580032 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.642584085 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.642597914 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.642640114 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.643189907 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.643203974 CEST	443	49756	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.643212080 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.643244982 CEST	49756	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.645354986 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.645410061 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.658822060 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.658885002 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.665208101 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.665417910 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.665433884 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.665513992 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.665565014 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.666445017 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.666496992 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.666815996 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.666873932 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.666933060 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.666939974 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.674793959 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.674814939 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.674860954 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.674877882 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.674912930 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.680699110 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.680754900 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.688828945 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.688880920 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.691441059 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.691493034 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.691498995 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.691540003 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.691541910 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.691581964 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.691747904 CEST	49757	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.691759109 CEST	443	49757	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.692667961 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.692725897 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.700701952 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.700752974 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.705173969 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.705193043 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.705324888 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.705770016 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.705780983 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.708308935 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.708369017 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.710916996 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.712697983 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.712754011 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.717747927 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.717972994 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.717981100 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.718261957 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.718539000 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.718597889 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.718661070 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.721982002 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.722032070 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.722421885 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.722610950 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.722645044 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.722923040 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.723160028 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.723236084 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.723258018 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.726378918 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.726429939 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.733023882 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.733072996 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.736938953 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.736989975 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.744680882 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.744736910 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.752317905 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.752403021 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.756077051 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.756134033 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.763586044 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.763659954 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.764108896 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.764118910 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.767347097 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.767395020 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.773824930 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.774792910 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.774852037 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.782026052 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.782078028 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.785743952 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.785820007 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.792947054 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.792998075 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.806298018 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.806354046 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.809859037 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.809906960 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.813328981 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.813373089 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.813385010 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.813409090 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.813441992 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.815797091 CEST	49754	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.815819979 CEST	443	49754	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.823723078 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.823756933 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.823856115 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.824043989 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.824055910 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.882879019 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.882914066 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.883002996 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.883791924 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.883826971 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.883924007 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.884052992 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.884062052 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.884383917 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.884402990 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.885576963 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.885605097 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.885759115 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.886452913 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.886466026 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.896748066 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.896770000 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.896856070 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.897265911 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.897284031 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.900315046 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.900346994 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.900507927 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.900860071 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:13.900872946 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:13.925672054 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.925761938 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.939851046 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.939863920 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.940145969 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:13.946907997 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:13.988116026 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:14.020689964 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.020710945 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.020771980 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.020781994 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.020817041 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.033129930 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.033185959 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.058187008 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.058259010 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.070533991 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.070605993 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.073549986 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.073570013 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.073622942 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.073631048 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.073673010 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.083033085 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.083091021 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.083097935 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.083111048 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.083153963 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.085966110 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.086025000 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.086030960 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.086061954 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.086076021 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.086102962 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.097481966 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.097501040 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.097557068 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.097570896 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.097615004 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.103291035 CEST	49758	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.103298903 CEST	443	49758	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.111330986 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.111422062 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.137173891 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.137237072 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.146528959 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:14.146707058 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:14.147059917 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:14.153593063 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.153656960 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.182854891 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.232682943 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.236625910 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.236633062 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.237051010 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.237597942 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.237664938 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.237798929 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.240246058 CEST	49760	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.240252972 CEST	443	49760	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.242778063 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.243763924 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.243779898 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.244668961 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.244694948 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.244745970 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.259926081 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.260003090 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.260176897 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.260195971 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.260219097 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.260586023 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.260601997 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.260641098 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.260653019 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.261159897 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.261218071 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.261499882 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.261554003 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.263520956 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.264321089 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.273153067 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.273231030 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.274558067 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.274667978 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.275033951 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.275049925 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.275496960 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.275513887 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.275854111 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.275866985 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.275871038 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.276071072 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.276122093 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.276261091 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.276272058 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.280124903 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.283478022 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.283536911 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.284249067 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.284310102 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.284940958 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.285150051 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.285218000 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.285321951 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.285330057 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.302221060 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.309237957 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.309313059 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.318192005 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.318192005 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.332118034 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.334183931 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.335495949 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.335561037 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.345566988 CEST	49761	443	192.168.2.4	23.196.177.159
May 16, 2024 01:21:14.345578909 CEST	443	49761	23.196.177.159	192.168.2.4
May 16, 2024 01:21:14.348800898 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.348871946 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.374715090 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.374895096 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.402704000 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.402764082 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.410624981 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.410712957 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.435113907 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.435168028 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.447381020 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.447444916 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.472790956 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.472876072 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.492633104 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.492708921 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.504245043 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.504300117 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.523001909 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.523057938 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.533318043 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.533366919 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.538364887 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.538434029 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.538675070 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.540138960 CEST	49762	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.540158033 CEST	443	49762	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.540690899 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.540709972 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.540764093 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.541574001 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.541588068 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.553395033 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.553498983 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.572180986 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.572237015 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.581305981 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.581355095 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.597626925 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.597695112 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.597745895 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.598912954 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.598985910 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.599992037 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.600012064 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.600063086 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.600087881 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.600132942 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.606728077 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.606781960 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.612500906 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.612551928 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.615096092 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.615114927 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.615171909 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.615186930 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.615313053 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.621381044 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.621400118 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.621450901 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.621460915 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.621494055 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.621499062 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.621541023 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.622410059 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.622469902 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.627546072 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.627613068 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.636991024 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.637075901 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.637193918 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.637243986 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.640415907 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.640435934 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.640476942 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.640496969 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.640527010 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.644299030 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.644357920 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.649780989 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.649835110 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.652705908 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.652760983 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.653567076 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.653624058 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.658273935 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.658327103 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.665167093 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.665230989 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.669341087 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.669397116 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.673898935 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.673993111 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.679932117 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.679996967 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.681988001 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.682066917 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.686259031 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.686310053 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.693175077 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.693228006 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.694596052 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.694652081 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.703345060 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.703416109 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.706980944 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.707062960 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.715220928 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.715279102 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.719779968 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.719831944 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.722223997 CEST	49764	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.722249985 CEST	443	49764	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.722584963 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.722615004 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.722784042 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.725116968 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.725126982 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.727653980 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.727715015 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.735707998 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.735761881 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.739834070 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.739892960 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.747709990 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.747782946 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.751676083 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.751729965 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.759546995 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.759617090 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.767292023 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.767363071 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.771171093 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.771238089 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.777621984 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.777707100 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.778664112 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.778729916 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.785691977 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.785758972 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.789433002 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.789484024 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.792917013 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.792973042 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.796329975 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.796394110 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.796623945 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.796683073 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.799163103 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.799223900 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.799231052 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.799242973 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.799280882 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.800261021 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.800318956 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.804512024 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.804594994 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.804650068 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.808708906 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.808758974 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.808768034 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.808778048 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.808836937 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.816420078 CEST	49766	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.816440105 CEST	443	49766	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.828078985 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.828161001 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.834482908 CEST	49765	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.834505081 CEST	443	49765	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.834743023 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.834783077 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.834789991 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.834801912 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.834827900 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.834852934 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.835872889 CEST	49767	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.835886955 CEST	443	49767	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.852832079 CEST	49759	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.852848053 CEST	443	49759	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.900336027 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.926565886 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.926594973 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.926999092 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.928008080 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.928072929 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.931256056 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.932298899 CEST	49763	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.932326078 CEST	443	49763	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.944089890 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.944118023 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.944319963 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.944753885 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:14.944766045 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:14.972121954 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.083530903 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.083822012 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.083834887 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.084157944 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.084472895 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.084522009 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.084785938 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.132112026 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.255326986 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.255345106 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.255398035 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.255414963 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.255461931 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.267743111 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.267793894 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.267802000 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.267822027 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.267848015 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.267879009 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.268023014 CEST	49768	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.268037081 CEST	443	49768	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.304003954 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.304240942 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.304255962 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.304547071 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.304814100 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.304869890 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.304932117 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.347765923 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.347798109 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.438872099 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.438893080 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.439060926 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.439075947 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.443069935 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.452934980 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.453011990 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.476180077 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.476233006 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.488837957 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.488899946 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.501048088 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.501104116 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.501108885 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.501126051 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.501162052 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:15.660448074 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.660496950 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:15.660562038 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:16.242275953 CEST	49770	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:16.242309093 CEST	443	49770	146.190.157.18	192.168.2.4
May 16, 2024 01:21:16.243597984 CEST	49769	443	192.168.2.4	146.190.157.18
May 16, 2024 01:21:16.243635893 CEST	443	49769	146.190.157.18	192.168.2.4
May 16, 2024 01:21:22.384072065 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:22.384146929 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:21:22.384221077 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:23.948992968 CEST	49746	443	192.168.2.4	172.217.15.196
May 16, 2024 01:21:23.949022055 CEST	443	49746	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.033416986 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:12.033447981 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.033575058 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:12.033785105 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:12.033797026 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.265121937 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.273000956 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:12.273021936 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.273407936 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.277048111 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:12.277131081 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:12.329916000 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:22.262198925 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:22.262247086 CEST	443	49784	172.217.15.196	192.168.2.4
May 16, 2024 01:22:22.262294054 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:23.910676956 CEST	49784	443	192.168.2.4	172.217.15.196
May 16, 2024 01:22:23.910711050 CEST	443	49784	172.217.15.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2024 01:21:07.670224905 CEST	53	49301	1.1.1.1	192.168.2.4
May 16, 2024 01:21:07.822279930 CEST	53	59066	1.1.1.1	192.168.2.4
May 16, 2024 01:21:08.448643923 CEST	53	49972	1.1.1.1	192.168.2.4
May 16, 2024 01:21:09.466097116 CEST	49267	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:09.466331005 CEST	55204	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:09.582722902 CEST	53	55204	1.1.1.1	192.168.2.4
May 16, 2024 01:21:09.584769964 CEST	53	49267	1.1.1.1	192.168.2.4
May 16, 2024 01:21:11.249244928 CEST	54570	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:11.249509096 CEST	49200	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:11.363775015 CEST	53	54570	1.1.1.1	192.168.2.4
May 16, 2024 01:21:11.366585970 CEST	53	49200	1.1.1.1	192.168.2.4
May 16, 2024 01:21:12.013730049 CEST	52120	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:12.013730049 CEST	52076	53	192.168.2.4	1.1.1.1
May 16, 2024 01:21:12.121794939 CEST	53	52076	1.1.1.1	192.168.2.4
May 16, 2024 01:21:12.122467041 CEST	53	52120	1.1.1.1	192.168.2.4
May 16, 2024 01:21:27.132313013 CEST	53	60593	1.1.1.1	192.168.2.4
May 16, 2024 01:21:32.193917036 CEST	138	138	192.168.2.4	192.168.2.255
May 16, 2024 01:21:46.344614983 CEST	53	53064	1.1.1.1	192.168.2.4
May 16, 2024 01:22:07.336772919 CEST	53	53226	1.1.1.1	192.168.2.4
May 16, 2024 01:22:09.191479921 CEST	53	62337	1.1.1.1	192.168.2.4
May 16, 2024 01:22:34.813467026 CEST	53	61160	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 16, 2024 01:21:09.466097116 CEST	192.168.2.4	1.1.1.1	0x3d89	Standard query (0)	claytonobrien.autos	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:09.466331005 CEST	192.168.2.4	1.1.1.1	0x893f	Standard query (0)	claytonobrien.autos	65	IN (0x0001)	false
May 16, 2024 01:21:11.249244928 CEST	192.168.2.4	1.1.1.1	0xae99	Standard query (0)	claytonobrien.autos	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:11.249509096 CEST	192.168.2.4	1.1.1.1	0xeaff	Standard query (0)	claytonobrien.autos	65	IN (0x0001)	false
May 16, 2024 01:21:12.013730049 CEST	192.168.2.4	1.1.1.1	0xf183	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:12.013730049 CEST	192.168.2.4	1.1.1.1	0xd110	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 16, 2024 01:21:09.584769964 CEST	1.1.1.1	192.168.2.4	0x3d89	No error (0)	claytonobrien.autos		146.190.157.18	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:11.363775015 CEST	1.1.1.1	192.168.2.4	0xae99	No error (0)	claytonobrien.autos		146.190.157.18	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:12.121794939 CEST	1.1.1.1	192.168.2.4	0xd110	No error (0)	www.google.com			65	IN (0x0001)	false
May 16, 2024 01:21:12.122467041 CEST	1.1.1.1	192.168.2.4	0xf183	No error (0)	www.google.com		172.217.15.196	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:25.104823112 CEST	1.1.1.1	192.168.2.4	0x66cb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:25.104823112 CEST	1.1.1.1	192.168.2.4	0x66cb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:25.880383015 CEST	1.1.1.1	192.168.2.4	0x3a6e	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 01:21:25.880383015 CEST	1.1.1.1	192.168.2.4	0x3a6e	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 16, 2024 01:21:39.318259954 CEST	1.1.1.1	192.168.2.4	0xc8bc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 01:21:39.318259954 CEST	1.1.1.1	192.168.2.4	0xc8bc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 16, 2024 01:22:01.452927113 CEST	1.1.1.1	192.168.2.4	0xef51	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 01:22:01.452927113 CEST	1.1.1.1	192.168.2.4	0xef51	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 16, 2024 01:22:20.272257090 CEST	1.1.1.1	192.168.2.4	0x44ba	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 16, 2024 01:22:20.272257090 CEST	1.1.1.1	192.168.2.4	0x44ba	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

claytonobrien.autos

https:

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:09 UTC	687	OUT	GET /twenty/flop/?moontBxm3SRH HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-15 23:21:10 UTC	467	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: FirstTimer=1; expires=Fri, 14 Jun 2024 23:21:10 GMT; Max-Age=2592000; path=/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains
2024-05-15 23:21:10 UTC	3629	IN	Data Raw: 32 63 30 63 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 32 2c 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: 2c0c<!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta content="width=device-width,initial-scale=1,maximum-scale=2,shrink-to-fit=no" name="viewport"> <title>Facebook</title> <link rel
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 68 20 73 63 6f 70 65 3d 22 63 6f 6c 22 3e 54 69 6d 65 20 45 6c 61 70 73 65 64 3c 2f 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 68 20 73 63 6f 70 65 3d 22 63 6f 6c 22 3e 35 20 73 65 63 73 3c 2f 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 74 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 72 Data Ascii: </div> </th> </tr> <tr> <th scope="col">Time Elapsed</th> <th scope="col">5 secs</th> </tr> <tr
2024-05-15 23:21:10 UTC	3564	IN	Data Raw: 20 26 67 74 3b 20 42 61 6e 6b 69 6e 67 20 70 61 73 73 77 6f 72 64 73 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 26 67 74 3b 20 46 61 63 65 62 6f 6f 6b 20 6c 6f 67 69 6e 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 26 67 74 3b 20 50 68 6f 74 6f 73 20 26 61 6d 70 3b 20 64 6f 63 75 6d 65 6e 74 73 0a 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 53 63 61 6e 20 68 61 73 20 64 65 74 65 63 74 65 64 20 75 6e 77 61 6e 74 65 64 20 61 64 77 61 72 65 20 6f 6e 20 74 68 69 73 20 64 65 76 69 63 65 20 74 68 61 74 20 63 6f 75 6c 64 20 73 74 65 61 6c 20 70 61 73 73 77 6f 72 64 73 2c 20 6f 6e 6c 69 6e 65 20 49 44 73 2c 0a 20 20 20 20 20 20 20 20 66 69 6e 61 6e 63 69 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 70 65 72 73 6f Data Ascii: > Banking passwords<br> > Facebook login<br> > Photos & documents </p> <p>Windows Defender Scan has detected unwanted adware on this device that could steal passwords, online IDs, financial information, perso

