Edit tour

Windows Analysis Report
weekly-finances-report.xlsx

Overview

General Information

Sample name:	weekly-finances-report.xlsx
Analysis ID:	1545474
MD5:	f5b20f951569b6c6e6f0e398b692512c
SHA1:	cb5c3731d3e1a534501df6df842983a97426a95d
SHA256:	eab6f5d40791e2ef277809112b588028237e7ed0d769a0f9735fe29c2adaaaf5
Infos:

Detection

KnowBe4

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected KnowBe4 simulated phishing

Contains an external reference to another file

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3336 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

chrome.exe (PID: 3608 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 3780 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1212,i,1849172356153250680,5987038015233001814,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1404 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_100	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Sigma Signatures

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 52.72.176.27, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3336, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49162

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49162, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3336, Protocol: tcp, SourceIp: 52.72.176.27, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3336, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_100, type: DROPPED

Source: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==

HTTP Parser: No favicon

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3608_1026345083	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 52.72.176.27:443 -> 192.168.2.22:49162 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 199.232.192.193 199.232.192.193
Source: Joe Sandbox View	IP Address: 199.232.196.193 199.232.196.193

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4892A8F5.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /XRFZaREExRTA0Wko4MHRSeXFnWEhUUW5oNEF5cFdzN1RvN3dzVzlMWHdHdzlma2Jjc1BNYnNEc1g0WXJQYy9JSWlFVUpIbDE4cGdMcDBLdk54bEZydEJqRTBYdFpoeDZHUGtwZ0tTaVZ3cWZjL2ppVG5KQks1RE0xU21IUzd3PT0tLXVERnZSL2NmN25kNkovUUEtLUIxb3JrOUhOcUxJS1puMmpQNU5DN1E9PQ==?cid=2262276963 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: token.onelogin.com-token-auth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963 HTTP/1.1Host: token.onelogin.com-token-auth.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /helpimg/landing_pages/css/dd.css HTTP/1.1Host: s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1Host: cdn2.hubspot.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /QRF01zv.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: token.onelogin.com-token-auth.com
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: cdn2.hubspot.net
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 14:53:01 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 5dea109c-91de-41ac-8417-193cf15c55d5X-Runtime: 0.012093Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 14:53:01 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 83b81354-4f93-44e6-9127-bc453b7348fcX-Runtime: 0.011320Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 14:53:01 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: b5b98189-7538-4a33-a893-bdb834a454b0X-Runtime: 0.016110Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 14:53:02 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: d0786649-de60-49ab-a759-38873ef78c11X-Runtime: 0.014256Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 14:53:02 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeX-Frame-Options: SAMEORIGINX-XSS-Protection: 0X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneReferrer-Policy: strict-origin-when-cross-originCache-Control: no-cacheContent-Security-Policy: X-Request-Id: 4043fdf1-8209-4be4-b50c-fab093f3a264X-Runtime: 0.011199Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Source: chromecache_98.5.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_100.5.dr	String found in binary or memory: http://officeblogswest.blob.core.windows.net/wp-content/2014/01/OneDrive-forBiz_rgb_EN_Blue.png
Source: chromecache_100.5.dr	String found in binary or memory: http://preview.training.knowbe4.com/XcFVHWU14OFp6MDBNbWFIVExzQ0JJWDZzV1RkM1ZXdnFMK2dTRGsyNDFLblpueTd
Source: chromecache_100.5.dr	String found in binary or memory: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Source: chromecache_100.5.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_100.5.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Open
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5OaVI
Source: chromecache_93.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVI
Source: chromecache_98.5.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_100.5.dr	String found in binary or memory: https://i.imgur.com/QRF01zv.png
Source: chromecache_100.5.dr	String found in binary or memory: https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Source: chromecache_95.5.dr	String found in binary or memory: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVW

Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown

HTTPS traffic detected: 52.72.176.27:443 -> 192.168.2.22:49162 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.evad.winXLSX@20/51@25/9

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$weekly-finances-report.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRB78B.tmp

Jump to behavior

Source: AA830000.0.dr

OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1212,i,1849172356153250680,5987038015233001814,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1212,i,1849172356153250680,5987038015233001814,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AA830000.0.dr

Initial sample: OLE zip file path = xl/media/image1.jpg

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3608_1026345083	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: AA830000.0.dr

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Contains an external reference to another file

Source: drawing1.xml.rels

Extracted files from sample: https://token.onelogin.com-token-auth.com/xrfzareexrta0wko4mhrsexfnwehuuw5onef5cfdzn1rvn3dzvzlmwhdhdzlma2jjc1bnynnec1g0wxjqyy9jswlfvupibde4cgdmcdbldk54bezydejqrtbydfpoedzhugtwz0ttavz3cwzjl2ppvg5kqks1re0xu21iuzd3pt0tlxvernzsl2nmn25knkovuuetluixb3jrouhocuxjs1pummpqnu5dn1e9pq==?cid=2262276963