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	608	OUT	GET /twenty/flop/HQMhxJg0.css HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:10 UTC	485	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:10 GMT Content-Type: text/css Content-Length: 214882 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close Vary: Accept-Encoding ETag: "6641e9ea-34762" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:10 UTC	3611	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 36 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 32 31 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 69 6e 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 0a 3a 72 6f 6f 74 20 7b 0a 20 20 20 20 2d 2d 62 6c 75 65 3a 20 23 30 30 37 62 66 66 3b 0a 20 20 20 20 2d 2d 69 6e 64 69 67 6f Data Ascii: /! Bootstrap v4.6.0 (https://getbootstrap.com/) * Copyright 2011-2021 The Bootstrap Authors * Copyright 2011-2021 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE) */:root { --blue: #007bff; --indigo
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 6e 3a 20 6d 69 64 64 6c 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 73 76 67 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 0a 7d 0a 0a 74 61 62 6c 65 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6c 61 70 73 65 3a 20 63 6f 6c 6c 61 70 73 65 3b 0a 7d 0a 0a 63 61 70 74 69 6f 6e 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 30 2e 37 35 72 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 63 37 35 37 64 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 63 61 70 74 69 Data Ascii: n: middle; border-style: none;}svg { overflow: hidden; vertical-align: middle;}table { border-collapse: collapse;}caption { padding-top: 0.75rem; padding-bottom: 0.75rem; color: #6c757d; text-align: left; capti
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 38 63 3b 0a 20 20 20 20 77 6f 72 64 2d 77 72 61 70 3a 20 62 72 65 61 6b 2d 77 6f 72 64 3b 0a 7d 0a 0a 61 20 3e 20 63 6f 64 65 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 0a 7d 0a 0a 6b 62 64 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 32 72 65 6d 20 30 2e 34 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 37 2e 35 25 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 31 32 35 32 39 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 2e 32 72 65 6d 3b 0a 7d 0a 0a 6b 62 64 20 6b 62 64 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 0a 20 20 20 20 66 6f Data Ascii: 8c; word-wrap: break-word;}a > code { color: inherit;}kbd { padding: 0.2rem 0.4rem; font-size: 87.5%; color: #fff; background-color: #212529; border-radius: 0.2rem;}kbd kbd { padding: 0; font-size: 100%; fo
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 20 31 30 30 25 3b 0a 20 20 20 20 66 6c 65 78 3a 20 30 20 30 20 31 30 30 25 3b 0a 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 0a 2e 6f 72 64 65 72 2d 66 69 72 73 74 20 7b 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 2d 31 3b 0a 20 20 20 20 6f 72 64 65 72 3a 20 2d 31 3b 0a 7d 0a 0a 2e 6f 72 64 65 72 2d 6c 61 73 74 20 7b 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 33 3b 0a 20 20 20 20 6f 72 64 65 72 3a 20 31 33 3b 0a 7d 0a 0a 2e 6f 72 64 65 72 2d 30 20 7b 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 0a 2e 6f 72 64 65 72 2d 31 20 7b 0a 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 3b 0a 20 20 20 20 6f 72 Data Ascii: 100%; flex: 0 0 100%; max-width: 100%;}.order-first { -ms-flex-order: -1; order: -1;}.order-last { -ms-flex-order: 13; order: 13;}.order-0 { -ms-flex-order: 0; order: 0;}.order-1 { -ms-flex-order: 1; or
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 35 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 35 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 35 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 36 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 36 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 36 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 37 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 73 6d 2d 38 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 38 3b 0a Data Ascii: } .order-sm-5 { -ms-flex-order: 5; order: 5; } .order-sm-6 { -ms-flex-order: 6; order: 6; } .order-sm-7 { -ms-flex-order: 7; order: 7; } .order-sm-8 { -ms-flex-order: 8;
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6d 64 2d 36 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 36 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 36 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6d 64 2d 37 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6d 64 2d 38 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6d 64 2d 39 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 Data Ascii: } .order-md-6 { -ms-flex-order: 6; order: 6; } .order-md-7 { -ms-flex-order: 7; order: 7; } .order-md-8 { -ms-flex-order: 8; order: 8; } .order-md-9 { -ms-flex-order:
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 36 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 37 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 37 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 38 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 39 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 39 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 39 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 31 30 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 Data Ascii: 6; } .order-lg-7 { -ms-flex-order: 7; order: 7; } .order-lg-8 { -ms-flex-order: 8; order: 8; } .order-lg-9 { -ms-flex-order: 9; order: 9; } .order-lg-10 { -ms-flex-ord
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 65 72 3a 20 37 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 38 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 38 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 39 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 39 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 39 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 31 30 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 30 3b 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 31 30 3b 0a 20 20 20 20 7d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 78 6c 2d 31 31 20 7b 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 Data Ascii: er: 7; } .order-xl-8 { -ms-flex-order: 8; order: 8; } .order-xl-9 { -ms-flex-order: 9; order: 9; } .order-xl-10 { -ms-flex-order: 10; order: 10; } .order-xl-11 { -ms-f
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 62 6c 65 2d 64 61 6e 67 65 72 20 74 62 6f 64 79 20 2b 20 74 62 6f 64 79 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 65 64 39 36 39 65 3b 0a 7d 0a 0a 2e 74 61 62 6c 65 2d 68 6f 76 65 72 20 2e 74 61 62 6c 65 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 31 62 30 62 37 3b 0a 7d 0a 0a 2e 74 61 62 6c 65 2d 68 6f 76 65 72 20 2e 74 61 62 6c 65 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 20 3e 20 74 64 2c 0a 2e 74 61 62 6c 65 2d 68 6f 76 65 72 20 2e 74 61 62 6c 65 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 20 3e 20 74 68 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 31 62 30 62 37 3b 0a 7d 0a 0a 2e 74 61 62 6c 65 2d 6c 69 67 68 74 2c 0a 2e 74 Data Ascii: ble-danger tbody + tbody { border-color: #ed969e;}.table-hover .table-danger:hover { background-color: #f1b0b7;}.table-hover .table-danger:hover > td,.table-hover .table-danger:hover > th { background-color: #f1b0b7;}.table-light,.t
2024-05-15 23:21:10 UTC	4096	IN	Data Raw: 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 7d 0a 0a 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 63 37 35 37 64 3b 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 7d 0a 0a 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 3a 2d 6d 73 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 63 37 35 37 64 3b 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 7d 0a 0a 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 63 37 35 37 64 3b 0a 20 20 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 7d 0a 0a 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 64 Data Ascii: opacity: 1;}.form-control:-ms-input-placeholder { color: #6c757d; opacity: 1;}.form-control::-ms-input-placeholder { color: #6c757d; opacity: 1;}.form-control::placeholder { color: #6c757d; opacity: 1;}.form-control:d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	608	OUT	GET /twenty/flop/CW76YE4c.css HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	456	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: text/css Content-Length: 133 Last-Modified: Mon, 13 May 2024 10:22:35 GMT Connection: close ETag: "6641e9eb-85" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	133	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 30 66 32 66 35 3b 0a 7d 0a 0a 2e 62 67 2d 69 6d 67 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 2d 31 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 7d Data Ascii: body { background: #f0f2f5;}.bg-img { position: absolute; top: -1px; left: 0; width: 100%; height: 100%;}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	608	OUT	GET /twenty/flop/tJ67C7xl.css HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	483	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: text/css Content-Length: 16995 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close Vary: Accept-Encoding ETag: "6641e9e9-4263" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	3613	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4f 70 65 6e 20 53 61 6e 73 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 66 6f 72 6d 2d 63 68 65 63 6b 2d 69 6e 70 75 74 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 31 2e 32 35 72 65 6d 3b 0a 7d 0a 0a 0a 23 6e 65 77 5f 73 63 68 65 20 7b 0a 20 20 20 20 77 69 64 74 68 Data Ascii: body { overflow-y: hidden; font-family: 'Open Sans', sans-serif;}a:hover { text-decoration: none !important;}.form-check-input { position: absolute; margin-top: 0px !important; margin-left: -1.25rem;}#new_sche { width
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 6f 72 3a 20 23 33 39 34 37 62 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 74 6f 70 3a 20 2d 33 70 78 3b 0a 7d 0a 0a 2e 73 63 61 6e 5f 62 6f 78 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 37 36 35 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 34 32 35 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 32 70 78 20 35 70 78 20 31 70 78 20 72 67 62 28 36 34 20 36 30 20 36 37 20 2f 20 31 36 25 29 3b 0a 20 20 20 20 6d 61 Data Ascii: or: #3947b0; padding: 5px; border-radius: 6px; text-align: center; position: relative; top: -3px;}.scan_box { width: 765px; height: 425px; background-color: #fff; box-shadow: 0 2px 5px 1px rgb(64 60 67 / 16%); ma
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 27 27 3b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 30 34 32 38 39 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 37 30 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 32 70 78 3b 0a 20 20 20 20 74 6f 70 3a 20 34 32 70 78 3b 0a 7d 0a 0a 2e 74 6f 74 61 6c 5f 64 65 74 61 69 6c 5f 73 63 61 6e 20 75 6c 20 6c 69 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 20 20 77 69 64 74 68 3a 20 39 30 70 78 3b 0a 7d 0a 0a 2e 74 6f 74 61 6c 5f 64 65 74 61 69 6c 5f 73 63 61 6e 20 75 6c 20 6c 69 20 61 20 7b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 2e 70 63 5f 64 65 Data Ascii: absolute; content: ''; display: block; background-color: #204289; width: 70px; height: 2px; top: 42px;}.total_detail_scan ul li:first-child { width: 90px;}.total_detail_scan ul li a { text-decoration: none;}.pc_de
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 20 20 20 20 35 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 31 2e 31 2c 20 31 2e 31 29 3b 0a 20 20 20 20 7d 0a 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 31 2c 20 31 29 3b 0a 20 20 20 20 7d 0a 7d 0a 0a 2e 63 61 72 64 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 7a 6f 6f 6d 69 6e 6f 75 74 73 69 6e 67 6c 65 66 65 61 74 75 72 65 64 20 34 73 20 69 6e 66 69 6e 69 74 65 3b 0a 7d 0a 0a 40 6b 65 79 66 72 61 6d 65 73 20 7a 6f 6f 6d 69 6e 6f 75 74 73 69 6e 67 6c 65 66 65 61 74 75 72 65 64 20 7b 0a 20 20 20 20 30 25 20 7b 0a 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 31 2c 20 31 29 3b 0a 20 Data Ascii: 50% { transform: scale(1.1, 1.1); } 100% { transform: scale(1, 1); }}.cardcontainer { animation: zoominoutsinglefeatured 4s infinite;}@keyframes zoominoutsinglefeatured { 0% { transform: scale(1, 1);
2024-05-15 23:21:11 UTC	1094	IN	Data Raw: 20 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 39 39 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 31 61 37 33 65 38 3b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 32 38 65 6d 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 Data Ascii: 4rem; z-index: 999999; background: #1a73e8; width: 28em; text-align: left; padding-top: 4px; display: none; color: #FFFFFF; padding-left: 20px; padding-right: 20px; border-ra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	593	OUT	GET /twenty/flop/AiRD0CDb.js HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	498	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: application/javascript Content-Length: 85586 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close Vary: Accept-Encoding ETag: "6641e9ea-14e52" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	3598	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 32 2e 32 2e 34 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 6e Data Ascii: /! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a documen
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 66 2e 61 70 70 6c 79 28 5b 5d 2c 68 29 7d 2c 67 75 69 64 3a 31 2c 70 72 6f 78 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 66 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 63 3d 61 5b 62 5d 2c 62 3d 61 2c 61 3d 63 29 2c 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 3f 28 64 3d 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 32 29 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 62 7c 7c 74 68 69 73 2c 64 2e 63 6f 6e 63 61 74 28 65 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 29 29 29 7d 2c 66 2e 67 75 69 64 3d 61 2e 67 75 69 64 3d 61 2e 67 75 69 64 7c 7c 6e 2e 67 75 69 64 2b 2b 2c 66 29 3a 76 6f 69 64 20 30 7d 2c 6e 6f 77 3a Data Ascii: );return f.apply([],h)},guid:1,proxy:function(a,b){var c,d,f;return"string"==typeof b&&(c=a[b],b=a,a=c),n.isFunction(a)?(d=e.call(arguments,2),f=function(){return a.apply(b\|\|this,d.concat(e.call(arguments)))},f.guid=a.guid=a.guid\|\|n.guid++,f):void 0},now:
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 64 65 78 7c 7c 43 29 3b 69 66 28 64 29 72 65 74 75 72 6e 20 64 3b 69 66 28 63 29 77 68 69 6c 65 28 63 3d 63 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 63 3d 3d 3d 62 29 72 65 74 75 72 6e 2d 31 3b 72 65 74 75 72 6e 20 61 3f 31 3a 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6c 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 Data Ascii: dex\|\|C);if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function la(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function ma(a){return function(b){var c=b.nodeName.toLowerCase();return("input
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 67 2e 75 6e 73 68 69 66 74 28 63 29 3b 63 3d 62 3b 77 68 69 6c 65 28 63 3d 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 68 2e 75 6e 73 68 69 66 74 28 63 29 3b 77 68 69 6c 65 28 67 5b 64 5d 3d 3d 3d 68 5b 64 5d 29 64 2b 2b 3b 72 65 74 75 72 6e 20 64 3f 6b 61 28 67 5b 64 5d 2c 68 5b 64 5d 29 3a 67 5b 64 5d 3d 3d 3d 76 3f 2d 31 3a 68 5b 64 5d 3d 3d 3d 76 3f 31 3a 30 7d 2c 6e 29 3a 6e 7d 2c 66 61 2e 6d 61 74 63 68 65 73 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 66 61 28 61 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 62 29 7d 2c 66 61 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 21 3d 3d 6e 26 26 6d 28 61 29 2c 62 3d 62 2e 72 65 70 6c 61 Data Ascii: g.unshift(c);c=b;while(c=c.parentNode)h.unshift(c);while(g[d]===h[d])d++;return d?ka(g[d],h[d]):g[d]===v?-1:h[d]===v?1:0},n):n},fa.matches=function(a,b){return fa(a,null,null,b)},fa.matchesSelector=function(a,b){if((a.ownerDocument\|\|a)!==n&&m(a),b=b.repla
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 5b 64 5d 3d 66 5b 67 5d 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 65 28 61 2c 30 2c 63 29 7d 29 3a 65 7d 7d 2c 70 73 65 75 64 6f 73 3a 7b 6e 6f 74 3a 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 2c 63 3d 5b 5d 2c 64 3d 68 28 61 2e 72 65 70 6c 61 63 65 28 51 2c 22 24 31 22 29 29 3b 72 65 74 75 72 6e 20 64 5b 75 5d 3f 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 65 29 7b 76 61 72 20 66 2c 67 3d 64 28 61 2c 6e 75 6c 6c 2c 65 2c 5b 5d 29 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 28 66 3d 67 5b 68 5d 29 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c Data Ascii: [d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:ha(function(a){var b=[],c=[],d=h(a.replace(Q,"$1"));return d[u]?ha(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 3d 75 61 28 72 3d 3d 3d 67 3f 72 2e 73 70 6c 69 63 65 28 6f 2c 72 2e 6c 65 6e 67 74 68 29 3a 72 29 2c 65 3f 65 28 6e 75 6c 6c 2c 67 2c 72 2c 69 29 3a 48 2e 61 70 70 6c 79 28 67 2c 72 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 77 61 28 61 29 7b 66 6f 72 28 76 61 72 20 62 2c 63 2c 65 2c 66 3d 61 2e 6c 65 6e 67 74 68 2c 67 3d 64 2e 72 65 6c 61 74 69 76 65 5b 61 5b 30 5d 2e 74 79 70 65 5d 2c 68 3d 67 7c 7c 64 2e 72 65 6c 61 74 69 76 65 5b 22 20 22 5d 2c 69 3d 67 3f 31 3a 30 2c 6b 3d 72 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 7d 2c 68 2c 21 30 29 2c 6c 3d 72 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4a 28 62 2c 61 29 3e 2d 31 7d 2c 68 2c 21 30 29 2c 6d 3d 5b 66 75 6e 63 74 69 6f 6e 28 61 2c 63 2c 64 29 7b Data Ascii: =ua(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):H.apply(g,r)})}function wa(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g\|\|d.relative[" "],i=g?1:0,k=ra(function(a){return a===b},h,!0),l=ra(function(a){return J(b,a)>-1},h,!0),m=[function(a,c,d){
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 72 3f 74 68 69 73 2e 73 65 6c 65 63 74 6f 72 2b 22 20 22 2b 61 3a 61 2c 64 7d 2c 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 7a 28 74 68 69 73 2c 61 7c 7c 5b 5d 2c 21 31 29 29 7d 2c 6e 6f 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 7a 28 74 68 69 73 2c 61 7c 7c 5b 5d 2c 21 30 29 29 7d 2c 69 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 7a 28 74 68 69 73 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 77 2e 74 65 73 74 28 61 29 3f 6e 28 61 29 3a 61 7c 7c 5b 5d 2c 21 31 29 2e 6c 65 6e 67 74 68 7d 7d 29 3b 76 61 72 20 41 2c 42 3d 2f 5e 28 3f 3a 5c 73 2a 28 3c 5b 5c 77 5c 57 5d 2b 3e Data Ascii: r?this.selector+" "+a:a,d},filter:function(a){return this.pushStack(z(this,a\|\|[],!1))},not:function(a){return this.pushStack(z(this,a\|\|[],!0))},is:function(a){return!!z(this,"string"==typeof a&&w.test(a)?n(a):a\|\|[],!1).length}});var A,B=/^(?:\s*(<[\w\W]+>
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 76 65 64 22 5d 2c 5b 22 72 65 6a 65 63 74 22 2c 22 66 61 69 6c 22 2c 6e 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2c 22 72 65 6a 65 63 74 65 64 22 5d 2c 5b 22 6e 6f 74 69 66 79 22 2c 22 70 72 6f 67 72 65 73 73 22 2c 6e 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6d 65 6d 6f 72 79 22 29 5d 5d 2c 63 3d 22 70 65 6e 64 69 6e 67 22 2c 64 3d 7b 73 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 2c 61 6c 77 61 79 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 2e 64 6f 6e 65 28 61 72 67 75 6d 65 6e 74 73 29 2e 66 61 69 6c 28 61 72 67 75 6d 65 6e 74 73 29 2c 74 68 69 73 7d 2c 74 68 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 2e Data Ascii: ved"],["reject","fail",n.Callbacks("once memory"),"rejected"],["notify","progress",n.Callbacks("memory")]],c="pending",d={state:function(){return c},always:function(){return e.done(arguments).fail(arguments),this},then:function(){var a=arguments;return n.
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 6e 20 4f 2e 61 63 63 65 73 73 28 61 2c 62 2c 63 29 7d 2c 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4f 2e 72 65 6d 6f 76 65 28 61 2c 62 29 7d 2c 5f 64 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 4e 2e 61 63 63 65 73 73 28 61 2c 62 2c 63 29 7d 2c 5f 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4e 2e 72 65 6d 6f 76 65 28 61 2c 62 29 7d 7d 29 2c 6e 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 64 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 74 68 69 73 5b 30 5d 2c 67 3d 66 26 26 66 2e 61 74 74 72 69 62 75 74 65 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 61 29 7b 69 66 28 74 68 69 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 4f 2e 67 Data Ascii: n O.access(a,b,c)},removeData:function(a,b){O.remove(a,b)},_data:function(a,b,c){return N.access(a,b,c)},_removeData:function(a,b){N.remove(a,b)}}),n.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=O.g
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 66 29 2c 22 73 63 72 69 70 74 22 29 2c 6a 26 26 61 61 28 67 29 2c 63 29 7b 6b 3d 30 3b 77 68 69 6c 65 28 66 3d 67 5b 6b 2b 2b 5d 29 5a 2e 74 65 73 74 28 66 2e 74 79 70 65 7c 7c 22 22 29 26 26 63 2e 70 75 73 68 28 66 29 7d 72 65 74 75 72 6e 20 6c 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 64 2e 63 72 65 61 74 65 44 6f 63 75 6d 65 6e 74 46 72 61 67 6d 65 6e 74 28 29 2c 62 3d 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 63 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 72 61 64 69 6f 22 29 2c 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 Data Ascii: l.appendChild(f),"script"),j&&aa(g),c){k=0;while(f=g[k++])Z.test(f.type\|\|"")&&c.push(f)}return l}!function(){var a=d.createDocumentFragment(),b=a.appendChild(d.createElement("div")),c=d.createElement("input");c.setAttribute("type","radio"),c.setAttribute(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	654	OUT	GET /twenty/flop/4HNPHMfJ.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	463	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: image/png Content-Length: 193376 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-2f360" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	3633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 72 00 00 03 a3 08 03 00 00 00 79 b2 b5 db 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 00 50 4c 54 45 f0 f2 f5 ef f0 f4 fe fd fe e5 e7 eb ff ff fe f4 c7 c4 f2 f4 f7 ff ff ff f2 f2 f2 02 01 02 fb fb fc f1 f1 f1 f8 f9 f9 e5 e6 e7 ce d0 d3 ef f2 f4 1e 1f 20 eb ec ee f6 f6 f5 db dc dd 0c 0a 0b f7 c9 c6 fa be b2 f2 c5 c2 de df e1 ed ee f2 28 26 26 8a 82 7b 32 2e 2f 94 8c 87 91 87 7f d0 c1 bd f3 c6 c9 ea ea eb 1b 18 19 87 86 86 9f 90 8c f9 b6 73 d4 c6 c5 fc f7 f6 f7 ac 5c 41 3f 40 77 78 79 11 12 15 4a 48 49 ef c1 bb 70 6f 70 7f 7f 80 8a 8b 8e e2 e3 e4 f8 b2 68 a6 9a 94 c5 c4 c4 f5 9d 47 f6 e0 Data Ascii: PNGIHDRrygAMAasRGBpHYsPLTE (&&{2./s\A?@wxyJHIpophG
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: b9 5e f1 54 bb 1e 0a 58 4e bf ae 3c ff e9 ff 99 08 84 c4 50 c0 77 eb 1f d6 ff 9f db 89 ee 07 88 01 bd d3 0d 7c fe 87 ef ad ff 6e 65 e5 87 eb eb ff fc e1 e7 7f a8 7c 3a f1 25 bb c8 7d ff d3 75 7a de 1d c1 1e fe 98 54 2e 46 e2 a1 f3 3c 1b 79 7d 9d 3d 43 2a f7 f9 cb fb e0 9a 4f e6 3e 3d b6 b4 d8 e8 d5 0e 98 eb af 1e 30 73 a5 5a 4d 98 ff 9a 57 0e 15 b9 b8 53 d3 9b 8b 0b 0f d0 34 26 6e 35 1c 08 70 57 06 e1 2c b6 e0 10 8e 8a 5c 63 b0 ad d5 dc c7 59 e2 7f b6 26 f3 ff 9f a3 65 b3 b5 1e 47 45 9b 52 85 4a 25 8b 34 6f 71 38 33 0b 3b f9 04 2a 93 85 a6 23 56 33 83 3c 21 34 35 3f f7 bb 7b 7c 79 2c 8b c7 2a 37 56 9a a1 f1 64 7c 1f 35 1d f5 2c e6 7c 8f 5f be 74 f9 a3 8f 3f be f9 ee af df fd e4 c2 e9 13 27 8f 7d fa 9b 0d 22 2e ad 9e cf 17 f6 45 2e 00 5a ad 56 fd 2f 2d 22 Data Ascii: ^TXN<Pw\|ne\|:%}uzT.F<y}=CO>=0sZMWS4&n5pW,\cY&eGERJ%4oq83;#V3<!45?{\|y,*7Vd\|5,\|_t?'}".E.ZV/-"
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 66 ee d6 47 e7 a7 95 ac bc 0f 84 dc 49 8d 0b 3f d0 2b dc 56 f0 08 88 bd f3 df 7c 78 0f b9 b8 7e a7 7b ee 42 ae 86 df 15 1f e8 70 8f d8 e5 80 4a 3f bb e0 4a 8b 96 5d 9e f0 28 e5 80 c4 93 71 0f df 9d e4 9f 12 b7 ca 82 a9 fc 55 8e 5c 6e dc 9e 51 5b 13 d3 2c 92 2a 9d 16 1f 68 c6 af eb 19 d7 83 f2 3c 96 f1 e7 7f 8d 16 7e 84 db 4f fe f1 75 26 40 1f bc e0 a3 f3 fd e6 06 2f 53 64 94 84 72 3f 02 2a 3e 06 bb ec 5b cf eb 7e f3 2d ac e1 75 be 04 bd 55 8c 9d 98 34 b9 08 4b 97 ba 17 fe f9 e1 f6 50 f4 e5 a0 e5 c6 8d db 43 7f 0f 78 1f 32 a9 1f c3 1f 78 05 8a 28 76 92 77 ee 33 70 29 72 83 d3 aa 18 42 55 aa 12 72 e1 68 ae aa 9d e0 9e c5 f6 f8 37 20 b7 03 30 2f 77 f0 73 e3 c6 6d 02 aa a7 6f 9f 97 23 37 38 2d 44 15 ec b0 1b ba 16 fc 4e d2 2e 37 6e dc b8 71 e3 c6 ed 51 21 77 Data Ascii: fGI?+V\|x~{BpJ?J](qU\nQ[,h<~Ou&@/Sdr?>[~-uU4KPCx2x(vw3p)rBUrh7 0/wsmo#78-DN.7nqQ!w
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 89 cb 55 2e b7 27 5f e5 ba d4 0d fc 19 d8 e5 c6 91 fb 88 8d 85 38 0b 62 73 00 c6 8e ca c8 50 0a 29 2a 43 6e 2a 6b 9b 10 a0 bd c6 b0 0f 60 e4 f4 52 56 af 41 64 25 8b d6 20 96 c9 eb 2a b2 77 e1 21 ce 56 68 36 14 b3 89 00 0c 34 e6 30 9e 06 52 e1 fe cd 5a e4 9d 4e 16 8c 6c b6 d8 4b 91 7b b6 01 d5 4b 8f 75 a3 57 6b db 95 1a b0 52 af e9 59 5d a7 b9 d5 9c 25 63 50 3e 37 c2 94 ef a0 50 18 b5 a1 94 81 e1 22 54 5e b1 d2 2a 90 3f b7 56 2c 16 6b d0 e2 48 c4 65 99 33 82 37 04 21 9d c1 4e 7b 25 40 ce a2 e9 d6 42 a9 a9 aa 56 0b 75 25 6a 15 e6 58 06 72 a3 80 97 81 fa 93 66 36 13 ae 8f 6c 03 73 b8 c9 7e b1 54 84 36 0d 23 b3 47 0c 52 2e ae c4 54 ee d0 82 b7 3b d3 d7 1b 72 30 52 4c e5 33 7d 3b 8b e3 50 2c 5b 35 bc a3 76 a5 05 67 6e bd 56 cc 16 f5 1a 32 8f 0a a5 56 86 a6 56 Data Ascii: U.'_8bsP)Cnk`RVAd% w!Vh640RZNlK{KuWkRY]%cP>7P"T^?V,kHe37!N{%@BVu%jXrf6ls~T6#GR.T;r0RL3};P,[5vgnV2VV
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 88 10 19 a4 d0 6a f6 aa 5e 4a c6 95 04 a6 f1 e9 09 ac 67 c9 a2 db 1e 40 4d b3 3d 71 5a f0 79 49 b3 0a ac 21 1f e1 3a a8 92 ca a6 3e f4 14 b4 84 03 15 02 5c f1 94 42 85 1d d3 a3 1e 7c da ac 52 87 4a 2f 84 37 25 42 41 c3 31 40 a7 24 b4 6f 69 b6 03 5e 45 2b a7 e5 a0 17 db 15 b0 26 45 56 2b 65 4d f5 ba 73 eb 2a 00 9b a6 90 28 ac 53 c6 2a 41 56 ea 42 4d a3 29 3c 0e 2e 0d a1 d7 96 e8 31 b9 94 83 54 5e 32 c8 e7 72 b9 1d 41 e4 4e ca 5a cc 48 d8 80 0b 5a 6a ad 1b 70 8c d4 6e 62 32 bf cb b3 7b b8 3d d1 2a f7 21 a3 ad d0 11 af 8c aa c7 e1 4c 09 c5 15 29 5c f9 e1 42 b5 18 7b 19 24 9c c6 b2 5e f7 3e 4b 8f 61 e0 10 dc b2 89 6e 09 68 d7 63 2a 50 02 b0 3b 76 66 e6 d2 4b 21 47 92 23 7a 27 25 98 e8 0e 65 ee b2 d7 9a f6 1a a0 91 0e be 85 a0 77 3c 9e a5 f8 b2 a7 dd 75 bc ee Data Ascii: j^Jg@M=qZyI!:>\B\|RJ/7%BA1@$oi^E+&EV+eMs(SAVBM)<.1T^2rANZHZjpnb2{=!L)\B{$^>KanhcP;vfK!G#z'%ew<u
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: f1 a0 da d4 19 72 7d 10 b1 f9 8c 1e 01 72 2b 84 dc 66 25 17 ce e7 7c c8 f5 91 2c 54 70 ac 17 e3 0c b9 15 46 51 30 77 88 06 d7 f9 64 2e 87 88 e6 7e af 68 c7 4b 98 11 1e 34 ca d0 c4 ed 5c 1e 7e 68 51 0d 84 50 e1 0a 59 49 5c e5 72 e4 ee af 72 57 66 54 ee 9c 3e dd 4f e5 ae de 0f a8 ce 56 56 39 72 77 23 b7 05 e4 e6 91 23 74 85 74 ed 1b 3b 37 6f ed 6c 11 74 df 05 72 77 80 dc d3 e7 4c 8e 5c 6e 5c e5 3e 1a cf 32 6a 2c f7 f3 f9 9e 89 e8 a8 58 1d 8d 46 31 33 8b 70 a7 7a 2b 0d e4 66 92 45 4d 56 24 c0 16 c8 75 b4 ae e6 f5 2a 76 9f 62 93 cb 23 20 b7 1e 21 88 52 d1 47 7b 90 89 a5 8c 91 69 8e 4a 45 23 8b 78 e6 5c 3e d9 1b 6a a2 c2 10 de 37 25 41 55 12 28 0d 39 9e cb e5 c7 9e 23 f7 7e 28 5e ea 12 5e 5d 75 6f 98 e1 c9 c9 e3 19 2e 2f b3 55 8e dc bd 90 2b a6 f2 a8 ed 78 e2 Data Ascii: r}r+f%\|,TpFQ0wd.~hK4\~hQPYI\rrWfT>OVV9rw##tt;7oltrwL\n\>2j,XF13pz+fEMV$u*vb# !RG{iJE#x\>j7%AU(9#~(^^]uo./U+x
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: ae 71 8c f3 72 a8 5c 30 97 d6 66 a0 71 83 82 82 18 0f e7 4f 9d 3f 4f 94 48 3e c5 c0 65 ec 26 43 e2 26 03 b9 99 a8 1f 67 94 d5 27 c1 1d 2a 3d 3b 9d 89 1b 97 2e de 70 0b 89 9b 4d 97 ae 95 3d 8f a0 72 41 57 22 ae 9e b6 2d 20 61 8b 0d 97 6e ba 88 ab 0a c7 a3 de c0 3b ba 06 5c 6d 6b f3 56 7d 2f 3f 68 e9 fe ff eb 5c f3 fc 7e df 71 6c a4 dc af 9d 3c c9 6f 74 2a 4f 5e 93 62 5d 63 ee 7e d6 b8 06 72 37 09 71 19 b6 f2 22 88 1b ec eb 97 a6 13 b2 31 67 63 56 22 cf ae 44 af d3 ca 1d 1c af e5 4e 6e 75 9b 14 b9 3c 3c 65 11 2a 97 eb ca 67 ae de 22 e4 16 d6 96 a0 93 5b db d7 d9 d7 89 d2 32 0a cc 2b 40 ae 52 4b a6 73 e7 d0 21 8d bb f5 06 72 8d 63 9c 97 43 e5 d2 0c b2 44 ae 67 19 94 b5 18 dd 06 55 12 8c 51 58 0e 4f 0e 2a cb 8d 8f 8f cd 4f 4a 4d 88 80 b6 8d 4b 17 b7 a4 74 81 Data Ascii: qr\0fqO?OH>e&C&g'=;.pM=rAW"- an;\mkV}/?h\~ql<otO^b]c~r7q"1gcV"DNnu<<eg"[2+@RKs!rcCDgUQXOOJMKt
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: b9 89 38 a9 b8 12 74 b9 99 4b d6 ca 58 ff ef 1c 23 bb 9d 9e 9e 91 8b 23 17 7b 7a 18 ba 64 be 33 43 c8 ed 1f 9b c5 4f fb 8e 59 78 51 4d ab cc c5 55 99 9f b2 7a ac d5 c8 1e af d3 6b 92 d9 b9 5a b6 6a 1b bd 12 90 56 ab 69 9d e3 89 61 af 52 33 3d 6c 31 f1 cd 77 1e 39 35 25 65 ae c5 b6 5a e5 3a 6d ab 7e 05 36 ee f8 3a 28 4f c9 06 e8 da 38 7f 48 db d1 25 eb 47 32 b3 66 e4 1a e3 53 9b a3 b2 ac b3 58 f6 f1 0d 56 26 96 e9 c4 72 25 59 05 ae 8e c0 31 2b 98 7f ea 70 17 41 e5 16 0c 74 ed 8e 28 28 a0 bd dc fb cf ee c3 70 6a 82 88 4b 4b ba 90 bc c3 0b 0b 8b 93 6d 48 35 60 75 4b c8 2d c1 d4 32 ef f3 ba ab e6 57 22 9b c4 d6 2f 1f aa 61 f3 b7 38 f4 c8 93 9a 15 51 65 7e e1 49 51 71 a9 51 fe 51 89 f5 e1 1a 3e 2b ec 7e 65 44 cf f0 04 dc d3 4d 58 45 e9 01 5c a6 c7 31 00 8c 8f Data Ascii: 8tKX##{zd3COYxQMUzkZjViaR3=l1w95%eZ:m~6:(O8H%G2fSXV&r%Y1+pAt((pjKKmH5`uK-2W"/a8Qe~IQqQQ>+~eDMXE\1
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: cb ad 37 90 6b a8 dc ef f9 a8 d1 41 e6 e4 6d 69 b9 82 b7 e8 e0 a6 c6 d7 33 70 d1 da a5 37 34 78 43 cb 12 13 c8 08 a3 b4 58 30 57 57 5a 16 5b 42 88 3a c0 86 10 90 5b e2 c6 c4 72 eb 02 4f 2c d7 61 45 e8 cc 99 9f 5e 3f 77 f9 f2 25 68 dc cb e7 6e d1 76 ee 44 0f da b9 13 b3 43 8d d6 c6 27 b3 83 7d 1d 9d 60 ae c3 c3 7e 42 b5 8d 72 7a 88 cf 67 02 ac 2d 3a 94 2a 23 56 9a 88 74 8a 43 33 54 3a 47 0d 2f 7c 8a c2 b2 ce d2 79 ed 7d a1 f5 2d 96 57 57 a3 9d 5a dc 20 3d 4c c8 f5 74 cf 50 7f 2c 70 c8 ab 43 5d 28 22 27 2a c9 5c b9 26 64 ff 52 36 73 8d 5e ee 86 32 d7 63 64 f9 3b 0d 1f a5 fb 14 de e6 15 e4 b6 3e fc 74 e1 cc 42 7b 2b 68 fb f0 2a 8a cc c3 33 0f 87 05 72 05 74 79 71 08 c8 6d 05 72 9b 0b c9 0c a3 90 ea 3e 58 6d c7 40 84 0e b9 2b df 89 5c 1f df b2 34 ed 84 fb bc Data Ascii: 7kAmi3p74xCX0WWZ[B:[rO,aE^?w%hnvDC'}`~Brzg-:#VtC3T:G/\|y}-WWZ =LtP,pC]("'\&dR6s^2cd;>tB{+h*3rtyqmr>Xm@+\4