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
cdn2.hubspot.net	104.18.90.62	true	false	unknown
s3.amazonaws.com	16.15.176.94	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
secured-login.net	3.93.255.10	true	false	unknown
landing.training.knowbe4.com	52.72.176.27	true	false	unknown
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	unknown
i.imgur.com	unknown	unknown	false	unknown
token.onelogin.com-token-auth.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://secured-login.net/assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js	false	unknown
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css	false	unknown
https://secured-login.net/packs/js/vendor-69f70dd3792dc7287ac8.js	false	unknown
https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css	false	unknown
https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	unknown
https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png	false	unknown
https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==	false	unknown
https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css	false	unknown
https://secured-login.net/favicon.ico	false	unknown
https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963	false	unknown
https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js	false	unknown
https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	unknown
https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css	false	unknown
https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png	false	unknown
https://i.imgur.com/QRF01zv.png	false	unknown
https://token.onelogin.com-token-auth.com/XRFZaREExRTA0Wko4MHRSeXFnWEhUUW5oNEF5cFdzN1RvN3dzVzlMWHdHdzlma2Jjc1BNYnNEc1g0WXJQYy9JSWlFVUpIbDE4cGdMcDBLdk54bEZydEJqRTBYdFpoeDZHUGtwZ0tTaVZ3cWZjL2ppVG5KQks1RE0xU21IUzd3PT0tLXVERnZSL2NmN25kNkovUUEtLUIxb3JrOUhOcUxJS1puMmpQNU5DN1E9PQ==?cid=2262276963	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://getbootstrap.com)	chromecache_98.5.dr	false	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_98.5.dr	false	unknown
http://preview.training.knowbe4.com/XcFVHWU14OFp6MDBNbWFIVExzQ0JJWDZzV1RkM1ZXdnFMK2dTRGsyNDFLblpueTd	chromecache_100.5.dr	false	unknown
https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVW	chromecache_95.5.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
199.232.192.193	unknown	United States	54113	FASTLYUS	false
52.72.176.27	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
104.18.90.62	cdn2.hubspot.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.93.255.10	secured-login.net	United States	14618	AMAZON-AESUS	false
16.15.176.94	s3.amazonaws.com	United States	unknown	unknown	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545474
Start date and time:	2024-10-30 15:51:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	weekly-finances-report.xlsx
Detection:	MAL
Classification:	mal52.phis.evad.winXLSX@20/51@25/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963 Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, vga.dll, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.186.110, 142.250.185.78, 172.217.218.84, 142.250.185.206, 34.104.35.123, 216.58.212.138, 142.250.186.99, 142.250.185.131
Excluded domains from analysis (whitelisted): fonts.googleapis.com, clients2.google.com, redirector.gvt1.com, accounts.google.com, edgedl.me.gvt1.com, fonts.gstatic.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, officeblogswest.blob.core.windows.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: weekly-finances-report.xlsx