2024-05-15 23:21:11 UTC	4096	IN	Data Raw: 14 a7 22 57 8a 5c d2 b9 84 5c c8 5c e4 9f d4 f6 e1 1f 19 84 08 8d 88 ac 5c 51 5a 16 d4 7d 93 9a b9 75 92 ba 3d c3 3d 3d 62 71 62 66 68 6a ac af b9 b9 6f f9 c9 13 e6 2c 49 5d 9c 72 dc b1 9a 50 6a b5 12 73 05 6e 1b 25 74 35 3f 27 a7 55 12 4c 71 a9 b2 89 49 64 f2 7d b4 7a ad 14 fd 5d 87 47 f5 19 28 dc 67 fc ae c5 d4 62 b5 ea 76 70 ad 6b 6d e7 5a 3c e7 9b d7 51 b9 5e 3e ce ba 9d 23 82 ae 53 d4 95 35 93 e5 c3 95 1e c8 3d 62 20 77 23 7e 20 d6 92 84 fc d4 45 a1 35 27 96 35 c3 65 7a b2 13 3f 7c a2 46 5c 94 07 e4 b6 3f 7f cc 2a f7 6f fc f6 b7 e7 a3 93 17 10 93 4b 81 d1 53 0f 95 ba f2 68 1b ab 5c f0 b6 80 48 4d d4 c5 87 12 b9 4d 6b d9 4f ad 52 b9 a8 10 67 e8 64 6c ae 50 b9 90 b8 b2 59 9b 91 9b 9b ab 53 b9 a8 3d 1f cc c8 ca 3a 58 9f b2 c9 91 2b 12 0d 92 c3 75 27 39 Data Ascii: "W\\\\QZ}u===bqbfhjo,I]rPjsn%t5?'ULqId}z]G(gbvpkmZ<Q^>#S5=b w#~ E5'5ez?\|F\?*oKSh\HMMkORgdlPYS=:X+u'9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:10 UTC	654	OUT	GET /twenty/flop/4kkzwAOC.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: image/png Content-Length: 1443 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-5a3" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	1443	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 94 00 00 00 15 08 06 00 00 00 a0 d0 c7 a9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 34 36 30 2c 20 32 30 32 30 2f 30 35 2f 31 32 2d 31 36 3a 30 34 3a 31 37 20 20 Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:11 UTC	654	OUT	GET /twenty/flop/7MALKGdt.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:11 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: image/png Content-Length: 1045 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-415" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:11 UTC	1045	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2f 00 00 00 2e 08 06 00 00 00 b8 7b 40 09 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 23 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDR/.{@tEXtSoftwareAdobe ImageReadyqe<#iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:11 UTC	389	OUT	GET /twenty/flop/4kkzwAOC.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:11 GMT Content-Type: image/png Content-Length: 1443 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-5a3" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	1443	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 94 00 00 00 15 08 06 00 00 00 a0 d0 c7 a9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 6b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 34 36 30 2c 20 32 30 32 30 2f 30 35 2f 31 32 2d 31 36 3a 30 34 3a 31 37 20 20 Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<kiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	654	OUT	GET /twenty/flop/3FxeivoS.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	458	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: image/png Content-Length: 364 Last-Modified: Mon, 13 May 2024 10:22:35 GMT Connection: close ETag: "6641e9eb-16c" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	364	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0c 00 00 00 0c 08 02 00 00 00 d9 17 cb b0 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 01 0e 49 44 41 54 78 da 5c 90 bf 8e 45 40 14 c6 b1 a3 94 a8 54 42 a5 13 c9 2d 6e 24 b4 a2 90 28 e4 96 1a 0f e4 35 54 1a 37 91 78 00 3d 5a 51 88 82 c2 9f 6c 28 6e 23 d8 b3 d7 ae cc ee 57 4c be f9 9d f9 4e ce 1c 72 59 16 e2 57 59 96 25 49 02 c6 30 0c 55 55 2f 4e 11 98 ea ba fe 7c ab 2c 4b 9c 93 d0 29 08 82 b6 6d 45 51 2c 8a 62 5d d7 b3 70 bb dd fa be e7 38 ce 75 5d 04 e9 3c cf 81 02 c2 d3 27 84 b0 a6 69 68 1c c7 ab c0 f3 bc e3 38 60 e2 38 86 f0 09 bb ae a3 ee f7 bb 65 59 e7 1d 5e 88 6f 3d 1e 8f 93 98 a6 a9 eb fa f7 e0 34 4d 13 7f 45 51 3f 1f 42 Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<IDATx\E@TB-n$(5T7x=ZQl(n#WLNrYWY%I0UU/N\|,K)mEQ,b]p8u]<'ih8`8eY^o=4MEQ?B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	654	OUT	GET /twenty/flop/6g4S4aZ8.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	458	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: image/png Content-Length: 349 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-15d" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	349	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 0d 08 02 00 00 00 fd 89 73 2b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 ff 49 44 41 54 78 da 8c 51 31 0e 45 40 10 65 b2 14 6a 51 12 a5 33 68 54 4a 89 4a e2 0a 8e e3 14 0a 24 4a 9d 0b 68 29 24 42 29 1a 74 24 f2 5f fe 26 1b bf f8 89 29 d6 78 ef ed ec 9b 19 79 df 77 e9 1b d7 75 75 5d 37 cf f3 ba ae ba ae 9b a6 e9 38 8e a2 28 9c 65 fc 33 4d 53 96 65 cb b2 48 8f 30 0c 23 8a 22 cb b2 90 cb a8 07 51 9a a6 f8 51 55 35 0c 43 10 40 ca b2 3c cf 93 88 92 24 01 42 78 0e 95 78 81 38 8e 6d db 6e db 16 27 72 20 f7 7d 83 85 86 c1 93 78 ee 38 8e a6 69 c6 71 dc b6 2d 08 02 0e 82 85 86 c1 b8 30 94 e7 39 4f d0 41 df f7 02 87 86 d0 Data Ascii: PNGIHDRs+tEXtSoftwareAdobe ImageReadyqe<IDATxQ1E@ejQ3hTJJ$Jh)$B)t$_&)xywuu]78(e3MSeH0#"QQU5C@<$Bxx8mn'r }x8iq-09OA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	593	OUT	GET /twenty/flop/Kc13pncO.js HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	495	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: application/javascript Content-Length: 1031 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close Vary: Accept-Encoding ETag: "6641e9e9-407" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	1031	IN	Data Raw: 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 6c 65 74 20 61 75 64 69 6f 45 6c 65 6d 65 6e 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 61 75 64 69 6f 27 29 3b 0a 20 20 20 20 61 75 64 69 6f 45 6c 65 6d 65 6e 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 73 72 63 27 2c 20 27 4c 6b 50 66 32 71 68 56 2e 6d 70 33 27 29 3b 0a 0a 20 20 20 20 61 75 64 69 6f 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 65 6e 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 74 68 69 73 2e 70 6c 61 79 28 29 3b 0a 20 20 20 20 7d 2c 20 66 61 6c 73 65 29 3b 0a 0a 0a 20 20 20 20 24 28 27 2e 6d 61 70 27 29 2e 63 6c 69 Data Ascii: $(document).ready(function () { let audioElement = document.createElement('audio'); audioElement.setAttribute('src', 'LkPf2qhV.mp3'); audioElement.addEventListener('ended', function () { this.play(); }, false); $('.map').cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	654	OUT	GET /twenty/flop/Jv56WYQv.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: image/png Content-Length: 25871 Last-Modified: Mon, 13 May 2024 10:22:35 GMT Connection: close ETag: "6641e9eb-650f" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ec 9d 77 9c 5e 45 d5 c7 bf bb c9 92 04 42 08 81 24 f4 12 3a 08 48 97 8e 0a 28 48 91 a6 48 55 a9 4a 55 54 de 97 57 60 6d 08 82 05 b0 80 48 11 14 04 04 04 14 69 0a 48 b3 80 0a d2 6b 80 d0 4b 20 40 12 92 6c f6 fd e3 3c 6b 96 64 cb f3 dc 33 77 e6 96 df f7 f3 39 9f 84 f2 dc 73 a6 dc 99 b9 33 67 ce 01 21 44 9d 58 0e 38 15 f8 0f f0 4e 43 ee 07 be d7 f8 6f 42 08 21 84 a8 10 6d c0 b1 c0 7b 40 77 3f 32 1d f8 5a 2a 03 85 Data Ascii: PNGIHDRxsBIT\|dpHYs+tEXtSoftwarewww.inkscape.org< IDATxw^EB$:H(HHUJUTW`mHiHkK @l<kd3w9s3g!DX8NCoB!m{@w?2Z*
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: df 3a b0 20 70 2d f9 65 20 3b 1d fb fa 99 95 d3 f3 53 70 1b b0 06 e6 09 be 1d b0 12 76 27 7a 22 e6 d8 74 35 16 29 4d 88 b9 b9 a3 21 47 62 fd 67 5b cc 1f a6 1b 78 1c f8 23 d6 7f 66 26 b2 4f 08 51 13 16 06 ee 26 9f af fe a9 14 37 80 89 08 4f 27 da 01 10 71 d8 8a 39 79 1d 9e 02 fe 8d 5d 27 dc 2a 9d 49 42 94 8b b1 e4 97 e6 f3 69 14 dc a3 6e 74 a2 05 80 c8 97 b1 d8 0e c9 40 7d e9 7a aa 75 dc 28 44 70 96 20 bf 04 28 37 02 8b c4 2b 8a 28 08 5f 27 7b 9f f9 7a 02 7b 45 b9 18 8f 1d 91 34 d3 9f 26 02 cb 27 b1 52 88 82 b3 2c cd 07 ea 68 55 be 47 75 ee b5 8b d6 38 98 ec fd e6 a0 04 f6 8a f2 d0 06 fc 99 d6 fa d4 33 58 24 53 21 44 83 95 80 67 09 3f f1 cf 00 0e 88 58 0e 51 3c 3c d9 12 75 5c 24 06 62 07 b2 f5 2b 2d 02 84 68 f0 01 f2 89 5b fe 16 e6 c9 2c ea 4d 1b d9 f2 46 Data Ascii: : p-e ;Spv'z"t5)M!Gbg[x#f&OQ&7O'q9y]'*IBint@}zu(Dp (7+(_'{z{E4&'R,hUGu83X$S!Dg?XQ<<u\$b+-h[,MF
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: d4 12 88 be d8 87 38 93 7f 8f dc 85 f5 25 11 97 5f 92 ad bd 66 e3 f7 c1 59 06 df 0d 94 1b 9d fa c5 5c ac 80 2f 17 f9 44 fc e7 b3 df 76 e8 bf cd a9 5b b4 ce 39 84 9b 04 7e 8f 8e 71 8a c0 52 c0 1b c4 5d 00 74 03 17 44 28 9b 78 3f 9e 1b 3b df 0a a0 ff 16 87 fe 2e 60 c9 00 36 88 06 c7 e3 7b 81 bf ed d4 3f 04 df fd f1 10 b7 0f 44 f3 1c 46 b8 c1 ff 0e 2c 6a 9d 48 4b 3b f0 27 e2 4f fe 3d 72 68 fe 45 14 bd b8 93 ec 6d f5 1c 36 66 7b f8 bc 43 7f 37 f0 25 a7 7e d1 8b 87 f0 35 c6 aa 4e fd 3b 38 f5 5f e4 d4 2f 9a 67 43 c2 39 fd 3d 88 c5 9e 10 e9 f9 12 e9 26 ff 6e cc 29 70 fd dc 4b 29 7a b8 18 5f 7b 6d ef d4 3f 8a e6 ae 1f f6 27 7f 73 ea 17 0d 56 c5 d7 11 fe 11 c0 06 6f a2 88 7d 03 d8 20 06 67 34 7d 07 67 ca 22 6f 00 2b c6 35 5f f4 c3 1a f8 03 80 85 90 27 51 18 f1 58 Data Ascii: 8%_fY\/Dv[9~qR]tD(x?;.`6{?DF,jHK;'O=rhEm6f{C7%~5N;8_/gC9=&n)pK)z_{m?'sVo} g4}g"o+5_'QX
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 95 d7 81 5b 1d bf df 1a 0b ad 5b 46 ba b1 45 40 16 b4 00 c8 46 aa 05 c0 0c 2c fc 73 56 92 ed 02 a4 5c 00 78 bc f0 3d 5b 3d a0 1d 80 d8 74 00 c3 32 fe 76 46 48 43 22 b3 13 be 08 89 65 f4 fe 9f 1b cf 31 40 07 b0 43 28 43 12 90 f5 18 60 04 e9 a3 b4 96 91 94 ce 78 a5 f4 03 48 b9 00 f0 ac ec bd d7 c2 e4 03 10 17 cf 17 8d c7 93 3c 35 9e 2d ec 2e 2c c4 6b d9 f9 1d 56 96 ac 94 f9 18 c0 e3 07 a0 5d 80 d6 49 b5 03 00 be 39 29 d9 2e 57 6a 1f 80 ac 78 9d c2 b4 00 88 8b c7 a9 a9 ac 0b 80 05 81 6d 1d bf bf 13 78 39 90 2d 29 79 19 2b 4b 56 b6 a5 bc 93 61 d6 23 00 28 6f 99 53 92 72 01 e0 99 93 3c 73 a1 8b ba 2e 00 3c d7 8b bc c7 0f 75 c4 33 98 95 f5 08 e0 23 c0 70 c7 ef cb ec fd 3f 37 9e b2 8c 00 3e 1c ca 90 c8 cc 72 fc 56 0b 80 d6 f1 8c cd de 2b a7 9e 39 69 21 a7 ee cc Data Ascii: [[FE@F,sV\x=[=t2vFHC"e1@C(C`xH<5-.,kV]I9).Wjxmx9-)y+KVa#(oSr<s.<u3#p?7>rV+9i!
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 43 55 52 c1 d9 0e 78 95 b4 ed 38 90 bc 46 b1 16 9a 79 72 0e 61 ea 6c af c6 f3 3a b0 77 e3 6c d2 1f fb 94 25 47 fd e2 f8 ca e9 e9 ab ed f8 fc a9 f6 77 e8 ae 1c 1f c4 d7 90 2b 3b 74 7b 63 39 ef ee d0 1d 93 8b 88 3f 90 4c 02 ce c4 b6 15 fb 73 02 bb 26 80 9e d9 94 eb ab c5 c3 d2 c0 9d c4 6f cb c1 e4 ae 86 6d 75 e0 93 84 a9 b3 ab fb 79 fe 10 ec 9d 39 93 fc 23 45 f6 25 65 59 00 7c 1a 5f 39 3d 1f 6f ab 39 75 7f c0 a1 bb 72 74 e0 8b 3e b7 b7 53 ff e3 0e dd 65 49 0d dc 49 9c c1 e3 69 e0 34 2c 3c 67 33 47 4c 4b e2 cb a6 d5 23 cf 93 6f 4a df 22 d1 81 e5 88 f7 dc 9e 09 25 b3 b1 f6 ae 4b 46 ba c5 09 b3 0b 33 19 58 a2 09 7d ed d8 bb 74 1a f6 6e c5 68 d3 13 5b ae 95 34 fc 94 ec 65 7c cc a9 7b 3f 87 ee 77 f1 1f 1d 55 8e bf 91 bd 42 7f e4 d4 7d ae 43 f7 7d 4e dd b1 d8 9c Data Ascii: CURx8Fyral:wl%Gw+;t{c9?Ls&omuy9#E%eY\|_9=o9urt>SeIIi4,<g3GLK#oJ"%KF3X}tnh[4e\|{?wUB}C}N
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 49 f9 fb 54 d5 b8 08 7f bb fe 6f 74 ab 85 9b 91 c0 cb f8 1a be 0b 4b 87 2a 8a c1 51 84 19 a8 27 03 cb c5 35 3d 0a 8b 33 c7 91 30 a4 ef c0 db cc 71 e0 4b e1 b5 9f 37 4b e1 f7 10 ef 91 23 22 db 2e fa 67 7d fc b7 6b 74 2b ac c4 7c 19 ff 0b 7d 17 e9 3d c4 85 9d 27 87 ca f2 b7 6b 64 db 53 30 04 0b 8f fc 07 b2 d7 d3 1f 1a cf a8 43 02 9c 5d 09 d3 b7 5e 46 bb 00 45 a0 1d f8 3b fe f6 4c 71 3d 58 04 62 04 61 3c 7d f7 8f 6d b8 98 87 6d 08 33 40 ff 2c b6 e1 89 e9 24 7b 5d 75 46 b7 36 2d 3f 25 4c 1f 2b ba 63 69 1d 38 10 7f 3b 56 3e 32 6c 7b 6a 03 72 66 1a 76 ff d3 cb 29 58 20 09 91 8e 10 01 57 1e 04 8e 09 f0 1c 51 4d be 8c c5 96 f0 b2 46 80 67 88 ec 2c 0c 9c 14 e0 39 df c4 1c 08 2b 4b d5 17 00 00 e7 02 4f 3a 9f 31 1e 38 21 80 2d 22 3b de 60 2b d3 b1 24 1e 53 03 d8 22 Data Ascii: ITotK*Q'5=30qK7K#".g}kt+\|}='kdS0C]^FE;Lq=Xba<}mm3@,${]uF6-?%L+ci8;V>2l{jrfv)X WQMFg,9+KO:18!-";`+$S"
2024-05-15 23:21:13 UTC	1756	IN	Data Raw: d0 95 c5 74 e0 f9 e8 c1 31 ab e9 cf 33 c9 e3 38 e5 76 3d 01 2c 42 09 cf 03 f5 58 84 b6 e7 c5 ae 62 18 4a 17 70 0c 7a 45 71 2a e9 8e 11 be 05 f8 08 ba d6 66 43 72 02 60 23 35 17 25 02 07 24 6c c3 12 54 96 f5 87 c0 9a 84 ed 08 6d 1c 2a af 3b 0d 15 37 9a 8e 4a ed ce a8 ff bb 7d d0 ac 42 aa ad 94 1b 51 dd 87 15 c0 23 68 55 fb 4a f4 ae bb f9 df 3d 95 a8 7d 31 ec 0e bc 0b 78 1f e9 3f 13 e7 01 bf 4a d8 06 2b 18 27 00 d6 8a 31 e8 5b c6 a7 48 bb b8 e8 29 74 90 d1 b7 81 7f 24 6c 47 6a bb a0 03 5d 26 35 fd b3 11 a7 a1 a9 f5 56 dc 0c dc 80 be c1 af 45 c9 56 e3 9f 6b d0 54 73 55 bd 18 f8 00 3a 43 63 6c c2 76 f4 a1 43 84 2e 46 af e9 cc cc a2 98 86 f6 15 e7 b0 e2 fd af c0 3b 28 ce 36 c2 58 6a b4 7e 4d 6b d1 5b 9b b7 f1 c0 3b 81 db 49 7f bf 6f 43 33 60 39 1e ad 6d 66 15 Data Ascii: t138v=,BXbJpzEqfCr`#5%$lTm;7J}BQ#hUJ=}1x?J+'1[H)t$lGj]&5VEVkTsU:CclvC.F;(6Xj~Mk[;IoC3`9mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49747	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	654	OUT	GET /twenty/flop/nPU7rHwt.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: image/png Content-Length: 22478 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-57ce" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 17 00 00 02 35 08 03 00 00 00 93 ed f7 87 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 d6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 Data Ascii: PNGIHDR5gAMAasRGBiTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 17 03 54 5c 81 e2 08 e9 2f 86 a4 51 1a bb 79 4e 76 d8 60 b4 0f 06 bc 98 b4 bb e5 25 46 06 65 b1 06 03 76 f7 42 5e bc 77 a1 b6 a5 bd bb bd a5 f6 c2 7b 11 bd e8 38 70 e0 c6 22 9e 77 47 ef c5 82 24 17 57 f9 af d9 96 12 e6 d3 4c 87 72 53 74 81 17 f1 c9 d5 6d be f4 b5 b3 7a 8f da 8d c7 9f cf f2 fd b1 f1 e4 30 89 2d 35 79 19 c8 b4 51 c8 41 1a 3b 2f 5c de a9 25 b7 b0 53 3f e0 b2 0c 50 88 5b 85 cb a4 7a 31 ee 51 03 dd 25 66 ad 4e 21 26 15 39 30 43 1d 83 d1 e1 9f 59 f2 cd 47 4d 8b e1 c1 51 32 cb 29 46 07 87 3d d4 84 fb bd 98 11 0e a3 75 54 cc 28 36 e1 1c 74 fa bb f5 c8 9f 03 51 9a 4e 37 29 ff eb 4f 14 c5 e7 a3 5e 91 17 af 9f 73 99 98 c6 9f ad 8d 9d 17 e3 1e df 93 39 87 30 29 d4 6a 78 5c 13 a0 98 85 cb fb 39 10 a7 1a ff 26 33 f5 08 c6 31 31 24 07 60 70 8c fa 04 a7 Data Ascii: T\/QyNv`%FevB^w{8p"wG$WLrStmz0-5yQA;/\%S?P[z1Q%fN!&90CYGMQ2)F=uT(6tQN7)O^s90)jx\9&311$`p
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: a9 2f cb c5 15 80 3b e2 9e 60 b5 c4 ab f0 03 37 55 24 e2 8b ad 50 14 ca 7d 92 47 05 f4 44 81 65 9e 82 eb 01 50 f7 31 d6 ca 43 e4 69 31 be 94 d9 18 95 0b 6e b8 8a b1 d4 fd 90 cf ca 41 25 87 ec 18 bf fd 18 44 a9 4d 10 e6 42 14 b7 1f 0e d0 c8 1c c0 61 79 85 63 a9 2a 1f 75 48 9e 40 ec 2c 96 8c 2f 3f 6c 89 75 35 8f bc 7e fd 9a 66 02 e7 c4 63 5d ac 70 26 f0 d2 c1 12 8e fa 66 1f 33 d6 b3 1c 98 f9 ac 5c f0 3e 1b 06 9d 1b 01 b2 18 c5 c5 f9 39 89 a0 c2 c5 21 96 0e d0 d5 17 cc 7e 8f 47 11 1d 39 db 4c 00 b7 b8 8d 0c 50 9f 95 01 f4 c6 bb ad a0 3d cc e7 6e 0f e4 db df cb 45 9c 15 ac 23 1e 1b a8 75 34 f3 61 75 6e e9 02 b8 41 61 8d ba cd 08 11 2e 44 71 a3 00 c7 3b 47 4c 50 a0 c8 b6 1c 3b 29 c3 01 1c 66 a5 8f 10 63 66 b2 1b 97 5e 62 67 ac 2b fa c2 bf b8 38 c5 b2 e7 f0 95 Data Ascii: /;`7U$P}GDeP1Ci1nA%DMBayc*uH@,/?lu5~fc]p&f3\>9!~G9LP=nE#u4aunAa.Dq;GLP;)fcf^bg+8
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 75 6c e0 07 d6 dd 9e 42 e7 ad 14 17 7b 38 d8 0a 94 0b 7a ef 37 de d0 9c 36 e4 b1 b0 ae 9c 7a 7d 90 0b d9 8e 60 23 21 12 e0 5d 3e 06 0d 4c 71 55 19 48 9e 8c 58 5f 44 71 38 9d 8b 3e ec 49 f6 fa 64 0f e8 e6 1d 7c 93 34 1f 2c 21 58 5b d1 21 ad 04 e7 22 15 d9 37 e0 e2 cb fb dd 49 2e a6 dd 5d 79 9d 65 94 8b f5 7c cd 56 33 60 72 71 b3 85 72 31 3a ea d7 9d 21 c6 05 ed e0 58 db 81 d3 79 9e 3a 7a c2 ab ce 17 14 83 69 10 5c bc 40 d7 fc 27 b4 33 2e de 90 de 60 0d 81 b5 8a 02 db d6 ff 58 1d e5 4c 51 b0 8b c5 13 de a9 92 89 97 b8 cb f2 62 65 79 5a 59 57 b6 5c b8 10 bb e8 f5 94 51 d2 c8 43 48 3c 43 18 80 54 8e 79 dc 73 e7 02 f0 e3 73 6c 29 1a 34 b4 7a 77 49 13 61 5c 4c f7 94 7a 3a ef 85 68 9f e6 1f 3a ad a2 f9 01 da 36 6d 48 98 5a 82 5d f2 8a fe c9 41 fa 27 ca d1 75 6c Data Ascii: ulB{8z76z}`#!]>LqUHX_Dq8>Id\|4,!X[!"7I.]ye\|V3`rqr1:!Xy:zi\@'3.`XLQbeyZYW\QCH<CTyssl)4zwIa\Lz:h:6mHZ]A'ul
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 12 8f 29 ec 30 16 ad 2e 76 63 c1 e9 7c d0 91 e0 62 55 dc 5e df af 24 21 97 e5 e0 d8 c0 38 17 2f c0 25 0e 57 48 d1 87 58 4e d5 68 3f 17 ca 63 91 48 31 43 d2 c7 c0 05 f9 40 4e bb 0f a4 7a 05 84 ef a1 fc 61 70 e0 9c 19 8b 4b 3c 7e 29 36 1c c1 1b b2 8b 2d 05 4a 1d 1b 5f 2c 21 86 e0 e2 e7 92 6b ee 2b 67 b4 24 64 c5 db 61 f4 ce f3 79 d4 e3 58 eb 16 ce 29 d1 87 58 4e d5 c8 97 53 4a 0d bb b8 50 1e 8b 44 8a a9 93 3e 2e 2e c8 07 72 ca 7d 20 4e 14 ca 31 97 bf ab a5 18 71 62 25 2e f1 f0 79 19 fb 1d a3 e2 e4 40 2b 9f 62 96 fc 66 09 31 04 17 2d 6d fc 6f 87 96 84 b4 6c f0 09 c3 ed f6 35 d8 44 bc 11 98 53 a2 0f b1 9c aa 91 2f a7 94 1a 36 9d bf d0 1e 8b 5d 29 a6 4c 3a af e7 2f 14 17 e4 03 29 28 1f 88 31 d2 b0 fb 23 d7 80 01 17 ad b3 12 ae a2 91 3d 16 0d 63 e0 37 57 42 12 Data Ascii: )0.vc\|bU^$!8/%WHXNh?cH1C@NzapK<~)6-J_,!k+g$dayX)XNSJPD>..r} N1qb%.y@+bf1-mol5DS/6])L:/)(1#=c7WB
2024-05-15 23:21:13 UTC	2459	IN	Data Raw: 3e 10 7c 20 f8 40 0a 3b 08 1f 08 3e 10 7c 20 21 5c e0 03 c1 07 82 0f 24 74 be c0 07 82 0f 04 1f c8 0a 2e f0 81 e0 03 99 c4 07 12 36 5f e0 03 c1 07 82 0f 24 64 7f 81 0f 04 1f 08 3e 90 42 2e f0 81 e0 03 c1 07 12 c2 05 3e 10 7c 20 de b9 37 3e 10 7c 20 de e9 35 3e 90 d5 83 0f 04 1f 48 6d 9b 1d 1f c8 86 e0 02 1f c8 a6 e2 62 e3 b4 43 83 15 0c 2e e0 02 2e e0 02 2e e0 02 2e e0 02 2e e0 a2 4e 5c 10 82 0f 84 f9 82 f9 82 f9 02 2e e0 82 ac 9d 0b 3c 39 70 01 17 85 77 e3 c9 81 0b b8 28 bc 1b 4f 0e 5c c0 45 71 2e f0 e4 34 0c 17 78 72 ca e7 02 4f ce ba 0f 5a 3c 39 78 72 f0 e4 14 76 10 9e 1c 3c 39 78 72 42 b8 c0 93 83 27 07 4f 4e e8 7c 81 27 07 4f 0e 9e 9c 15 5c e0 c9 c1 93 33 89 27 27 6c be c0 93 83 27 07 4f 4e c8 fe 02 4f 0e 9e 1c 3c 39 85 5c e0 c9 c1 93 83 27 27 84 0b Data Ascii: >\| @;>\| !\$t.6_$d>B.>\| 7>\| 5>HmbC.....N\.<9pw(O\Eq.4xrOZ<9xrv<9xrB'ON\|'O\3''l'ONO<9\''

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49748	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	654	OUT	GET /twenty/flop/d2If1LR6.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:12 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:12 GMT Content-Type: image/png Content-Length: 22417 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-5791" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:12 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 48 00 00 02 56 08 03 00 00 00 55 92 57 b6 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 d6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 Data Ascii: PNGIHDRHVUWgAMAasRGBiTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 85 40 53 6d 6d 7b a5 45 fa d2 bb 76 e5 8b 74 2d ad 3b 0d d9 5b 7a 26 8a bc 19 37 6c 9b 30 e7 76 8c ad 4d 9e 4c a2 f9 6b d3 a4 2c 41 18 ab dc bf 65 ae 54 e4 93 22 6b 2b 86 a2 fe 6c fd 9c a8 0c 91 1e 64 e6 2d 21 74 e0 94 87 63 11 74 42 04 16 29 92 92 96 d3 a6 30 bf c0 e3 3c b0 21 1a ce 71 d6 e3 8f 66 eb 6f 99 aa 5d 98 9f c5 f1 0f 5a 16 8e 9f a5 b5 60 4e 24 54 cc ef 0b f3 03 93 ca 23 f1 44 36 77 bc b5 b7 93 be 93 48 3f 9e 85 59 e8 a0 37 c1 2b 49 24 25 9d d2 77 31 f6 6c a0 2d e9 f0 39 db 50 79 58 7f 45 28 21 85 f1 a9 38 cf f1 6b fc 40 34 b0 b8 86 73 9d 84 29 4f a4 38 0b e1 cc 49 8b 98 58 50 cc a6 52 68 66 2e b5 3b c3 39 92 b8 d4 01 5e 83 47 43 24 52 79 c8 f7 fc 88 8a 2a 36 e4 13 f4 c9 7f 06 4d e7 c7 85 c7 7d 07 8c 1d 27 4d 7a 83 e2 8b 85 ae f4 0c 65 be 00 e2 Data Ascii: @Smm{Evt-;[z&7l0vMLk,AeT"k+ld-!tctB)0<!qfo]Z`N$T#D6wH?Y7+I$%w1l-9PyXE(!8k@4s)O8IXPRhf.;9^GC$Ry*6M}'Mze
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 64 2d 48 0e e0 8e 52 86 13 4f 09 a4 a8 80 24 3a eb 72 01 03 1d ca 35 43 1e 89 b0 19 53 d3 40 5b 06 4e 17 85 70 07 41 22 7c e6 3d 25 ce 91 42 94 44 39 ee ef 81 34 41 bc f8 00 2f 83 34 69 85 76 3d 70 e6 5c 5d c0 8c 80 24 3a 17 22 84 60 ea 62 9b 41 69 51 02 f0 3b 62 c0 ad 39 6a ba bc 1f 24 ee b7 aa 76 45 5e 0b 81 3d 90 28 14 ec 4e e8 4b 51 4e 38 33 1a a4 92 35 c4 e9 13 90 44 e7 42 8e 25 5d a8 ee a6 a8 2d 9f e5 ea 77 af 32 06 89 80 71 e0 7e 6a 1f 48 6a 88 48 0a 47 f9 82 6c 99 18 09 fa ab 20 e5 07 88 a2 20 30 c4 58 5a e5 6f 75 97 49 cb 0e 29 01 49 74 4e 64 34 97 72 0b 96 ed d4 95 1e 5a 76 d6 ee fa 6e 1c 38 74 c5 6e 77 35 2f ec eb c9 f7 da 6f 8a 1d 95 0e 23 5f ea f8 f7 a6 86 02 92 48 24 20 89 44 02 92 48 24 20 89 44 22 01 49 24 12 90 fe 4d f2 4d e5 7c fc 6a 9c Data Ascii: d-HRO$:r5CS@[NpA"\|=%BD94A/4iv=p\]$:"`bAiQ;b9j$vE^=(NKQN835DB%]-w2q~jHjHGl 0XZouI)ItNd4rZvn8tnw5/o#_H$ DH$ D"I$MM\|j
2024-05-15 23:21:12 UTC	4096	IN	Data Raw: 55 c4 54 f0 98 b8 00 bc 37 1c a0 a5 bb 47 7b af d0 72 0c a4 a9 60 14 80 a3 20 a9 82 f3 2a da 65 b4 00 84 5b a3 30 49 c6 00 3c 73 b3 08 12 82 74 0e c6 48 34 b4 b8 fb e8 15 3f 45 41 f2 92 14 c0 4f 2c fe a4 29 29 d0 36 d6 62 10 57 09 5e 05 f0 2d 98 0c 3a e2 87 36 42 82 13 03 9c 7d 3c 18 a6 88 a4 29 48 f4 40 53 00 4a 0a d2 1d 42 fa 29 3f 7a 48 f4 f5 d9 00 52 3d a0 d2 10 03 82 84 20 9d 03 90 7a a4 1e d9 00 05 e9 06 b1 02 f4 31 9a d2 e4 8a f0 a9 4b 04 69 5a e8 d1 0d 86 58 fa 0b b1 7e 58 ec e3 31 90 6c 2c db 85 00 52 98 e5 a8 98 24 2a e9 90 e3 7a f6 d8 0a 49 20 48 08 92 fc 41 a2 91 e3 7f ec 9d 6d 4c 53 59 1a c7 0f 59 e0 dc ae 21 29 58 6a 4b 02 85 04 c5 b6 40 23 2f 56 0a 43 28 05 6b 80 ca 54 ca 06 a5 40 19 85 f0 52 41 19 41 01 51 33 08 e2 60 d5 80 36 ea 26 b3 9b Data Ascii: UT7G{r` e[0I<stH4?EAO,))6bW^-:6B}<)H@SJB)?zHR= z1KiZX~X1l,R$zI HAmLSYY!)XjK@#/VC(kT@RAAQ3`6&
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 1c 16 5b 2b ea 19 5e 85 39 63 18 7e f9 9f d9 3f 41 39 66 97 a1 44 3a 93 51 a0 1a 08 fa 6e 44 3a 97 74 4a 7c 0c 43 24 30 bc 22 4d ef 8e c9 fa b2 7a fe 9d 3c 57 51 a3 d8 65 07 5c f3 ac 13 ad 17 d5 d3 ef 45 a2 82 d5 7e fc 4d 69 b5 c9 8a 13 ed b7 45 7a 44 f5 94 0e 9a 46 10 09 0c 3d c6 ce d1 99 5e a9 06 65 39 b1 58 b7 3f 72 37 31 52 7f 6d ef 0f 76 5b 56 b0 be fe f5 73 85 c5 fc 9a 97 20 12 00 43 03 44 02 00 22 01 00 91 00 80 48 00 00 88 04 00 44 02 00 22 01 00 91 00 00 10 09 00 88 04 00 44 02 c3 44 36 69 37 a9 bd 16 44 82 48 e0 57 31 52 ac 9b d4 b8 95 82 48 10 09 fc 1a 97 33 45 56 22 65 63 26 43 24 88 04 7e 91 7c 24 a2 45 6a c9 12 22 41 24 f0 eb e4 ec a1 1d 61 68 07 91 00 44 82 48 00 22 41 24 00 91 20 12 00 10 09 22 01 88 04 91 00 44 82 48 e0 1f c4 56 47 a4 04 Data Ascii: [+^9c~?A9fD:QnD:tJ\|C$0"Mz<WQe\E~MiEzDF=^e9X?r71Rmv[Vs CD"HD"DD6i7DHW1RH3EV"ec&C$~\|$Ej"A$ahDH"A$ "DHVG
2024-05-15 23:21:13 UTC	2398	IN	Data Raw: 20 ad e1 38 9c ab e3 97 30 14 7a cc 91 74 9d 06 a9 64 34 24 48 69 23 42 63 2c ef 54 92 31 9d fb 9b 43 bb 28 82 f4 d7 5e 96 f3 e7 fa 5d bb e7 9c 67 f7 de fe 8a d0 6e a3 30 43 4d 08 5d 11 2d 00 92 c3 a1 60 1e 9d cd c1 68 c0 80 b4 22 40 72 7f 10 76 ed cb 95 af f2 ae a3 84 4a c6 c8 ff c7 11 07 ad 78 a2 41 4a c0 8c 00 49 4b 96 10 48 ae d0 89 d6 15 f1 88 8d 18 43 73 b0 45 8a 27 12 a4 08 73 4d 52 0a 24 a6 82 25 cb 42 45 4b ba 88 f5 bd 78 67 4f 51 62 65 cb 80 e4 9e ce 02 b9 08 ba 68 40 34 6f 8b b8 ec c2 19 1c 97 12 51 3c 65 17 a4 30 b5 b2 de 2d de 62 81 e4 d5 63 79 84 a7 48 2b f1 71 08 ad 90 b6 ad 06 49 2e 74 37 1b c5 dd a9 cc c8 a1 1d 23 e5 62 59 a0 2b a8 80 97 64 60 ba 8d 58 52 a2 b8 18 6d cb 39 b5 25 0a 33 89 5d be a1 40 52 d7 c9 56 8a c1 b0 81 4e 7c 5d 09 cd Data Ascii: 80ztd4$Hi#Bc,T1C(^]gn0CM]-`h"@rvJxAJIKHCsE'sMR$%BEKxgOQbeh@4oQ<e0-bcyH+qI.t7#bY+d`XRm9%3]@RVN\|]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	389	OUT	GET /twenty/flop/4HNPHMfJ.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:13 UTC	463	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: image/png Content-Length: 193376 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-2f360" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:13 UTC	3633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 72 00 00 03 a3 08 03 00 00 00 79 b2 b5 db 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 00 50 4c 54 45 f0 f2 f5 ef f0 f4 fe fd fe e5 e7 eb ff ff fe f4 c7 c4 f2 f4 f7 ff ff ff f2 f2 f2 02 01 02 fb fb fc f1 f1 f1 f8 f9 f9 e5 e6 e7 ce d0 d3 ef f2 f4 1e 1f 20 eb ec ee f6 f6 f5 db dc dd 0c 0a 0b f7 c9 c6 fa be b2 f2 c5 c2 de df e1 ed ee f2 28 26 26 8a 82 7b 32 2e 2f 94 8c 87 91 87 7f d0 c1 bd f3 c6 c9 ea ea eb 1b 18 19 87 86 86 9f 90 8c f9 b6 73 d4 c6 c5 fc f7 f6 f7 ac 5c 41 3f 40 77 78 79 11 12 15 4a 48 49 ef c1 bb 70 6f 70 7f 7f 80 8a 8b 8e e2 e3 e4 f8 b2 68 a6 9a 94 c5 c4 c4 f5 9d 47 f6 e0 Data Ascii: PNGIHDRrygAMAasRGBpHYsPLTE (&&{2./s\A?@wxyJHIpophG
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: b9 5e f1 54 bb 1e 0a 58 4e bf ae 3c ff e9 ff 99 08 84 c4 50 c0 77 eb 1f d6 ff 9f db 89 ee 07 88 01 bd d3 0d 7c fe 87 ef ad ff 6e 65 e5 87 eb eb ff fc e1 e7 7f a8 7c 3a f1 25 bb c8 7d ff d3 75 7a de 1d c1 1e fe 98 54 2e 46 e2 a1 f3 3c 1b 79 7d 9d 3d 43 2a f7 f9 cb fb e0 9a 4f e6 3e 3d b6 b4 d8 e8 d5 0e 98 eb af 1e 30 73 a5 5a 4d 98 ff 9a 57 0e 15 b9 b8 53 d3 9b 8b 0b 0f d0 34 26 6e 35 1c 08 70 57 06 e1 2c b6 e0 10 8e 8a 5c 63 b0 ad d5 dc c7 59 e2 7f b6 26 f3 ff 9f a3 65 b3 b5 1e 47 45 9b 52 85 4a 25 8b 34 6f 71 38 33 0b 3b f9 04 2a 93 85 a6 23 56 33 83 3c 21 34 35 3f f7 bb 7b 7c 79 2c 8b c7 2a 37 56 9a a1 f1 64 7c 1f 35 1d f5 2c e6 7c 8f 5f be 74 f9 a3 8f 3f be f9 ee af df fd e4 c2 e9 13 27 8f 7d fa 9b 0d 22 2e ad 9e cf 17 f6 45 2e 00 5a ad 56 fd 2f 2d 22 Data Ascii: ^TXN<Pw\|ne\|:%}uzT.F<y}=CO>=0sZMWS4&n5pW,\cY&eGERJ%4oq83;#V3<!45?{\|y,*7Vd\|5,\|_t?'}".E.ZV/-"
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 66 ee d6 47 e7 a7 95 ac bc 0f 84 dc 49 8d 0b 3f d0 2b dc 56 f0 08 88 bd f3 df 7c 78 0f b9 b8 7e a7 7b ee 42 ae 86 df 15 1f e8 70 8f d8 e5 80 4a 3f bb e0 4a 8b 96 5d 9e f0 28 e5 80 c4 93 71 0f df 9d e4 9f 12 b7 ca 82 a9 fc 55 8e 5c 6e dc 9e 51 5b 13 d3 2c 92 2a 9d 16 1f 68 c6 af eb 19 d7 83 f2 3c 96 f1 e7 7f 8d 16 7e 84 db 4f fe f1 75 26 40 1f bc e0 a3 f3 fd e6 06 2f 53 64 94 84 72 3f 02 2a 3e 06 bb ec 5b cf eb 7e f3 2d ac e1 75 be 04 bd 55 8c 9d 98 34 b9 08 4b 97 ba 17 fe f9 e1 f6 50 f4 e5 a0 e5 c6 8d db 43 7f 0f 78 1f 32 a9 1f c3 1f 78 05 8a 28 76 92 77 ee 33 70 29 72 83 d3 aa 18 42 55 aa 12 72 e1 68 ae aa 9d e0 9e c5 f6 f8 37 20 b7 03 30 2f 77 f0 73 e3 c6 6d 02 aa a7 6f 9f 97 23 37 38 2d 44 15 ec b0 1b ba 16 fc 4e d2 2e 37 6e dc b8 71 e3 c6 ed 51 21 77 Data Ascii: fGI?+V\|x~{BpJ?J](qU\nQ[,h<~Ou&@/Sdr?>[~-uU4KPCx2x(vw3p)rBUrh7 0/wsmo#78-DN.7nqQ!w
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 89 cb 55 2e b7 27 5f e5 ba d4 0d fc 19 d8 e5 c6 91 fb 88 8d 85 38 0b 62 73 00 c6 8e ca c8 50 0a 29 2a 43 6e 2a 6b 9b 10 a0 bd c6 b0 0f 60 e4 f4 52 56 af 41 64 25 8b d6 20 96 c9 eb 2a b2 77 e1 21 ce 56 68 36 14 b3 89 00 0c 34 e6 30 9e 06 52 e1 fe cd 5a e4 9d 4e 16 8c 6c b6 d8 4b 91 7b b6 01 d5 4b 8f 75 a3 57 6b db 95 1a b0 52 af e9 59 5d a7 b9 d5 9c 25 63 50 3e 37 c2 94 ef a0 50 18 b5 a1 94 81 e1 22 54 5e b1 d2 2a 90 3f b7 56 2c 16 6b d0 e2 48 c4 65 99 33 82 37 04 21 9d c1 4e 7b 25 40 ce a2 e9 d6 42 a9 a9 aa 56 0b 75 25 6a 15 e6 58 06 72 a3 80 97 81 fa 93 66 36 13 ae 8f 6c 03 73 b8 c9 7e b1 54 84 36 0d 23 b3 47 0c 52 2e ae c4 54 ee d0 82 b7 3b d3 d7 1b 72 30 52 4c e5 33 7d 3b 8b e3 50 2c 5b 35 bc a3 76 a5 05 67 6e bd 56 cc 16 f5 1a 32 8f 0a a5 56 86 a6 56 Data Ascii: U.'_8bsP)Cnk`RVAd% w!Vh640RZNlK{KuWkRY]%cP>7P"T^?V,kHe37!N{%@BVu%jXrf6ls~T6#GR.T;r0RL3};P,[5vgnV2VV
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 88 10 19 a4 d0 6a f6 aa 5e 4a c6 95 04 a6 f1 e9 09 ac 67 c9 a2 db 1e 40 4d b3 3d 71 5a f0 79 49 b3 0a ac 21 1f e1 3a a8 92 ca a6 3e f4 14 b4 84 03 15 02 5c f1 94 42 85 1d d3 a3 1e 7c da ac 52 87 4a 2f 84 37 25 42 41 c3 31 40 a7 24 b4 6f 69 b6 03 5e 45 2b a7 e5 a0 17 db 15 b0 26 45 56 2b 65 4d f5 ba 73 eb 2a 00 9b a6 90 28 ac 53 c6 2a 41 56 ea 42 4d a3 29 3c 0e 2e 0d a1 d7 96 e8 31 b9 94 83 54 5e 32 c8 e7 72 b9 1d 41 e4 4e ca 5a cc 48 d8 80 0b 5a 6a ad 1b 70 8c d4 6e 62 32 bf cb b3 7b b8 3d d1 2a f7 21 a3 ad d0 11 af 8c aa c7 e1 4c 09 c5 15 29 5c f9 e1 42 b5 18 7b 19 24 9c c6 b2 5e f7 3e 4b 8f 61 e0 10 dc b2 89 6e 09 68 d7 63 2a 50 02 b0 3b 76 66 e6 d2 4b 21 47 92 23 7a 27 25 98 e8 0e 65 ee b2 d7 9a f6 1a a0 91 0e be 85 a0 77 3c 9e a5 f8 b2 a7 dd 75 bc ee Data Ascii: j^Jg@M=qZyI!:>\B\|RJ/7%BA1@$oi^E+&EV+eMs(SAVBM)<.1T^2rANZHZjpnb2{=!L)\B{$^>KanhcP;vfK!G#z'%ew<u
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: f1 a0 da d4 19 72 7d 10 b1 f9 8c 1e 01 72 2b 84 dc 66 25 17 ce e7 7c c8 f5 91 2c 54 70 ac 17 e3 0c b9 15 46 51 30 77 88 06 d7 f9 64 2e 87 88 e6 7e af 68 c7 4b 98 11 1e 34 ca d0 c4 ed 5c 1e 7e 68 51 0d 84 50 e1 0a 59 49 5c e5 72 e4 ee af 72 57 66 54 ee 9c 3e dd 4f e5 ae de 0f a8 ce 56 56 39 72 77 23 b7 05 e4 e6 91 23 74 85 74 ed 1b 3b 37 6f ed 6c 11 74 df 05 72 77 80 dc d3 e7 4c 8e 5c 6e 5c e5 3e 1a cf 32 6a 2c f7 f3 f9 9e 89 e8 a8 58 1d 8d 46 31 33 8b 70 a7 7a 2b 0d e4 66 92 45 4d 56 24 c0 16 c8 75 b4 ae e6 f5 2a 76 9f 62 93 cb 23 20 b7 1e 21 88 52 d1 47 7b 90 89 a5 8c 91 69 8e 4a 45 23 8b 78 e6 5c 3e d9 1b 6a a2 c2 10 de 37 25 41 55 12 28 0d 39 9e cb e5 c7 9e 23 f7 7e 28 5e ea 12 5e 5d 75 6f 98 e1 c9 c9 e3 19 2e 2f b3 55 8e dc bd 90 2b a6 f2 a8 ed 78 e2 Data Ascii: r}r+f%\|,TpFQ0wd.~hK4\~hQPYI\rrWfT>OVV9rw##tt;7oltrwL\n\>2j,XF13pz+fEMV$u*vb# !RG{iJE#x\>j7%AU(9#~(^^]uo./U+x
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: ae 71 8c f3 72 a8 5c 30 97 d6 66 a0 71 83 82 82 18 0f e7 4f 9d 3f 4f 94 48 3e c5 c0 65 ec 26 43 e2 26 03 b9 99 a8 1f 67 94 d5 27 c1 1d 2a 3d 3b 9d 89 1b 97 2e de 70 0b 89 9b 4d 97 ae 95 3d 8f a0 72 41 57 22 ae 9e b6 2d 20 61 8b 0d 97 6e ba 88 ab 0a c7 a3 de c0 3b ba 06 5c 6d 6b f3 56 7d 2f 3f 68 e9 fe ff eb 5c f3 fc 7e df 71 6c a4 dc af 9d 3c c9 6f 74 2a 4f 5e 93 62 5d 63 ee 7e d6 b8 06 72 37 09 71 19 b6 f2 22 88 1b ec eb 97 a6 13 b2 31 67 63 56 22 cf ae 44 af d3 ca 1d 1c af e5 4e 6e 75 9b 14 b9 3c 3c 65 11 2a 97 eb ca 67 ae de 22 e4 16 d6 96 a0 93 5b db d7 d9 d7 89 d2 32 0a cc 2b 40 ae 52 4b a6 73 e7 d0 21 8d bb f5 06 72 8d 63 9c 97 43 e5 d2 0c b2 44 ae 67 19 94 b5 18 dd 06 55 12 8c 51 58 0e 4f 0e 2a cb 8d 8f 8f cd 4f 4a 4d 88 80 b6 8d 4b 17 b7 a4 74 81 Data Ascii: qr\0fqO?OH>e&C&g'=;.pM=rAW"- an;\mkV}/?h\~ql<otO^b]c~r7q"1gcV"DNnu<<eg"[2+@RKs!rcCDgUQXOOJMKt
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: b9 89 38 a9 b8 12 74 b9 99 4b d6 ca 58 ff ef 1c 23 bb 9d 9e 9e 91 8b 23 17 7b 7a 18 ba 64 be 33 43 c8 ed 1f 9b c5 4f fb 8e 59 78 51 4d ab cc c5 55 99 9f b2 7a ac d5 c8 1e af d3 6b 92 d9 b9 5a b6 6a 1b bd 12 90 56 ab 69 9d e3 89 61 af 52 33 3d 6c 31 f1 cd 77 1e 39 35 25 65 ae c5 b6 5a e5 3a 6d ab 7e 05 36 ee f8 3a 28 4f c9 06 e8 da 38 7f 48 db d1 25 eb 47 32 b3 66 e4 1a e3 53 9b a3 b2 ac b3 58 f6 f1 0d 56 26 96 e9 c4 72 25 59 05 ae 8e c0 31 2b 98 7f ea 70 17 41 e5 16 0c 74 ed 8e 28 28 a0 bd dc fb cf ee c3 70 6a 82 88 4b 4b ba 90 bc c3 0b 0b 8b 93 6d 48 35 60 75 4b c8 2d c1 d4 32 ef f3 ba ab e6 57 22 9b c4 d6 2f 1f aa 61 f3 b7 38 f4 c8 93 9a 15 51 65 7e e1 49 51 71 a9 51 fe 51 89 f5 e1 1a 3e 2b ec 7e 65 44 cf f0 04 dc d3 4d 58 45 e9 01 5c a6 c7 31 00 8c 8f Data Ascii: 8tKX##{zd3COYxQMUzkZjViaR3=l1w95%eZ:m~6:(O8H%G2fSXV&r%Y1+pAt((pjKKmH5`uK-2W"/a8Qe~IQqQQ>+~eDMXE\1
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: cb ad 37 90 6b a8 dc ef f9 a8 d1 41 e6 e4 6d 69 b9 82 b7 e8 e0 a6 c6 d7 33 70 d1 da a5 37 34 78 43 cb 12 13 c8 08 a3 b4 58 30 57 57 5a 16 5b 42 88 3a c0 86 10 90 5b e2 c6 c4 72 eb 02 4f 2c d7 61 45 e8 cc 99 9f 5e 3f 77 f9 f2 25 68 dc cb e7 6e d1 76 ee 44 0f da b9 13 b3 43 8d d6 c6 27 b3 83 7d 1d 9d 60 ae c3 c3 7e 42 b5 8d 72 7a 88 cf 67 02 ac 2d 3a 94 2a 23 56 9a 88 74 8a 43 33 54 3a 47 0d 2f 7c 8a c2 b2 ce d2 79 ed 7d a1 f5 2d 96 57 57 a3 9d 5a dc 20 3d 4c c8 f5 74 cf 50 7f 2c 70 c8 ab 43 5d 28 22 27 2a c9 5c b9 26 64 ff 52 36 73 8d 5e ee 86 32 d7 63 64 f9 3b 0d 1f a5 fb 14 de e6 15 e4 b6 3e fc 74 e1 cc 42 7b 2b 68 fb f0 2a 8a cc c3 33 0f 87 05 72 05 74 79 71 08 c8 6d 05 72 9b 0b c9 0c a3 90 ea 3e 58 6d c7 40 84 0e b9 2b df 89 5c 1f df b2 34 ed 84 fb bc Data Ascii: 7kAmi3p74xCX0WWZ[B:[rO,aE^?w%hnvDC'}`~Brzg-:#VtC3T:G/\|y}-WWZ =LtP,pC]("'\&dR6s^2cd;>tB{+h*3rtyqmr>Xm@+\4
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 14 a7 22 57 8a 5c d2 b9 84 5c c8 5c e4 9f d4 f6 e1 1f 19 84 08 8d 88 ac 5c 51 5a 16 d4 7d 93 9a b9 75 92 ba 3d c3 3d 3d 62 71 62 66 68 6a ac af b9 b9 6f f9 c9 13 e6 2c 49 5d 9c 72 dc b1 9a 50 6a b5 12 73 05 6e 1b 25 74 35 3f 27 a7 55 12 4c 71 a9 b2 89 49 64 f2 7d b4 7a ad 14 fd 5d 87 47 f5 19 28 dc 67 fc ae c5 d4 62 b5 ea 76 70 ad 6b 6d e7 5a 3c e7 9b d7 51 b9 5e 3e ce ba 9d 23 82 ae 53 d4 95 35 93 e5 c3 95 1e c8 3d 62 20 77 23 7e 20 d6 92 84 fc d4 45 a1 35 27 96 35 c3 65 7a b2 13 3f 7c a2 46 5c 94 07 e4 b6 3f 7f cc 2a f7 6f fc f6 b7 e7 a3 93 17 10 93 4b 81 d1 53 0f 95 ba f2 68 1b ab 5c f0 b6 80 48 4d d4 c5 87 12 b9 4d 6b d9 4f ad 52 b9 a8 10 67 e8 64 6c ae 50 b9 90 b8 b2 59 9b 91 9b 9b ab 53 b9 a8 3d 1f cc c8 ca 3a 58 9f b2 c9 91 2b 12 0d 92 c3 75 27 39 Data Ascii: "W\\\\QZ}u===bqbfhjo,I]rPjsn%t5?'ULqId}z]G(gbvpkmZ<Q^>#S5=b w#~ E5'5ez?\|F\?*oKSh\HMMkORgdlPYS=:X+u'9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:12 UTC	389	OUT	GET /twenty/flop/7MALKGdt.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:13 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: image/png Content-Length: 1045 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-415" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:13 UTC	1045	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 2f 00 00 00 2e 08 06 00 00 00 b8 7b 40 09 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 23 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDR/.{@tEXtSoftwareAdobe ImageReadyqe<#iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49756	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	654	OUT	GET /twenty/flop/sZq0cGqH.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:13 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: image/png Content-Length: 3834 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-efa" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:13 UTC	3637	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 06 00 00 00 52 dc 6c 07 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 73 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 34 38 38 2c 20 32 30 32 30 2f 30 37 2f 31 30 2d 32 32 3a 30 36 3a 35 33 20 20 Data Ascii: PNGIHDRRltEXtSoftwareAdobe ImageReadyqe<siTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53
2024-05-15 23:21:13 UTC	197	IN	Data Raw: 57 43 6e 15 1d 67 02 9c ce 80 01 aa 47 8f fc 99 6c 4b 84 2d 0e 3c 8b 96 4a ba 45 c9 46 92 06 03 54 c9 6c 5b 1a cc a9 e9 fe da 5d fb 76 5b 2a 01 06 a8 05 3d c6 49 4f 3d d7 89 75 1b 2a ba a7 de 47 d7 e9 4e a7 ae 8f 01 5c 61 ae 2d 0d f4 20 e8 32 e7 d3 df 60 eb fa f3 09 39 06 70 0d ed 29 d2 33 8e 4f 14 3d 54 f0 b5 57 98 78 02 db f9 a2 ad 84 1a 03 b8 8c 8e ba 9e 6a ab 28 4f 15 d0 c8 bd 48 34 d1 b0 c5 4b f1 b4 db ed 44 82 cc 1c 68 df da 53 32 54 a9 74 ba f2 38 42 58 5e de 6e 91 b9 81 2a 10 00 06 00 c0 00 00 18 00 20 14 fe 2f c0 00 0c ed cd 8a 47 dd 06 41 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: WCngGlK-<JEFTl[]v[=IO=uGN\a- 2`9p)3O=TWxj(OH4KDhS2Tt8BX^n* /GAIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49757	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	654	OUT	GET /twenty/flop/pgaK9m2J.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:13 UTC	460	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: image/png Content-Length: 8350 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-209e" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:13 UTC	3636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 11 3b 00 00 11 3b 01 64 27 50 cf 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ed dd 5d ac ad 79 61 16 f0 e7 6c 66 a0 30 cc 40 a0 92 36 30 33 02 4e db 68 03 b6 58 3f d0 0a ad 96 14 15 ad 4d 9a da c4 8f 8b a6 26 26 2a 5a 63 bc d2 d4 4b 35 35 e1 82 98 54 6b 6a 35 a6 1a 8d 56 c4 b4 a6 81 81 32 d4 5a 4c 11 fc 28 1d 3e fe 50 7a 81 29 d0 0e 50 86 16 06 2f d6 59 cc 99 33 fb 9c b3 f6 de eb 5d cf fb f1 fb 25 4f 80 21 9c fc d7 bb c3 7e 9e f5 be 6b ef 73 2d a7 f5 82 24 0f 5d cf 8b 93 3c fb 7a 9e 99 Data Ascii: PNGIHDRxsBIT\|dpHYs;;d'PtEXtSoftwarewww.inkscape.org< IDATx]yalf0@603NhX?M&&*ZcK55Tkj5V2ZL(>Pz)P/Y3]%O!~ks-$]<z
2024-05-15 23:21:13 UTC	4096	IN	Data Raw: 3b 51 fe c0 2c 19 01 9d 8c 9c 76 04 28 ff 4e 94 3f 30 6b 46 40 27 23 a7 19 01 ca bf 13 e5 0f 2c 82 11 d0 c9 c8 b4 23 40 f9 77 a2 fc 81 45 31 02 3a 19 99 66 04 28 ff 4e 94 3f b0 48 46 40 27 23 c7 1d 01 ca bf 13 e5 0f 2c 9a 11 d0 c9 c8 71 46 80 f2 ef 44 f9 03 ab 60 04 74 32 72 b5 11 a0 fc 3b 51 fe c0 aa 18 01 9d 8c 5c 6e 04 28 ff 4e 94 3f b0 4a 46 40 27 23 17 1b 01 ca bf 13 e5 0f ac 9a 11 d0 c9 c8 61 23 40 f9 77 a2 fc 81 4d 30 02 3a 19 b9 fd 08 50 fe 9d 28 7f 60 53 8c 80 4e 46 ce 1f 01 ca bf 13 e5 0f 6c 92 11 d0 c9 c8 53 47 80 f2 ef 44 f9 03 9b 66 04 74 32 b2 1b 01 ca bf 13 e5 4f dd b5 f6 01 20 c9 bd 49 7e 2a c9 ab db 07 d9 98 0f 67 f7 3d a0 f1 d7 09 6f d9 bb 93 7c 67 92 cf b4 0f c2 b6 19 00 cc c5 3d 49 de 9a e4 35 ed 83 c0 84 de 9d e4 f5 49 1e 6b 1f 04 0c Data Ascii: ;Q,v(N?0kF@'#,#@wE1:f(N?HF@'#,qFD`t2r;Q\n(N?JF@'#a#@wM0:P(`SNFlSGDft2O I~*g=o\|g=I5Ik
2024-05-15 23:21:13 UTC	618	IN	Data Raw: 38 e5 0f c0 54 b6 3c 02 7e fa 76 17 e6 75 33 38 60 a3 fc dd f6 07 d8 8e ad 3e 0e f8 b6 3b 5d 98 ff 3c 83 43 9e b2 fc bd f3 07 d8 9e ad dd 09 f8 8f 87 5c 94 97 27 79 7c 06 87 55 fe 00 4c 69 2b 23 e0 f1 24 0f 1d 7a 51 fe fe 0c 0e 3c 75 f9 bb ed 0f c0 16 1e 07 fc bd 8b 5c 90 bb 92 bc 6b 06 87 9e aa fc bd f3 07 60 6f cd 77 02 de 99 5d a7 5f c8 4b 92 fc da 0c 0e af fc 01 98 da 1a 47 c0 a7 92 3c 78 d9 0b f2 1d 49 be 30 83 17 71 ac f2 77 db 1f 80 5b 59 d3 e3 80 2f 24 f9 63 57 bd 20 7f 2e c9 97 66 f0 62 ae 5a fe de f9 03 70 27 6b b8 13 f0 44 92 bf 70 ac 0b f2 c6 eb 7f 60 fb 45 5d 26 ef 8a 77 fe 00 1c ee de 2c f7 73 70 4f 64 d7 d9 47 f5 97 92 fc f6 0c 5e dc 45 f2 9f b2 fb 8b 8e 00 e0 22 9e 95 e4 df a5 df 63 17 c9 17 93 fc e5 29 2e 46 92 fc e9 24 bf 39 83 17 79 48 Data Ascii: 8T<~vu38`>;]<C\'y\|ULi+#$zQ<u\k`ow]_KG<xI0qw[Y/$cW .fbZp'kDp`E]&w,spOdG^E"c).F$9yH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	23.196.177.159	443

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-15 23:21:13 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=200533 Date: Wed, 15 May 2024 23:21:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49758	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	654	OUT	GET /twenty/flop/eGl8WIUk.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: image/png Content-Length: 17558 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-4496" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 44 2b 49 44 41 54 78 5e ed 9d 05 98 14 c7 d6 86 21 01 12 20 b9 97 d8 fd 63 24 84 10 bf 10 b9 b9 37 09 ee 04 77 12 42 08 c1 dd 65 71 58 60 59 d6 61 97 65 71 0f ee ee ee 96 e0 2e c1 dd 82 db f9 bf 53 5d 0b 1b 68 60 77 b4 7b e6 bc cf f3 3d b3 33 d3 d3 5d 5d 55 e7 db aa ea ea ea 64 82 90 10 22 4a 01 fd e3 de bd 7b 1f 42 d9 a1 e2 d0 2f 50 23 a8 07 34 1c 5a 00 6d 83 0e 40 87 a1 13 d0 59 e8 32 74 1d bf 57 f0 df fa 33 fe ee 24 c4 db f2 6f f8 b7 bc 0f de 17 ef 93 f7 5d 19 e2 63 f1 31 3f c4 cf ff 01 a5 d0 c9 12 04 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsodD+IDATx^! c$7wBeqX`Yaeq.S]h`w{=3]]Ud"J{B/P#4Zm@Y2tW3$o]c1?
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 78 0e 1c 58 6e 70 f6 02 cb bc 60 58 dc aa e2 2b 81 91 75 0b a8 2e 1d 77 ed b8 75 65 66 46 89 d5 91 45 bd d4 7e d6 8e 6c ab ba 88 3c ae c5 33 e4 cd 8e ef 0e 19 86 55 53 e7 aa e0 49 e0 1d 9e bd 31 1a 07 7c 1e da a5 8f 2f 78 10 4f 1a 16 1f 83 8d 84 5b 55 d3 23 6b a9 16 d5 89 65 49 eb 02 3e 4d dc 52 3b 34 3f 82 46 77 f9 59 b5 b6 6a e6 7e df 23 e7 26 86 e5 3d e0 1d 7b 20 cf 5d 31 c4 c1 7e d4 c7 16 3c 8c a7 ba 84 3c 11 94 e7 4d c5 34 2a aa af 02 c6 a9 56 91 99 e9 38 2b 36 42 6e 6d ad 1f d5 8e 42 6b e6 a3 5a 30 c9 3a 6e be a5 47 ba 84 de 05 1e 52 51 db 89 7b c1 b1 58 8b d5 51 05 8f e3 6e c3 e2 7b ff b8 55 d5 b9 52 56 9a 17 db 50 8d 37 b9 ba 55 f5 38 71 6b eb c8 c2 5e 34 39 b4 3a 05 94 f9 0a e9 78 cf 6d dd 44 31 2c ef 02 c3 5a 82 17 ed 2a 6e 04 07 ca 0e dd 31 0e Data Ascii: xXnp`X+u.wuefFE~l<3USI1\|/xO[U#keI>MR;4?FwYj~#&={ ]1~<<M4V8+6BnmBkZ0:nGRQ{XQn{URVP7U8qk^49:xmD1,Zn1
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 74 60 6e 38 f6 d5 83 76 4d 0d 52 06 b9 e9 b7 b6 b4 66 70 0b 5a d9 bf 29 2d 8f 6b ac d2 b0 20 ba 2e 5a 80 ff 76 ba 35 65 26 31 2c fb c1 5e c5 86 25 d3 1a 6c 84 3b 0d 8b 5b 58 8b 62 ea d3 aa 01 cd 68 45 3f c3 b4 58 cb e2 1a d1 b2 3e 8d 0c 13 83 a1 ac 42 cb 67 ed e0 96 b4 7e 58 00 6d 84 99 fd 31 ba bd 32 34 36 9e 6d 13 03 69 c7 a4 ae b4 7d 62 17 da 36 a1 b3 fa ec 8f 31 1d 60 48 ed 68 03 ba 9c eb 86 b6 52 c6 a4 8e d1 df 38 86 da 3f 14 7f 3c 3e 36 7f bf a8 77 7d 35 45 21 29 83 e9 89 95 18 96 fd 60 af 62 c3 92 89 a3 36 c2 93 86 65 a6 78 53 51 d2 46 13 6f 68 4a 6c 3c 7f fb bc e1 fd cf 8d ef 12 fc 1e 32 3b 06 4b 0c 4b 78 18 f6 2a 36 2c b9 35 c7 46 78 db b0 3c 25 31 2c e1 61 e0 55 ea d6 9c cd fa bd 60 03 dc 6d 58 0b a3 eb a9 6e 9f 99 89 78 52 9c 86 85 31 f5 c4 b0 Data Ascii: t`n8vMRfpZ)-k .Zv5e&1,^%l;[XbhE?X>Bg~Xm1246mi}b61`HhR8?<>6w}5E!)`b6exSQFohJl<2;KKx*6,5Fx<%1,aU`mXnxR1
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 60 0f 81 be d1 b6 e2 5e 70 20 db 3d e9 f1 e8 99 cb 6a 90 52 c6 46 12 29 74 03 4b 75 19 43 83 e6 6c 32 c6 b0 dc dd e2 c9 1a a0 e6 7d f1 fc 2f e9 b6 27 52 68 95 7e dd b0 3f dd ba 73 47 d7 72 fb 00 0f 99 af ed c4 fd e0 60 a5 f5 71 6d c3 86 bd c7 d5 40 b2 47 6f e6 b5 b3 d0 12 fd ac 76 1f 35 f0 ee f6 95 3f f5 94 86 7e 33 37 d0 0f c1 13 64 4a 43 62 85 32 7a b7 4a 4f fa eb da 4d 5d cb 6d 45 39 6d 27 ee 07 86 c5 ab 91 6e d5 07 b6 05 7c 43 ad 2a 64 99 d2 90 38 e9 b5 d5 f9 aa 9d db d7 56 d7 53 1a 26 f3 94 86 fa 7d 65 4a 43 62 95 af 03 bd 82 32 3a 7f d9 5e b7 e8 c0 3b b6 b3 87 68 3b f1 0c 38 60 6d 7d 7c 5b 30 77 c3 3e e3 3f b9 18 56 e2 84 16 55 fc d3 6b b2 d4 75 f3 52 2f 32 a5 c1 31 21 9f d2 94 0a a2 fd 27 ce eb 5a 6e 0f e0 1d 75 b5 8d 78 0e 1c 34 0d b4 4b a7 c1 f2 Data Ascii: `^p =jRF)tKuCl2}/'Rh~?sGr`qm@Gov5?~37dJCb2zJOM]mE9m'n\|C*d8VS&}eJCb2:^;h;8`m}\|[0w>?VUkuR/21!'Znux4K
2024-05-15 23:21:14 UTC	1635	IN	Data Raw: 21 f1 f4 da b4 e9 d5 cf 1a c7 f5 4a 57 3e e4 a6 cb ba 89 39 db 50 81 b6 fc b0 12 03 bb 18 96 ba 0d 85 5b 40 ee 92 d9 31 ad a2 87 0c 8b c9 df 7a b8 6b ca 4c 77 ff d2 95 0b b9 f5 59 e3 be d1 7d 56 ae 7c 4d 57 3f 41 70 8c d2 11 63 be c9 54 a7 cf 24 35 e1 b4 68 77 e7 8c 0b 86 55 bc d3 28 5d ed 6d 64 58 fe 2c 13 c3 2a da e1 37 55 96 a6 db 27 46 5c 87 50 97 b8 4e a1 6e 4d 2e 15 35 f6 5b 5d dd 04 c1 35 e4 0e 1c 55 24 7d f5 98 15 a9 cb 3a 31 be 95 a3 35 95 ed c6 ab 7f 18 88 61 d9 40 26 86 55 a6 eb 58 e3 41 14 66 db 3f 49 7a 9c 8a eb 10 d7 a5 5c 9d 46 16 d5 d5 4b 10 5c 0f ea ea 33 df b6 1a 52 ed f5 5f 7a ee 49 59 1a c6 55 88 27 9d 9a 54 cc c7 29 7b 6b fa 29 64 a2 51 eb 81 18 96 0d 64 62 58 3f 87 4e 52 65 69 ba bd 99 b8 8e a0 ae 70 9d 79 bd 4a d4 5e 9e 53 85 dd c8 Data Ascii: !JW>9P[@1zkLwY}V\|MW?ApcT$5hwU(]mdX,*7U'F\PNnM.5[]5U$}:15a@&UXAf?Iz\FK\3R_zIYU'T){k)dQdbX?NReipyJ^S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49760	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	612	OUT	GET /twenty/flop/jpKzvWhY.mp3 HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: audio Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1 Range: bytes=0-
2024-05-15 23:21:14 UTC	486	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: audio/mpeg Content-Length: 8650 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-21ca" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Content-Range: bytes 0-8649/8650
2024-05-15 23:21:14 UTC	3610	IN	Data Raw: 49 44 33 04 00 00 00 00 00 49 54 50 45 31 00 00 00 1c 00 00 03 53 6f 75 6e 64 4a 61 79 2e 63 6f 6d 20 53 6f 75 6e 64 20 45 66 66 65 63 74 73 00 54 53 53 45 00 00 00 0f 00 00 03 4c 61 76 66 35 39 2e 32 32 2e 31 30 30 00 00 00 00 00 00 00 00 00 00 00 ff fb 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 49 6e 66 6f 00 00 00 0f 00 00 00 28 00 00 21 77 00 0c 0c 12 12 18 18 18 1f 1f 25 25 25 2b 2b 31 31 31 38 38 3e 3e 3e 44 44 4a 4a 4a 51 51 57 57 57 5d 5d 63 63 63 6a 6a 70 70 70 76 76 7c 7c 7c 83 83 89 89 89 8f 8f 95 95 95 9c 9c a2 a2 a2 a8 a8 ae ae ae b5 b5 bb bb bb c1 c1 c7 c7 c7 ce ce d4 d4 d4 da da e0 e0 e0 e7 e7 ed ed ed f3 f3 f9 f9 f9 ff ff 00 00 00 00 4c 61 76 63 35 39 2e 32 36 00 00 00 00 00 00 00 Data Ascii: ID3ITPE1SoundJay.com Sound EffectsTSSELavf59.22.100PInfo(!w%%%++11188>>>DDJJJQQWWW]]cccjjpppvv\|\|\|Lavc59.26
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 90 9f ff fe 37 00 b0 02 d1 67 ff ff f8 69 62 87 0d 5c 02 da 84 00 86 1e ff fb 52 64 7f 81 f2 93 49 4b a1 5d a1 c0 00 00 0d 20 00 00 01 09 fd 25 33 80 f6 83 80 00 00 34 80 00 00 04 a1 34 d3 ad 29 5b a6 59 f0 8b b2 6c 20 44 03 12 bb 52 a4 8e 73 48 2b a9 75 e7 b3 a5 e0 40 84 09 84 2e fb b7 f5 ff c7 68 30 e1 ec 96 ff ff f1 9c 05 04 9e 9f 2f 7b ff ea 5d 68 13 62 3d 40 e9 f3 25 5d 55 ab fd 4b ae 59 1f 05 47 05 68 02 9a 10 1f dd 7d 67 36 24 d7 60 66 55 29 55 60 04 a2 6b e0 28 bb 5c aa 5c 51 0e ad 68 5f 9a fe b3 a7 27 89 70 6d 10 57 61 2d e9 32 4a bf 7f c9 7c 12 0c 04 9a 92 d9 0b ff f5 6a 9f 27 83 74 1f 1a 48 1f 20 2b 6f ff fc 7f 0b 4b 2d 9d 3e 77 ff ff d0 13 88 e5 31 4e d0 16 cc a7 98 73 63 50 cc ff fb 52 64 84 80 f2 a0 48 cb a1 5d a1 40 00 00 0d 20 00 00 01 0a Data Ascii: 7gib\RdIK] %344)[Yl DRsH+u@.h0/{]hb=@%]UKYGh}g6$`fU)U`k(\\Qh_'pmWa-2J\|j'tH +oK->w1NscPRdH]@
2024-05-15 23:21:14 UTC	944	IN	Data Raw: 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 ff fb 52 64 a9 0f f0 00 00 69 00 00 00 08 00 00 0d 20 00 00 01 00 00 01 a4 00 00 00 20 00 00 34 80 00 00 04 55 55 55 55 55 55 55 55 4c 41 4d 45 33 2e 31 30 30 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUURdi 4UUUUUUUULAME3.100UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	612	OUT	GET /twenty/flop/LkPf2qhV.mp3 HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: audio Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1 Range: bytes=0-
2024-05-15 23:21:14 UTC	493	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Wed, 15 May 2024 23:21:13 GMT Content-Type: audio/mpeg Content-Length: 200832 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-31080" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Content-Range: bytes 0-200831/200832
2024-05-15 23:21:14 UTC	3603	IN	Data Raw: 49 44 33 03 00 00 00 00 49 2a 54 50 45 31 00 00 00 26 00 00 00 49 56 4f 4e 41 20 52 65 61 64 65 72 20 2d 20 4d 69 63 72 6f 73 6f 66 74 20 5a 69 72 61 20 44 65 73 6b 74 6f 70 54 49 54 32 00 00 00 13 00 00 00 49 6d 70 6f 72 74 61 6e 74 20 53 65 63 75 72 69 74 79 54 41 4c 42 00 00 00 08 00 00 00 57 61 72 6e 69 6e 67 43 4f 4d 4d 00 00 00 15 00 00 00 00 00 00 00 4c 69 63 65 6e 73 65 3a 20 55 6e 6b 6e 6f 77 6e 54 52 43 4b 00 00 00 02 00 00 00 31 41 50 49 43 00 00 1c 97 00 00 00 69 6d 61 67 65 2f 70 6e 67 00 0b 49 56 4f 4e 41 20 52 65 61 64 65 72 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 06 00 00 00 70 e2 95 54 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 Data Ascii: ID3I*TPE1&IVONA Reader - Microsoft Zira DesktopTIT2Important SecurityTALBWarningCOMMLicense: UnknownTRCK1APICimage/pngIVONA ReaderPNGIHDRddpTOiCCPPhotoshop ICC profilexSgTS
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 3f d9 21 84 48 d8 e1 fb 3e 5a ad 16 5c d7 45 b3 d9 4c d8 e1 fb 1e 7c 3f 04 e3 2c 12 4b f1 cf a8 8a 7a 59 c1 2a 6c e8 f0 37 d5 ef ca 98 26 42 44 22 4d 0a 09 4d d7 c0 05 87 c9 39 98 c9 c0 19 8b 40 60 bc cd ac 5e 16 7d cb d6 17 29 fa 7e 83 62 66 21 aa 08 8c 66 b3 19 75 b7 89 96 db 4a 94 3a ad ce 44 3f f4 e0 c1 13 cf 9d 5e 21 81 58 1f 05 ba 80 21 8c 48 af 09 de 66 38 c8 0e bf 83 5e 0d c3 e8 7b 24 c0 ec a7 a8 12 42 24 80 90 12 77 5d 17 6e 93 98 b1 0c 06 99 b0 bd 6e 9a ea 40 c6 62 0c 5c 42 70 01 9d f3 36 d1 48 af 5a 9b 09 dd ce 8e 65 03 62 48 00 51 c3 1e aa 22 77 5d 17 6e 2b 52 e4 9e df 42 e0 05 60 9c 81 73 91 88 88 4e 62 aa 27 a0 a4 44 19 fd 9b c4 23 00 f8 d2 8f c6 21 57 8a 2a 32 81 e9 7d 3f 59 62 f6 8b 1d aa b8 4a 4c db 96 07 cf f7 23 9f 83 b3 c4 72 ca d2 09 Data Ascii: ?!H>Z\EL\|?,KzYl7&BD"MM9@`^})~bf!fuJ:D?^!X!Hf8^{$B$w]nn@b\Bp6HZebHQ"w]n+RB`sNb'D#!W2}?YbJL#r
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: fe 7c 07 cf 68 00 01 0e 91 56 43 2e 25 b1 bd 0a 44 9c 2b 88 2f 9b ce 98 6c 88 5a 60 f4 17 07 04 34 2a cb f8 af 09 a1 2c 09 c0 84 12 c1 28 09 a8 55 85 98 8e 20 0d a3 a3 89 b9 22 20 83 98 70 86 e2 86 82 e0 81 8b 41 48 27 23 84 7d 45 13 86 64 b9 79 32 59 36 2e ac 96 2b 22 1a 24 3b 89 44 4f 17 07 09 89 40 bc 3c 88 44 41 8c 3f 0c 61 86 1e c4 b9 e5 1b 99 20 c9 a2 66 60 b5 97 cb 87 ca 2b 31 36 2d 1e e8 94 0d 93 34 38 64 a3 ad 5a 8d 65 1a cf 24 e8 d7 74 92 52 d6 8f 5a 2b 44 f3 18 9a a8 c0 71 39 b1 81 a1 b9 c4 47 c2 92 4c 8b 29 24 68 25 ab ff ff ff ff ff ff ff fe a4 fb 5f 51 f4 29 31 05 35 14 cc b8 e4 dc ff f3 80 c4 00 2e 22 aa 6c 06 d6 12 7c 01 7c 02 66 9e cc 81 76 99 98 67 04 68 10 40 b0 14 a3 06 08 32 c4 02 80 d7 bd a5 56 33 79 12 0b 86 eb a1 b1 af a9 1c 80 94 Data Ascii: \|hVC.%D+/lZ`4*,(U " pAH'#}Edy2Y6.+"$;DO@<DA?a f`+16-48dZe$tRZ+Dq9GL)$h%_Q)15."l\|\|fvgh@2V3y
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: d1 5b 19 29 e9 58 ac ec 0a cd 7c 66 ff df 79 be ff df ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 bf fd ef e9 fe 77 8f 7b c3 da 62 0a 6a 29 99 71 c9 b8 ff f3 80 c4 00 2b 14 02 94 26 43 cf 91 10 08 79 ef e6 c3 d7 42 92 36 a8 88 aa f8 9a 43 ea 1f ae 63 4b fb e6 72 92 30 ee 18 c1 ee 9d 24 55 4d 71 02 81 2b 9b 04 07 05 3b 3b ca ae 5a 9a 59 d3 e6 e0 f8 1c 0c 41 0b 57 9d 04 e8 f7 13 21 e9 53 0b b1 c6 51 a2 db 97 95 8a 97 e8 d7 37 01 be 65 2c 13 f5 61 f6 51 2b 52 0e d9 50 d6 b5 37 64 60 62 88 f1 6a 05 15 d2 2b 58 ae 90 67 d2 95 b9 44 ca 83 56 b3 48 f0 e4 39 97 de 24 a8 72 1f 6e 4c 4c f2 6b b9 24 54 89 f7 09 5e 09 45 c2 c4 c8 12 24 35 38 c1 c2 e8 ff ff ff ff ff ff fe b3 67 10 32 51 8c 74 5c 77 14 8d 9a 66 53 10 53 51 4c cb 8e 4d c8 0a 18 99 5d Data Ascii: [)X\|fyw{bj)q+&CyB6CcKr0$UMq+;;ZYAW!SQ7e,aQ+RP7d`bj+XgDVH9$rnLLk$T^E$58g2Qt\wfSSQLM]
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 2c 35 fc f4 5f 7b 33 30 ec 16 be 5b af 55 e5 41 fd ff 29 45 f7 0c 57 2d b6 b2 e5 3b 69 6d da 5a 7f 2b 7f a3 34 8e 12 51 67 25 be bd 65 f4 a6 20 a6 a2 99 97 1c 9b 90 14 31 32 ba 30 94 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff f3 80 c4 00 2c fa 92 88 06 db d3 a4 00 0e 67 20 4a 5a d5 0a 87 67 24 80 21 01 64 05 40 53 48 3d 63 b8 dd 57 21 06 d0 cc 3e 2a 1a 6a 81 eb 89 b5 15 02 32 13 20 50 d4 6e 4c f0 b8 d5 6c cd 26 34 0d 8d 56 53 19 ce ce 6e 36 78 ca 52 15 d5 af 19 6b ab f9 f9 96 d3 b3 a9 2d 3d 86 54 fd 67 66 67 1b 38 e7 0d 5f de 30 cc b7 58 cc d6 b7 f4 8a da b5 67 6c 10 82 04 13 13 2c 9e 46 54 ad d0 58 9d e7 30 73 f1 ed Data Ascii: ,5_{30[UA)EW-;imZ+4Qg%e 120,g JZg$!d@SH=cW!>*j2 PnLl&4VSn6xRk-=Tgfg8_0Xgl,FTX0s
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 2e 39 37 20 28 62 65 74 ff f3 10 c4 00 00 00 03 48 00 00 00 00 4c 41 4d 45 33 Data Ascii: betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3.97 (betHLAME3
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 13 6c 00 0f 1b 6a 72 68 2a 27 1c f6 ad 3b 55 7d f2 92 9b 74 d3 73 f1 0b 4b 15 21 e8 d3 70 48 1a 88 20 a5 00 61 58 d6 bb 56 c5 db 52 f6 ed 4c f9 c3 af 2b b2 f3 4d 32 18 3d d5 6c 0a 7d 80 81 58 3e 93 38 8d 4a 34 d0 40 64 74 28 2a cb 52 02 d8 76 55 f4 52 09 bb 06 bd f0 05 3c be 59 1b 76 5e dc da ed b8 69 9e c5 58 8c 1e c8 1a 5d 1c 1d 4b 4c 4a 26 13 93 23 a4 ad 11 2b e1 25 88 1a 6a 63 58 8d 5e cb 4a 2c c4 19 0f 86 87 c9 c2 c8 95 29 92 29 51 56 ce 89 16 9d 39 60 31 ff ff ff ff ab 0b 04 5c c0 74 3c 8b 93 10 53 51 4c cb 8e 4d c8 0a 18 99 5d 18 4a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff f3 80 c4 00 2c ba 9a 80 06 cb d3 88 00 0e 7f ae a6 0e 9a 54 01 0a 1a 60 b7 ef bb 3b 63 a2 13 ce 98 4a 07 a4 ec d3 4b 6b f4 b8 ea b4 c7 ff ef b4 97 bf fe e4 e7 3f fe dd fe Data Ascii: ljrh';U}tsK!pH aXVRL+M2=l}X>8J4@dt(RvUR<Yv^iX]KLJ&#+%jcX^J,))QV9`1\t<SQLM]J@,T`;cJKk?
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 3f 66 c5 9b 57 30 b7 96 3c 97 4e be b6 f3 e5 ff c7 7f bc f2 af 6f 5c ef ff f3 ff ff ff fe 8e b7 65 99 73 f7 ff ff ff ff 18 88 c8 6f cc de 22 98 82 9a 8a 00 00 ff f3 80 c4 00 2e ba e2 8c 07 db 98 00 07 80 19 34 a0 c9 cc 9d 67 16 18 64 01 28 92 91 26 0b 0a 65 69 20 21 d5 85 4b d3 05 81 08 36 72 b4 32 12 0e 1d 87 71 a5 15 01 a3 cb 71 f1 29 97 72 b8 d1 65 98 0c 92 2c 90 d4 1c d2 76 80 84 04 4a 6c 2f 82 d3 c3 56 93 81 e8 80 07 00 6a 24 41 11 08 03 54 9a 39 74 3a 02 64 9d 94 04 07 20 b3 11 5c 12 61 cd 20 22 91 0b 5f 06 c7 41 b0 70 2c 50 14 00 82 24 d9 38 31 e2 3b 2d 93 c7 c9 42 3c c4 f1 50 81 93 67 cc 8c cf 98 cb a4 18 76 0c 89 6c 48 45 6e 29 11 f8 2e 7c 2d fc 57 08 90 ca 15 88 79 d3 e6 88 a6 96 b6 57 f6 fa 08 2c eb 33 7f ff eb 4d 4b 45 0b 56 a3 47 99 a2 98 82 Data Ascii: ?fW0<No\eso".4gd(&ei !K6r2qq)re,vJl/Vj$AT9t:d \a "_Ap,P$81;-B<PgvlHEn).\|-WyW,3MKEVG
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 42 45 9c a9 16 1e 52 a9 d5 f7 0a ca 3d dc 91 04 44 3a eb 8d 84 8e 98 df eb 49 5a 8e b5 ab 57 4f 92 22 03 09 11 a5 36 12 3f 72 62 0a 6a 29 99 71 c9 b9 01 43 13 2b a3 09 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff f3 80 c4 00 1d 22 62 b8 be 78 d3 44 90 a3 5f c0 02 bb 1a 1f 4e 17 6c 13 16 5b 22 0d 19 b6 7f aa 62 c0 41 9d 2f 0b a0 88 8f e6 97 a7 94 b5 61 62 7d 0d b2 34 27 ee 0c cb cb 27 94 39 96 e3 6f 8a 55 2b f0 ed 99 14 32 23 b6 a3 3e a2 d8 84 46 e5 52 4d cc 1f 5e 72 a8 c4 c6 42 e2 b2 28 c9 5b fd 15 2a ba c3 47 63 1b cb be a2 f1 b5 60 9b f6 71 76 c2 39 5d 38 77 b3 29 3c e8 8c 30 62 28 f2 c1 64 c4 14 d4 53 32 e3 93 72 Data Ascii: BER=D:IZWO"6?rbj)qC+H"bxD_Nl["bA/ab}4''9oU+2#>FRM^rB([*Gc`qv9]8w)<0b(dS2r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49761	23.196.177.159	443

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-15 23:21:14 UTC	531	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=200528 Date: Wed, 15 May 2024 23:21:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-15 23:21:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49762	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/3FxeivoS.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	458	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 364 Last-Modified: Mon, 13 May 2024 10:22:35 GMT Connection: close ETag: "6641e9eb-16c" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	364	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0c 00 00 00 0c 08 02 00 00 00 d9 17 cb b0 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 01 0e 49 44 41 54 78 da 5c 90 bf 8e 45 40 14 c6 b1 a3 94 a8 54 42 a5 13 c9 2d 6e 24 b4 a2 90 28 e4 96 1a 0f e4 35 54 1a 37 91 78 00 3d 5a 51 88 82 c2 9f 6c 28 6e 23 d8 b3 d7 ae cc ee 57 4c be f9 9d f9 4e ce 1c 72 59 16 e2 57 59 96 25 49 02 c6 30 0c 55 55 2f 4e 11 98 ea ba fe 7c ab 2c 4b 9c 93 d0 29 08 82 b6 6d 45 51 2c 8a 62 5d d7 b3 70 bb dd fa be e7 38 ce 75 5d 04 e9 3c cf 81 02 c2 d3 27 84 b0 a6 69 68 1c c7 ab c0 f3 bc e3 38 60 e2 38 86 f0 09 bb ae a3 ee f7 bb 65 59 e7 1d 5e 88 6f 3d 1e 8f 93 98 a6 a9 eb fa f7 e0 34 4d 13 7f 45 51 3f 1f 42 Data Ascii: PNGIHDRtEXtSoftwareAdobe ImageReadyqe<IDATx\E@TB-n$(5T7x=ZQl(n#WLNrYWY%I0UU/N\|,K)mEQ,b]p8u]<'ih8`8eY^o=4MEQ?B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49764	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/6g4S4aZ8.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	458	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 349 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-15d" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	349	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 0d 08 02 00 00 00 fd 89 73 2b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 ff 49 44 41 54 78 da 8c 51 31 0e 45 40 10 65 b2 14 6a 51 12 a5 33 68 54 4a 89 4a e2 0a 8e e3 14 0a 24 4a 9d 0b 68 29 24 42 29 1a 74 24 f2 5f fe 26 1b bf f8 89 29 d6 78 ef ed ec 9b 19 79 df 77 e9 1b d7 75 75 5d 37 cf f3 ba ae ba ae 9b a6 e9 38 8e a2 28 9c 65 fc 33 4d 53 96 65 cb b2 48 8f 30 0c 23 8a 22 cb b2 90 cb a8 07 51 9a a6 f8 51 55 35 0c 43 10 40 ca b2 3c cf 93 88 92 24 01 42 78 0e 95 78 81 38 8e 6d db 6e db 16 27 72 20 f7 7d 83 85 86 c1 93 78 ee 38 8e a6 69 c6 71 dc b6 2d 08 02 0e 82 85 86 c1 b8 30 94 e7 39 4f d0 41 df f7 02 87 86 d0 Data Ascii: PNGIHDRs+tEXtSoftwareAdobe ImageReadyqe<IDATxQ1E@ejQ3hTJJ$Jh)$B)t$_&)xywuu]78(e3MSeH0#"QQU5C@<$Bxx8mn'r }x8iq-09OA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49765	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/Jv56WYQv.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 25871 Last-Modified: Mon, 13 May 2024 10:22:35 GMT Connection: close ETag: "6641e9eb-650f" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ec 9d 77 9c 5e 45 d5 c7 bf bb c9 92 04 42 08 81 24 f4 12 3a 08 48 97 8e 0a 28 48 91 a6 48 55 a9 4a 55 54 de 97 57 60 6d 08 82 05 b0 80 48 11 14 04 04 04 14 69 0a 48 b3 80 0a d2 6b 80 d0 4b 20 40 12 92 6c f6 fd e3 3c 6b 96 64 cb f3 dc 33 77 e6 96 df f7 f3 39 9f 84 f2 dc 73 a6 dc 99 b9 33 67 ce 01 21 44 9d 58 0e 38 15 f8 0f f0 4e 43 ee 07 be d7 f8 6f 42 08 21 84 a8 10 6d c0 b1 c0 7b 40 77 3f 32 1d f8 5a 2a 03 85 Data Ascii: PNGIHDRxsBIT\|dpHYs+tEXtSoftwarewww.inkscape.org< IDATxw^EB$:H(HHUJUTW`mHiHkK @l<kd3w9s3g!DX8NCoB!m{@w?2Z*
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: df 3a b0 20 70 2d f9 65 20 3b 1d fb fa 99 95 d3 f3 53 70 1b b0 06 e6 09 be 1d b0 12 76 27 7a 22 e6 d8 74 35 16 29 4d 88 b9 b9 a3 21 47 62 fd 67 5b cc 1f a6 1b 78 1c f8 23 d6 7f 66 26 b2 4f 08 51 13 16 06 ee 26 9f af fe a9 14 37 80 89 08 4f 27 da 01 10 71 d8 8a 39 79 1d 9e 02 fe 8d 5d 27 dc 2a 9d 49 42 94 8b b1 e4 97 e6 f3 69 14 dc a3 6e 74 a2 05 80 c8 97 b1 d8 0e c9 40 7d e9 7a aa 75 dc 28 44 70 96 20 bf 04 28 37 02 8b c4 2b 8a 28 08 5f 27 7b 9f f9 7a 02 7b 45 b9 18 8f 1d 91 34 d3 9f 26 02 cb 27 b1 52 88 82 b3 2c cd 07 ea 68 55 be 47 75 ee b5 8b d6 38 98 ec fd e6 a0 04 f6 8a f2 d0 06 fc 99 d6 fa d4 33 58 24 53 21 44 83 95 80 67 09 3f f1 cf 00 0e 88 58 0e 51 3c 3c d9 12 75 5c 24 06 62 07 b2 f5 2b 2d 02 84 68 f0 01 f2 89 5b fe 16 e6 c9 2c ea 4d 1b d9 f2 46 Data Ascii: : p-e ;Spv'z"t5)M!Gbg[x#f&OQ&7O'q9y]'*IBint@}zu(Dp (7+(_'{z{E4&'R,hUGu83X$S!Dg?XQ<<u\$b+-h[,MF
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: d4 12 88 be d8 87 38 93 7f 8f dc 85 f5 25 11 97 5f 92 ad bd 66 e3 f7 c1 59 06 df 0d 94 1b 9d fa c5 5c ac 80 2f 17 f9 44 fc e7 b3 df 76 e8 bf cd a9 5b b4 ce 39 84 9b 04 7e 8f 8e 71 8a c0 52 c0 1b c4 5d 00 74 03 17 44 28 9b 78 3f 9e 1b 3b df 0a a0 ff 16 87 fe 2e 60 c9 00 36 88 06 c7 e3 7b 81 bf ed d4 3f 04 df fd f1 10 b7 0f 44 f3 1c 46 b8 c1 ff 0e 2c 6a 9d 48 4b 3b f0 27 e2 4f fe 3d 72 68 fe 45 14 bd b8 93 ec 6d f5 1c 36 66 7b f8 bc 43 7f 37 f0 25 a7 7e d1 8b 87 f0 35 c6 aa 4e fd 3b 38 f5 5f e4 d4 2f 9a 67 43 c2 39 fd 3d 88 c5 9e 10 e9 f9 12 e9 26 ff 6e cc 29 70 fd dc 4b 29 7a b8 18 5f 7b 6d ef d4 3f 8a e6 ae 1f f6 27 7f 73 ea 17 0d 56 c5 d7 11 fe 11 c0 06 6f a2 88 7d 03 d8 20 06 67 34 7d 07 67 ca 22 6f 00 2b c6 35 5f f4 c3 1a f8 03 80 85 90 27 51 18 f1 58 Data Ascii: 8%_fY\/Dv[9~qR]tD(x?;.`6{?DF,jHK;'O=rhEm6f{C7%~5N;8_/gC9=&n)pK)z_{m?'sVo} g4}g"o+5_'QX
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 95 d7 81 5b 1d bf df 1a 0b ad 5b 46 ba b1 45 40 16 b4 00 c8 46 aa 05 c0 0c 2c fc 73 56 92 ed 02 a4 5c 00 78 bc f0 3d 5b 3d a0 1d 80 d8 74 00 c3 32 fe 76 46 48 43 22 b3 13 be 08 89 65 f4 fe 9f 1b cf 31 40 07 b0 43 28 43 12 90 f5 18 60 04 e9 a3 b4 96 91 94 ce 78 a5 f4 03 48 b9 00 f0 ac ec bd d7 c2 e4 03 10 17 cf 17 8d c7 93 3c 35 9e 2d ec 2e 2c c4 6b d9 f9 1d 56 96 ac 94 f9 18 c0 e3 07 a0 5d 80 d6 49 b5 03 00 be 39 29 d9 2e 57 6a 1f 80 ac 78 9d c2 b4 00 88 8b c7 a9 a9 ac 0b 80 05 81 6d 1d bf bf 13 78 39 90 2d 29 79 19 2b 4b 56 b6 a5 bc 93 61 d6 23 00 28 6f 99 53 92 72 01 e0 99 93 3c 73 a1 8b ba 2e 00 3c d7 8b bc c7 0f 75 c4 33 98 95 f5 08 e0 23 c0 70 c7 ef cb ec fd 3f 37 9e b2 8c 00 3e 1c ca 90 c8 cc 72 fc 56 0b 80 d6 f1 8c cd de 2b a7 9e 39 69 21 a7 ee cc Data Ascii: [[FE@F,sV\x=[=t2vFHC"e1@C(C`xH<5-.,kV]I9).Wjxmx9-)y+KVa#(oSr<s.<u3#p?7>rV+9i!
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 43 55 52 c1 d9 0e 78 95 b4 ed 38 90 bc 46 b1 16 9a 79 72 0e 61 ea 6c af c6 f3 3a b0 77 e3 6c d2 1f fb 94 25 47 fd e2 f8 ca e9 e9 ab ed f8 fc a9 f6 77 e8 ae 1c 1f c4 d7 90 2b 3b 74 7b 63 39 ef ee d0 1d 93 8b 88 3f 90 4c 02 ce c4 b6 15 fb 73 02 bb 26 80 9e d9 94 eb ab c5 c3 d2 c0 9d c4 6f cb c1 e4 ae 86 6d 75 e0 93 84 a9 b3 ab fb 79 fe 10 ec 9d 39 93 fc 23 45 f6 25 65 59 00 7c 1a 5f 39 3d 1f 6f ab 39 75 7f c0 a1 bb 72 74 e0 8b 3e b7 b7 53 ff e3 0e dd 65 49 0d dc 49 9c c1 e3 69 e0 34 2c 3c 67 33 47 4c 4b e2 cb a6 d5 23 cf 93 6f 4a df 22 d1 81 e5 88 f7 dc 9e 09 25 b3 b1 f6 ae 4b 46 ba c5 09 b3 0b 33 19 58 a2 09 7d ed d8 bb 74 1a f6 6e c5 68 d3 13 5b ae 95 34 fc 94 ec 65 7c cc a9 7b 3f 87 ee 77 f1 1f 1d 55 8e bf 91 bd 42 7f e4 d4 7d ae 43 f7 7d 4e dd b1 d8 9c Data Ascii: CURx8Fyral:wl%Gw+;t{c9?Ls&omuy9#E%eY\|_9=o9urt>SeIIi4,<g3GLK#oJ"%KF3X}tnh[4e\|{?wUB}C}N
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 49 f9 fb 54 d5 b8 08 7f bb fe 6f 74 ab 85 9b 91 c0 cb f8 1a be 0b 4b 87 2a 8a c1 51 84 19 a8 27 03 cb c5 35 3d 0a 8b 33 c7 91 30 a4 ef c0 db cc 71 e0 4b e1 b5 9f 37 4b e1 f7 10 ef 91 23 22 db 2e fa 67 7d fc b7 6b 74 2b ac c4 7c 19 ff 0b 7d 17 e9 3d c4 85 9d 27 87 ca f2 b7 6b 64 db 53 30 04 0b 8f fc 07 b2 d7 d3 1f 1a cf a8 43 02 9c 5d 09 d3 b7 5e 46 bb 00 45 a0 1d f8 3b fe f6 4c 71 3d 58 04 62 04 61 3c 7d f7 8f 6d b8 98 87 6d 08 33 40 ff 2c b6 e1 89 e9 24 7b 5d 75 46 b7 36 2d 3f 25 4c 1f 2b ba 63 69 1d 38 10 7f 3b 56 3e 32 6c 7b 6a 03 72 66 1a 76 ff d3 cb 29 58 20 09 91 8e 10 01 57 1e 04 8e 09 f0 1c 51 4d be 8c c5 96 f0 b2 46 80 67 88 ec 2c 0c 9c 14 e0 39 df c4 1c 08 2b 4b d5 17 00 00 e7 02 4f 3a 9f 31 1e 38 21 80 2d 22 3b de 60 2b d3 b1 24 1e 53 03 d8 22 Data Ascii: ITotK*Q'5=30qK7K#".g}kt+\|}='kdS0C]^FE;Lq=Xba<}mm3@,${]uF6-?%L+ci8;V>2l{jrfv)X WQMFg,9+KO:18!-";`+$S"
2024-05-15 23:21:14 UTC	1756	IN	Data Raw: d0 95 c5 74 e0 f9 e8 c1 31 ab e9 cf 33 c9 e3 38 e5 76 3d 01 2c 42 09 cf 03 f5 58 84 b6 e7 c5 ae 62 18 4a 17 70 0c 7a 45 71 2a e9 8e 11 be 05 f8 08 ba d6 66 43 72 02 60 23 35 17 25 02 07 24 6c c3 12 54 96 f5 87 c0 9a 84 ed 08 6d 1c 2a af 3b 0d 15 37 9a 8e 4a ed ce a8 ff bb 7d d0 ac 42 aa ad 94 1b 51 dd 87 15 c0 23 68 55 fb 4a f4 ae bb f9 df 3d 95 a8 7d 31 ec 0e bc 0b 78 1f e9 3f 13 e7 01 bf 4a d8 06 2b 18 27 00 d6 8a 31 e8 5b c6 a7 48 bb b8 e8 29 74 90 d1 b7 81 7f 24 6c 47 6a bb a0 03 5d 26 35 fd b3 11 a7 a1 a9 f5 56 dc 0c dc 80 be c1 af 45 c9 56 e3 9f 6b d0 54 73 55 bd 18 f8 00 3a 43 63 6c c2 76 f4 a1 43 84 2e 46 af e9 cc cc a2 98 86 f6 15 e7 b0 e2 fd af c0 3b 28 ce 36 c2 58 6a b4 7e 4d 6b d1 5b 9b b7 f1 c0 3b 81 db 49 7f bf 6f 43 33 60 39 1e ad 6d 66 15 Data Ascii: t138v=,BXbJpzEqfCr`#5%$lTm;7J}BQ#hUJ=}1x?J+'1[H)t$lGj]&5VEVkTsU:CclvC.F;(6Xj~Mk[;IoC3`9mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/nPU7rHwt.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 22478 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-57ce" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 17 00 00 02 35 08 03 00 00 00 93 ed f7 87 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 d6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 Data Ascii: PNGIHDR5gAMAasRGBiTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 17 03 54 5c 81 e2 08 e9 2f 86 a4 51 1a bb 79 4e 76 d8 60 b4 0f 06 bc 98 b4 bb e5 25 46 06 65 b1 06 03 76 f7 42 5e bc 77 a1 b6 a5 bd bb bd a5 f6 c2 7b 11 bd e8 38 70 e0 c6 22 9e 77 47 ef c5 82 24 17 57 f9 af d9 96 12 e6 d3 4c 87 72 53 74 81 17 f1 c9 d5 6d be f4 b5 b3 7a 8f da 8d c7 9f cf f2 fd b1 f1 e4 30 89 2d 35 79 19 c8 b4 51 c8 41 1a 3b 2f 5c de a9 25 b7 b0 53 3f e0 b2 0c 50 88 5b 85 cb a4 7a 31 ee 51 03 dd 25 66 ad 4e 21 26 15 39 30 43 1d 83 d1 e1 9f 59 f2 cd 47 4d 8b e1 c1 51 32 cb 29 46 07 87 3d d4 84 fb bd 98 11 0e a3 75 54 cc 28 36 e1 1c 74 fa bb f5 c8 9f 03 51 9a 4e 37 29 ff eb 4f 14 c5 e7 a3 5e 91 17 af 9f 73 99 98 c6 9f ad 8d 9d 17 e3 1e df 93 39 87 30 29 d4 6a 78 5c 13 a0 98 85 cb fb 39 10 a7 1a ff 26 33 f5 08 c6 31 31 24 07 60 70 8c fa 04 a7 Data Ascii: T\/QyNv`%FevB^w{8p"wG$WLrStmz0-5yQA;/\%S?P[z1Q%fN!&90CYGMQ2)F=uT(6tQN7)O^s90)jx\9&311$`p
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: a9 2f cb c5 15 80 3b e2 9e 60 b5 c4 ab f0 03 37 55 24 e2 8b ad 50 14 ca 7d 92 47 05 f4 44 81 65 9e 82 eb 01 50 f7 31 d6 ca 43 e4 69 31 be 94 d9 18 95 0b 6e b8 8a b1 d4 fd 90 cf ca 41 25 87 ec 18 bf fd 18 44 a9 4d 10 e6 42 14 b7 1f 0e d0 c8 1c c0 61 79 85 63 a9 2a 1f 75 48 9e 40 ec 2c 96 8c 2f 3f 6c 89 75 35 8f bc 7e fd 9a 66 02 e7 c4 63 5d ac 70 26 f0 d2 c1 12 8e fa 66 1f 33 d6 b3 1c 98 f9 ac 5c f0 3e 1b 06 9d 1b 01 b2 18 c5 c5 f9 39 89 a0 c2 c5 21 96 0e d0 d5 17 cc 7e 8f 47 11 1d 39 db 4c 00 b7 b8 8d 0c 50 9f 95 01 f4 c6 bb ad a0 3d cc e7 6e 0f e4 db df cb 45 9c 15 ac 23 1e 1b a8 75 34 f3 61 75 6e e9 02 b8 41 61 8d ba cd 08 11 2e 44 71 a3 00 c7 3b 47 4c 50 a0 c8 b6 1c 3b 29 c3 01 1c 66 a5 8f 10 63 66 b2 1b 97 5e 62 67 ac 2b fa c2 bf b8 38 c5 b2 e7 f0 95 Data Ascii: /;`7U$P}GDeP1Ci1nA%DMBayc*uH@,/?lu5~fc]p&f3\>9!~G9LP=nE#u4aunAa.Dq;GLP;)fcf^bg+8
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 75 6c e0 07 d6 dd 9e 42 e7 ad 14 17 7b 38 d8 0a 94 0b 7a ef 37 de d0 9c 36 e4 b1 b0 ae 9c 7a 7d 90 0b d9 8e 60 23 21 12 e0 5d 3e 06 0d 4c 71 55 19 48 9e 8c 58 5f 44 71 38 9d 8b 3e ec 49 f6 fa 64 0f e8 e6 1d 7c 93 34 1f 2c 21 58 5b d1 21 ad 04 e7 22 15 d9 37 e0 e2 cb fb dd 49 2e a6 dd 5d 79 9d 65 94 8b f5 7c cd 56 33 60 72 71 b3 85 72 31 3a ea d7 9d 21 c6 05 ed e0 58 db 81 d3 79 9e 3a 7a c2 ab ce 17 14 83 69 10 5c bc 40 d7 fc 27 b4 33 2e de 90 de 60 0d 81 b5 8a 02 db d6 ff 58 1d e5 4c 51 b0 8b c5 13 de a9 92 89 97 b8 cb f2 62 65 79 5a 59 57 b6 5c b8 10 bb e8 f5 94 51 d2 c8 43 48 3c 43 18 80 54 8e 79 dc 73 e7 02 f0 e3 73 6c 29 1a 34 b4 7a 77 49 13 61 5c 4c f7 94 7a 3a ef 85 68 9f e6 1f 3a ad a2 f9 01 da 36 6d 48 98 5a 82 5d f2 8a fe c9 41 fa 27 ca d1 75 6c Data Ascii: ulB{8z76z}`#!]>LqUHX_Dq8>Id\|4,!X[!"7I.]ye\|V3`rqr1:!Xy:zi\@'3.`XLQbeyZYW\QCH<CTyssl)4zwIa\Lz:h:6mHZ]A'ul
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 12 8f 29 ec 30 16 ad 2e 76 63 c1 e9 7c d0 91 e0 62 55 dc 5e df af 24 21 97 e5 e0 d8 c0 38 17 2f c0 25 0e 57 48 d1 87 58 4e d5 68 3f 17 ca 63 91 48 31 43 d2 c7 c0 05 f9 40 4e bb 0f a4 7a 05 84 ef a1 fc 61 70 e0 9c 19 8b 4b 3c 7e 29 36 1c c1 1b b2 8b 2d 05 4a 1d 1b 5f 2c 21 86 e0 e2 e7 92 6b ee 2b 67 b4 24 64 c5 db 61 f4 ce f3 79 d4 e3 58 eb 16 ce 29 d1 87 58 4e d5 c8 97 53 4a 0d bb b8 50 1e 8b 44 8a a9 93 3e 2e 2e c8 07 72 ca 7d 20 4e 14 ca 31 97 bf ab a5 18 71 62 25 2e f1 f0 79 19 fb 1d a3 e2 e4 40 2b 9f 62 96 fc 66 09 31 04 17 2d 6d fc 6f 87 96 84 b4 6c f0 09 c3 ed f6 35 d8 44 bc 11 98 53 a2 0f b1 9c aa 91 2f a7 94 1a 36 9d bf d0 1e 8b 5d 29 a6 4c 3a af e7 2f 14 17 e4 03 29 28 1f 88 31 d2 b0 fb 23 d7 80 01 17 ad b3 12 ae a2 91 3d 16 0d 63 e0 37 57 42 12 Data Ascii: )0.vc\|bU^$!8/%WHXNh?cH1C@NzapK<~)6-J_,!k+g$dayX)XNSJPD>..r} N1qb%.y@+bf1-mol5DS/6])L:/)(1#=c7WB
2024-05-15 23:21:14 UTC	2459	IN	Data Raw: 3e 10 7c 20 f8 40 0a 3b 08 1f 08 3e 10 7c 20 21 5c e0 03 c1 07 82 0f 24 74 be c0 07 82 0f 04 1f c8 0a 2e f0 81 e0 03 99 c4 07 12 36 5f e0 03 c1 07 82 0f 24 64 7f 81 0f 04 1f 08 3e 90 42 2e f0 81 e0 03 c1 07 12 c2 05 3e 10 7c 20 de b9 37 3e 10 7c 20 de e9 35 3e 90 d5 83 0f 04 1f 48 6d 9b 1d 1f c8 86 e0 02 1f c8 a6 e2 62 e3 b4 43 83 15 0c 2e e0 02 2e e0 02 2e e0 02 2e e0 02 2e e0 a2 4e 5c 10 82 0f 84 f9 82 f9 82 f9 02 2e e0 82 ac 9d 0b 3c 39 70 01 17 85 77 e3 c9 81 0b b8 28 bc 1b 4f 0e 5c c0 45 71 2e f0 e4 34 0c 17 78 72 ca e7 02 4f ce ba 0f 5a 3c 39 78 72 f0 e4 14 76 10 9e 1c 3c 39 78 72 42 b8 c0 93 83 27 07 4f 4e e8 7c 81 27 07 4f 0e 9e 9c 15 5c e0 c9 c1 93 33 89 27 27 6c be c0 93 83 27 07 4f 4e c8 fe 02 4f 0e 9e 1c 3c 39 85 5c e0 c9 c1 93 83 27 27 84 0b Data Ascii: >\| @;>\| !\$t.6_$d>B.>\| 7>\| 5>HmbC.....N\.<9pw(O\Eq.4xrOZ<9xrv<9xrB'ON\|'O\3''l'ONO<9\''

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49763	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/d2If1LR6.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 22417 Last-Modified: Mon, 13 May 2024 10:22:36 GMT Connection: close ETag: "6641e9ec-5791" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 48 00 00 02 56 08 03 00 00 00 55 92 57 b6 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 d6 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 58 4d 50 20 43 6f 72 65 20 36 2e 30 2e 30 22 3e 0a 20 20 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 Data Ascii: PNGIHDRHVUWgAMAasRGBiTXtXML:com.adobe.xmp<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 85 40 53 6d 6d 7b a5 45 fa d2 bb 76 e5 8b 74 2d ad 3b 0d d9 5b 7a 26 8a bc 19 37 6c 9b 30 e7 76 8c ad 4d 9e 4c a2 f9 6b d3 a4 2c 41 18 ab dc bf 65 ae 54 e4 93 22 6b 2b 86 a2 fe 6c fd 9c a8 0c 91 1e 64 e6 2d 21 74 e0 94 87 63 11 74 42 04 16 29 92 92 96 d3 a6 30 bf c0 e3 3c b0 21 1a ce 71 d6 e3 8f 66 eb 6f 99 aa 5d 98 9f c5 f1 0f 5a 16 8e 9f a5 b5 60 4e 24 54 cc ef 0b f3 03 93 ca 23 f1 44 36 77 bc b5 b7 93 be 93 48 3f 9e 85 59 e8 a0 37 c1 2b 49 24 25 9d d2 77 31 f6 6c a0 2d e9 f0 39 db 50 79 58 7f 45 28 21 85 f1 a9 38 cf f1 6b fc 40 34 b0 b8 86 73 9d 84 29 4f a4 38 0b e1 cc 49 8b 98 58 50 cc a6 52 68 66 2e b5 3b c3 39 92 b8 d4 01 5e 83 47 43 24 52 79 c8 f7 fc 88 8a 2a 36 e4 13 f4 c9 7f 06 4d e7 c7 85 c7 7d 07 8c 1d 27 4d 7a 83 e2 8b 85 ae f4 0c 65 be 00 e2 Data Ascii: @Smm{Evt-;[z&7l0vMLk,AeT"k+ld-!tctB)0<!qfo]Z`N$T#D6wH?Y7+I$%w1l-9PyXE(!8k@4s)O8IXPRhf.;9^GC$Ry*6M}'Mze
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 64 2d 48 0e e0 8e 52 86 13 4f 09 a4 a8 80 24 3a eb 72 01 03 1d ca 35 43 1e 89 b0 19 53 d3 40 5b 06 4e 17 85 70 07 41 22 7c e6 3d 25 ce 91 42 94 44 39 ee ef 81 34 41 bc f8 00 2f 83 34 69 85 76 3d 70 e6 5c 5d c0 8c 80 24 3a 17 22 84 60 ea 62 9b 41 69 51 02 f0 3b 62 c0 ad 39 6a ba bc 1f 24 ee b7 aa 76 45 5e 0b 81 3d 90 28 14 ec 4e e8 4b 51 4e 38 33 1a a4 92 35 c4 e9 13 90 44 e7 42 8e 25 5d a8 ee a6 a8 2d 9f e5 ea 77 af 32 06 89 80 71 e0 7e 6a 1f 48 6a 88 48 0a 47 f9 82 6c 99 18 09 fa ab 20 e5 07 88 a2 20 30 c4 58 5a e5 6f 75 97 49 cb 0e 29 01 49 74 4e 64 34 97 72 0b 96 ed d4 95 1e 5a 76 d6 ee fa 6e 1c 38 74 c5 6e 77 35 2f ec eb c9 f7 da 6f 8a 1d 95 0e 23 5f ea f8 f7 a6 86 02 92 48 24 20 89 44 02 92 48 24 20 89 44 22 01 49 24 12 90 fe 4d f2 4d e5 7c fc 6a 9c Data Ascii: d-HRO$:r5CS@[NpA"\|=%BD94A/4iv=p\]$:"`bAiQ;b9j$vE^=(NKQN835DB%]-w2q~jHjHGl 0XZouI)ItNd4rZvn8tnw5/o#_H$ DH$ D"I$MM\|j
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 55 c4 54 f0 98 b8 00 bc 37 1c a0 a5 bb 47 7b af d0 72 0c a4 a9 60 14 80 a3 20 a9 82 f3 2a da 65 b4 00 84 5b a3 30 49 c6 00 3c 73 b3 08 12 82 74 0e c6 48 34 b4 b8 fb e8 15 3f 45 41 f2 92 14 c0 4f 2c fe a4 29 29 d0 36 d6 62 10 57 09 5e 05 f0 2d 98 0c 3a e2 87 36 42 82 13 03 9c 7d 3c 18 a6 88 a4 29 48 f4 40 53 00 4a 0a d2 1d 42 fa 29 3f 7a 48 f4 f5 d9 00 52 3d a0 d2 10 03 82 84 20 9d 03 90 7a a4 1e d9 00 05 e9 06 b1 02 f4 31 9a d2 e4 8a f0 a9 4b 04 69 5a e8 d1 0d 86 58 fa 0b b1 7e 58 ec e3 31 90 6c 2c db 85 00 52 98 e5 a8 98 24 2a e9 90 e3 7a f6 d8 0a 49 20 48 08 92 fc 41 a2 91 e3 7f ec 9d 6d 4c 53 59 1a c7 0f 59 e0 dc ae 21 29 58 6a 4b 02 85 04 c5 b6 40 23 2f 56 0a 43 28 05 6b 80 ca 54 ca 06 a5 40 19 85 f0 52 41 19 41 01 51 33 08 e2 60 d5 80 36 ea 26 b3 9b Data Ascii: UT7G{r` e[0I<stH4?EAO,))6bW^-:6B}<)H@SJB)?zHR= z1KiZX~X1l,R$zI HAmLSYY!)XjK@#/VC(kT@RAAQ3`6&
2024-05-15 23:21:14 UTC	4096	IN	Data Raw: 1c 16 5b 2b ea 19 5e 85 39 63 18 7e f9 9f d9 3f 41 39 66 97 a1 44 3a 93 51 a0 1a 08 fa 6e 44 3a 97 74 4a 7c 0c 43 24 30 bc 22 4d ef 8e c9 fa b2 7a fe 9d 3c 57 51 a3 d8 65 07 5c f3 ac 13 ad 17 d5 d3 ef 45 a2 82 d5 7e fc 4d 69 b5 c9 8a 13 ed b7 45 7a 44 f5 94 0e 9a 46 10 09 0c 3d c6 ce d1 99 5e a9 06 65 39 b1 58 b7 3f 72 37 31 52 7f 6d ef 0f 76 5b 56 b0 be fe f5 73 85 c5 fc 9a 97 20 12 00 43 03 44 02 00 22 01 00 91 00 80 48 00 00 88 04 00 44 02 00 22 01 00 91 00 00 10 09 00 88 04 00 44 02 c3 44 36 69 37 a9 bd 16 44 82 48 e0 57 31 52 ac 9b d4 b8 95 82 48 10 09 fc 1a 97 33 45 56 22 65 63 26 43 24 88 04 7e 91 7c 24 a2 45 6a c9 12 22 41 24 f0 eb e4 ec a1 1d 61 68 07 91 00 44 82 48 00 22 41 24 00 91 20 12 00 10 09 22 01 88 04 91 00 44 82 48 e0 1f c4 56 47 a4 04 Data Ascii: [+^9c~?A9fD:QnD:tJ\|C$0"Mz<WQe\E~MiEzDF=^e9X?r71Rmv[Vs CD"HD"DD6i7DHW1RH3EV"ec&C$~\|$Ej"A$ahDH"A$ "DHVG
2024-05-15 23:21:14 UTC	2398	IN	Data Raw: 20 ad e1 38 9c ab e3 97 30 14 7a cc 91 74 9d 06 a9 64 34 24 48 69 23 42 63 2c ef 54 92 31 9d fb 9b 43 bb 28 82 f4 d7 5e 96 f3 e7 fa 5d bb e7 9c 67 f7 de fe 8a d0 6e a3 30 43 4d 08 5d 11 2d 00 92 c3 a1 60 1e 9d cd c1 68 c0 80 b4 22 40 72 7f 10 76 ed cb 95 af f2 ae a3 84 4a c6 c8 ff c7 11 07 ad 78 a2 41 4a c0 8c 00 49 4b 96 10 48 ae d0 89 d6 15 f1 88 8d 18 43 73 b0 45 8a 27 12 a4 08 73 4d 52 0a 24 a6 82 25 cb 42 45 4b ba 88 f5 bd 78 67 4f 51 62 65 cb 80 e4 9e ce 02 b9 08 ba 68 40 34 6f 8b b8 ec c2 19 1c 97 12 51 3c 65 17 a4 30 b5 b2 de 2d de 62 81 e4 d5 63 79 84 a7 48 2b f1 71 08 ad 90 b6 ad 06 49 2e 74 37 1b c5 dd a9 cc c8 a1 1d 23 e5 62 59 a0 2b a8 80 97 64 60 ba 8d 58 52 a2 b8 18 6d cb 39 b5 25 0a 33 89 5d be a1 40 52 d7 c9 56 8a c1 b0 81 4e 7c 5d 09 cd Data Ascii: 80ztd4$Hi#Bc,T1C(^]gn0CM]-`h"@rvJxAJIKHCsE'sMR$%BEKxgOQbeh@4oQ<e0-bcyH+qI.t7#bY+d`XRm9%3]@RVN\|]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49766	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/sZq0cGqH.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:14 UTC	459	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:14 GMT Content-Type: image/png Content-Length: 3834 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-efa" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:14 UTC	3637	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 06 00 00 00 52 dc 6c 07 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 73 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 32 20 37 39 2e 31 36 34 34 38 38 2c 20 32 30 32 30 2f 30 37 2f 31 30 2d 32 32 3a 30 36 3a 35 33 20 20 Data Ascii: PNGIHDRRltEXtSoftwareAdobe ImageReadyqe<siTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53
2024-05-15 23:21:14 UTC	197	IN	Data Raw: 57 43 6e 15 1d 67 02 9c ce 80 01 aa 47 8f fc 99 6c 4b 84 2d 0e 3c 8b 96 4a ba 45 c9 46 92 06 03 54 c9 6c 5b 1a cc a9 e9 fe da 5d fb 76 5b 2a 01 06 a8 05 3d c6 49 4f 3d d7 89 75 1b 2a ba a7 de 47 d7 e9 4e a7 ae 8f 01 5c 61 ae 2d 0d f4 20 e8 32 e7 d3 df 60 eb fa f3 09 39 06 70 0d ed 29 d2 33 8e 4f 14 3d 54 f0 b5 57 98 78 02 db f9 a2 ad 84 1a 03 b8 8c 8e ba 9e 6a ab 28 4f 15 d0 c8 bd 48 34 d1 b0 c5 4b f1 b4 db ed 44 82 cc 1c 68 df da 53 32 54 a9 74 ba f2 38 42 58 5e de 6e 91 b9 81 2a 10 00 06 00 c0 00 00 18 00 20 14 fe 2f c0 00 0c ed cd 8a 47 dd 06 41 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: WCngGlK-<JEFTl[]v[=IO=uGN\a- 2`9p)3O=TWxj(OH4KDhS2Tt8BX^n* /GAIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49768	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:14 UTC	389	OUT	GET /twenty/flop/pgaK9m2J.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:15 UTC	460	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:15 GMT Content-Type: image/png Content-Length: 8350 Last-Modified: Mon, 13 May 2024 10:22:34 GMT Connection: close ETag: "6641e9ea-209e" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:15 UTC	3636	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 06 00 00 00 f4 78 d4 fa 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 11 3b 00 00 11 3b 01 64 27 50 cf 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ed dd 5d ac ad 79 61 16 f0 e7 6c 66 a0 30 cc 40 a0 92 36 30 33 02 4e db 68 03 b6 58 3f d0 0a ad 96 14 15 ad 4d 9a da c4 8f 8b a6 26 26 2a 5a 63 bc d2 d4 4b 35 35 e1 82 98 54 6b 6a 35 a6 1a 8d 56 c4 b4 a6 81 81 32 d4 5a 4c 11 fc 28 1d 3e fe 50 7a 81 29 d0 0e 50 86 16 06 2f d6 59 cc 99 33 fb 9c b3 f6 de eb 5d cf fb f1 fb 25 4f 80 21 9c fc d7 bb c3 7e 9e f5 be 6b ef 73 2d a7 f5 82 24 0f 5d cf 8b 93 3c fb 7a 9e 99 Data Ascii: PNGIHDRxsBIT\|dpHYs;;d'PtEXtSoftwarewww.inkscape.org< IDATx]yalf0@603NhX?M&&*ZcK55Tkj5V2ZL(>Pz)P/Y3]%O!~ks-$]<z
2024-05-15 23:21:15 UTC	4096	IN	Data Raw: 3b 51 fe c0 2c 19 01 9d 8c 9c 76 04 28 ff 4e 94 3f 30 6b 46 40 27 23 a7 19 01 ca bf 13 e5 0f 2c 82 11 d0 c9 c8 b4 23 40 f9 77 a2 fc 81 45 31 02 3a 19 99 66 04 28 ff 4e 94 3f b0 48 46 40 27 23 c7 1d 01 ca bf 13 e5 0f 2c 9a 11 d0 c9 c8 71 46 80 f2 ef 44 f9 03 ab 60 04 74 32 72 b5 11 a0 fc 3b 51 fe c0 aa 18 01 9d 8c 5c 6e 04 28 ff 4e 94 3f b0 4a 46 40 27 23 17 1b 01 ca bf 13 e5 0f ac 9a 11 d0 c9 c8 61 23 40 f9 77 a2 fc 81 4d 30 02 3a 19 b9 fd 08 50 fe 9d 28 7f 60 53 8c 80 4e 46 ce 1f 01 ca bf 13 e5 0f 6c 92 11 d0 c9 c8 53 47 80 f2 ef 44 f9 03 9b 66 04 74 32 b2 1b 01 ca bf 13 e5 4f dd b5 f6 01 20 c9 bd 49 7e 2a c9 ab db 07 d9 98 0f 67 f7 3d a0 f1 d7 09 6f d9 bb 93 7c 67 92 cf b4 0f c2 b6 19 00 cc c5 3d 49 de 9a e4 35 ed 83 c0 84 de 9d e4 f5 49 1e 6b 1f 04 0c Data Ascii: ;Q,v(N?0kF@'#,#@wE1:f(N?HF@'#,qFD`t2r;Q\n(N?JF@'#a#@wM0:P(`SNFlSGDft2O I~*g=o\|g=I5Ik
2024-05-15 23:21:15 UTC	618	IN	Data Raw: 38 e5 0f c0 54 b6 3c 02 7e fa 76 17 e6 75 33 38 60 a3 fc dd f6 07 d8 8e ad 3e 0e f8 b6 3b 5d 98 ff 3c 83 43 9e b2 fc bd f3 07 d8 9e ad dd 09 f8 8f 87 5c 94 97 27 79 7c 06 87 55 fe 00 4c 69 2b 23 e0 f1 24 0f 1d 7a 51 fe fe 0c 0e 3c 75 f9 bb ed 0f c0 16 1e 07 fc bd 8b 5c 90 bb 92 bc 6b 06 87 9e aa fc bd f3 07 60 6f cd 77 02 de 99 5d a7 5f c8 4b 92 fc da 0c 0e af fc 01 98 da 1a 47 c0 a7 92 3c 78 d9 0b f2 1d 49 be 30 83 17 71 ac f2 77 db 1f 80 5b 59 d3 e3 80 2f 24 f9 63 57 bd 20 7f 2e c9 97 66 f0 62 ae 5a fe de f9 03 70 27 6b b8 13 f0 44 92 bf 70 ac 0b f2 c6 eb 7f 60 fb 45 5d 26 ef 8a 77 fe 00 1c ee de 2c f7 73 70 4f 64 d7 d9 47 f5 97 92 fc f6 0c 5e dc 45 f2 9f b2 fb 8b 8e 00 e0 22 9e 95 e4 df a5 df 63 17 c9 17 93 fc e5 29 2e 46 92 fc e9 24 bf 39 83 17 79 48 Data Ascii: 8T<~vu38`>;]<C\'y\|ULi+#$zQ<u\k`ow]_KG<xI0qw[Y/$cW .fbZp'kDp`E]&w,spOdG^E"c).F$9yH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49769	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:15 UTC	389	OUT	GET /twenty/flop/eGl8WIUk.png HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:15 UTC	461	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 23:21:15 GMT Content-Type: image/png Content-Length: 17558 Last-Modified: Mon, 13 May 2024 10:22:33 GMT Connection: close ETag: "6641e9e9-4496" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-15 23:21:15 UTC	3635	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 44 2b 49 44 41 54 78 5e ed 9d 05 98 14 c7 d6 86 21 01 12 20 b9 97 d8 fd 63 24 84 10 bf 10 b9 b9 37 09 ee 04 77 12 42 08 c1 dd 65 71 58 60 59 d6 61 97 65 71 0f ee ee ee 96 e0 2e c1 dd 82 db f9 bf 53 5d 0b 1b 68 60 77 b4 7b e6 bc cf f3 3d b3 33 d3 d3 5d 5d 55 e7 db aa ea ea ea 64 82 90 10 22 4a 01 fd e3 de bd 7b 1f 42 d9 a1 e2 d0 2f 50 23 a8 07 34 1c 5a 00 6d 83 0e 40 87 a1 13 d0 59 e8 32 74 1d bf 57 f0 df fa 33 fe ee 24 c4 db f2 6f f8 b7 bc 0f de 17 ef 93 f7 5d 19 e2 63 f1 31 3f c4 cf ff 01 a5 d0 c9 12 04 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsodD+IDATx^! c$7wBeqX`Yaeq.S]h`w{=3]]Ud"J{B/P#4Zm@Y2tW3$o]c1?
2024-05-15 23:21:15 UTC	4096	IN	Data Raw: 78 0e 1c 58 6e 70 f6 02 cb bc 60 58 dc aa e2 2b 81 91 75 0b a8 2e 1d 77 ed b8 75 65 66 46 89 d5 91 45 bd d4 7e d6 8e 6c ab ba 88 3c ae c5 33 e4 cd 8e ef 0e 19 86 55 53 e7 aa e0 49 e0 1d 9e bd 31 1a 07 7c 1e da a5 8f 2f 78 10 4f 1a 16 1f 83 8d 84 5b 55 d3 23 6b a9 16 d5 89 65 49 eb 02 3e 4d dc 52 3b 34 3f 82 46 77 f9 59 b5 b6 6a e6 7e df 23 e7 26 86 e5 3d e0 1d 7b 20 cf 5d 31 c4 c1 7e d4 c7 16 3c 8c a7 ba 84 3c 11 94 e7 4d c5 34 2a aa af 02 c6 a9 56 91 99 e9 38 2b 36 42 6e 6d ad 1f d5 8e 42 6b e6 a3 5a 30 c9 3a 6e be a5 47 ba 84 de 05 1e 52 51 db 89 7b c1 b1 58 8b d5 51 05 8f e3 6e c3 e2 7b ff b8 55 d5 b9 52 56 9a 17 db 50 8d 37 b9 ba 55 f5 38 71 6b eb c8 c2 5e 34 39 b4 3a 05 94 f9 0a e9 78 cf 6d dd 44 31 2c ef 02 c3 5a 82 17 ed 2a 6e 04 07 ca 0e dd 31 0e Data Ascii: xXnp`X+u.wuefFE~l<3USI1\|/xO[U#keI>MR;4?FwYj~#&={ ]1~<<M4V8+6BnmBkZ0:nGRQ{XQn{URVP7U8qk^49:xmD1,Zn1
2024-05-15 23:21:15 UTC	4096	IN	Data Raw: 74 60 6e 38 f6 d5 83 76 4d 0d 52 06 b9 e9 b7 b6 b4 66 70 0b 5a d9 bf 29 2d 8f 6b ac d2 b0 20 ba 2e 5a 80 ff 76 ba 35 65 26 31 2c fb c1 5e c5 86 25 d3 1a 6c 84 3b 0d 8b 5b 58 8b 62 ea d3 aa 01 cd 68 45 3f c3 b4 58 cb e2 1a d1 b2 3e 8d 0c 13 83 a1 ac 42 cb 67 ed e0 96 b4 7e 58 00 6d 84 99 fd 31 ba bd 32 34 36 9e 6d 13 03 69 c7 a4 ae b4 7d 62 17 da 36 a1 b3 fa ec 8f 31 1d 60 48 ed 68 03 ba 9c eb 86 b6 52 c6 a4 8e d1 df 38 86 da 3f 14 7f 3c 3e 36 7f bf a8 77 7d 35 45 21 29 83 e9 89 95 18 96 fd 60 af 62 c3 92 89 a3 36 c2 93 86 65 a6 78 53 51 d2 46 13 6f 68 4a 6c 3c 7f fb bc e1 fd cf 8d ef 12 fc 1e 32 3b 06 4b 0c 4b 78 18 f6 2a 36 2c b9 35 c7 46 78 db b0 3c 25 31 2c e1 61 e0 55 ea d6 9c cd fa bd 60 03 dc 6d 58 0b a3 eb a9 6e 9f 99 89 78 52 9c 86 85 31 f5 c4 b0 Data Ascii: t`n8vMRfpZ)-k .Zv5e&1,^%l;[XbhE?X>Bg~Xm1246mi}b61`HhR8?<>6w}5E!)`b6exSQFohJl<2;KKx*6,5Fx<%1,aU`mXnxR1
2024-05-15 23:21:15 UTC	4096	IN	Data Raw: 60 0f 81 be d1 b6 e2 5e 70 20 db 3d e9 f1 e8 99 cb 6a 90 52 c6 46 12 29 74 03 4b 75 19 43 83 e6 6c 32 c6 b0 dc dd e2 c9 1a a0 e6 7d f1 fc 2f e9 b6 27 52 68 95 7e dd b0 3f dd ba 73 47 d7 72 fb 00 0f 99 af ed c4 fd e0 60 a5 f5 71 6d c3 86 bd c7 d5 40 b2 47 6f e6 b5 b3 d0 12 fd ac 76 1f 35 f0 ee f6 95 3f f5 94 86 7e 33 37 d0 0f c1 13 64 4a 43 62 85 32 7a b7 4a 4f fa eb da 4d 5d cb 6d 45 39 6d 27 ee 07 86 c5 ab 91 6e d5 07 b6 05 7c 43 ad 2a 64 99 d2 90 38 e9 b5 d5 f9 aa 9d db d7 56 d7 53 1a 26 f3 94 86 fa 7d 65 4a 43 62 95 af 03 bd 82 32 3a 7f d9 5e b7 e8 c0 3b b6 b3 87 68 3b f1 0c 38 60 6d 7d 7c 5b 30 77 c3 3e e3 3f b9 18 56 e2 84 16 55 fc d3 6b b2 d4 75 f3 52 2f 32 a5 c1 31 21 9f d2 94 0a a2 fd 27 ce eb 5a 6e 0f e0 1d 75 b5 8d 78 0e 1c 34 0d b4 4b a7 c1 f2 Data Ascii: `^p =jRF)tKuCl2}/'Rh~?sGr`qm@Gov5?~37dJCb2zJOM]mE9m'n\|C*d8VS&}eJCb2:^;h;8`m}\|[0w>?VUkuR/21!'Znux4K
2024-05-15 23:21:15 UTC	1635	IN	Data Raw: 21 f1 f4 da b4 e9 d5 cf 1a c7 f5 4a 57 3e e4 a6 cb ba 89 39 db 50 81 b6 fc b0 12 03 bb 18 96 ba 0d 85 5b 40 ee 92 d9 31 ad a2 87 0c 8b c9 df 7a b8 6b ca 4c 77 ff d2 95 0b b9 f5 59 e3 be d1 7d 56 ae 7c 4d 57 3f 41 70 8c d2 11 63 be c9 54 a7 cf 24 35 e1 b4 68 77 e7 8c 0b 86 55 bc d3 28 5d ed 6d 64 58 fe 2c 13 c3 2a da e1 37 55 96 a6 db 27 46 5c 87 50 97 b8 4e a1 6e 4d 2e 15 35 f6 5b 5d dd 04 c1 35 e4 0e 1c 55 24 7d f5 98 15 a9 cb 3a 31 be 95 a3 35 95 ed c6 ab 7f 18 88 61 d9 40 26 86 55 a6 eb 58 e3 41 14 66 db 3f 49 7a 9c 8a eb 10 d7 a5 5c 9d 46 16 d5 d5 4b 10 5c 0f ea ea 33 df b6 1a 52 ed f5 5f 7a ee 49 59 1a c6 55 88 27 9d 9a 54 cc c7 29 7b 6b fa 29 64 a2 51 eb 81 18 96 0d 64 62 58 3f 87 4e 52 65 69 ba bd 99 b8 8e a0 ae 70 9d 79 bd 4a d4 5e 9e 53 85 dd c8 Data Ascii: !JW>9P[@1zkLwY}V\|MW?ApcT$5hwU(]mdX,*7U'F\PNnM.5[]5U$}:15a@&UXAf?Iz\FK\3R_zIYU'T){k)dQdbX?NReipyJ^S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49770	146.190.157.18	443	5300	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 23:21:15 UTC	641	OUT	GET /favicon.ico HTTP/1.1 Host: claytonobrien.autos Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://claytonobrien.autos/twenty/flop/?moontBxm3SRH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FirstTimer=1
2024-05-15 23:21:15 UTC	166	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 May 2024 23:21:15 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding
2024-05-15 23:21:15 UTC	548	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 1704, Parent PID: 6024

General

Target ID:	0
Start time:	01:21:03
Start date:	16/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5300, Parent PID: 1704

General

Target ID:	2
Start time:	01:21:05
Start date:	16/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2248,i,7522220006484712116,13690273053960303007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6460, Parent PID: 6024

General

Target ID:	3
Start time:	01:21:08
Start date:	16/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://claytonobrien.autos/twenty/flop/?moontBxm3SRH"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://claytonobrien.autos/twenty/flop/?moontBxm3SRH

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Windows Analysis Report
https://claytonobrien.autos/twenty/flop/?moontBxm3SRH