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
199.232.192.193	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse
	http://solidgdrive.glitch.me/gdry/edix/list.html?e=Dale.Hardy@40kwc.com	Get hash	malicious	Unknown	Browse
	Import_Declainvoice.htm	Get hash	malicious	Unknown	Browse
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse
	https://steamcommunity-success.com/gift-card/9376695162	Get hash	malicious	Unknown	Browse
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse
	https://steamcommunity-success.com/gift-card/9376695162	Get hash	malicious	Unknown	Browse
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse
52.72.176.27	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse
	https://mail.kb4.io/XV2pCbFUvdkZ0U1V3cHZQWXpqL3hjTU9wcmY4ZmEyNXZRWTRiU1VvMTVwRnRrYWdnVjdlM0lLQ3VmVXlCSlpGdkkvQUNJWjZLaHpVWnRmYjY0VktjbmJLUFlpV0xzWTVEdkJsa1hrWXY0dGZHMUNoclZ3aDRORWlpQlNhTlpLSy9pdXMwQXozSHVrYSthQnJrS2J6T0EvSVBMYUFYRG1EZ254WlBRUGdyZU55TkdBZjB0aWhCMFdIN081T2RsdFFIMVpIdFAvU2Q2NXlLKzNJY1JZQ1JNMTBwaDlZPS0tNE01L0hRZXp6Tm50TW1MTS0tSlkrYWNuVllJcXZpelZWZ2ppaVRSdz09?cid=2260646675	Get hash	malicious	Unknown	Browse
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse
199.232.196.193	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse
	http://solidgdrive.glitch.me/gdry/edix/list.html?e=Dale.Hardy@40kwc.com	Get hash	malicious	Unknown	Browse
	https://www.evernote.com/shard/s512/sh/13954171-1260-d858-de69-06ffb19cd62f/IpXIE2ZoTfkUL7pCMibo1Wvq-pGORrIcZV-gRtF0-ppZOJhbsY-7OG4AYQ__;!!A-_UObntj2w!TCF-dwwxew6_4xwX0vz37obzz_Nme89BLzz0LCDHIEcMt0H-fDdV9LeqXfzP36mva0iIJhqBnntAwfDFEkCvUyHvgSgA8Q$	Get hash	malicious	HTMLPhisher	Browse
	https://temp.farenheit.net/XL1VkZE1FVGZjL0VwUUt5cWc4dkk1SWpqVFFTMUtQZ0krRFhobktOS05RSWpVMTZIYzk3b3hOUTBoZ2VYdnAzM21wZnYwMVBmdGN0MW12M09qVmMzbnNVeVpkeXBxeHVGd2V4eDRvVlZ5dERsakpjbGV3ZVZxRVhlZ0F6Q3hwQlptYUUyRFhHRzY3YkRXQ3hjWmhBZDBpMkNpakJDSnhzUG9xa2k2ZkdacVpDZVhFVFppeUJLcHJIaC0teVVJeERBTFd0K3k3b01rYS0tRk9zSWNIVEd0blVHZVlhTlFnVUxldz09?cid=2242420613	Get hash	malicious	Unknown	Browse
	Import_Declainvoice.htm	Get hash	malicious	Unknown	Browse
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse
	https://click.pstmrk.it/3s/tldr.tech%2Fconfirmed%3Femail%3Djames.ward%2540gerflor.com%26newsletter%3Dinfosec/pEGE/grO4AQ/AQ/de2d9b1d-a87c-40b3-97e7-314a53573877/2/GfrX-GFLqn	Get hash	malicious	HTMLPhisher	Browse
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse
	https://steamcommunity-success.com/gift-card/9376695162	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
secured-login.net	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	34.199.167.68
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	18.232.196.105
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	54.156.128.231
	https://mail.kb4.io/XV2pCbFUvdkZ0U1V3cHZQWXpqL3hjTU9wcmY4ZmEyNXZRWTRiU1VvMTVwRnRrYWdnVjdlM0lLQ3VmVXlCSlpGdkkvQUNJWjZLaHpVWnRmYjY0VktjbmJLUFlpV0xzWTVEdkJsa1hrWXY0dGZHMUNoclZ3aDRORWlpQlNhTlpLSy9pdXMwQXozSHVrYSthQnJrS2J6T0EvSVBMYUFYRG1EZ254WlBRUGdyZU55TkdBZjB0aWhCMFdIN081T2RsdFFIMVpIdFAvU2Q2NXlLKzNJY1JZQ1JNMTBwaDlZPS0tNE01L0hRZXp6Tm50TW1MTS0tSlkrYWNuVllJcXZpelZWZ2ppaVRSdz09?cid=2260646675	Get hash	malicious	Unknown	Browse	52.72.176.27
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	54.159.215.66
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://temp.farenheit.net/XL1VkZE1FVGZjL0VwUUt5cWc4dkk1SWpqVFFTMUtQZ0krRFhobktOS05RSWpVMTZIYzk3b3hOUTBoZ2VYdnAzM21wZnYwMVBmdGN0MW12M09qVmMzbnNVeVpkeXBxeHVGd2V4eDRvVlZ5dERsakpjbGV3ZVZxRVhlZ0F6Q3hwQlptYUUyRFhHRzY3YkRXQ3hjWmhBZDBpMkNpakJDSnhzUG9xa2k2ZkdacVpDZVhFVFppeUJLcHJIaC0teVVJeERBTFd0K3k3b01rYS0tRk9zSWNIVEd0blVHZVlhTlFnVUxldz09?cid=2242420613	Get hash	malicious	Unknown	Browse	3.221.165.56
	https://report-scam.malwarebouncer.com/XOHNZUWRVSkNPN3B3b0dyakdQVFVmb1FYdjkxSFkwYVlNbnhFS1hyOVg0UkpoZzNZd04zaWh2UTZ0RE13ZGV6SklWLzhFZ20wYTNPenFQbzZBUHRIWFMvcVNMc0dvZDRsUU93QlNUckovcGQ4SXFlblYvcjhsWVo2RGxhdTNIc3pvNWZDcHU4T1NHa1hBR1V2MGtpUGthRjJudk1GSFowOFdHeVZsVzZSS2hXWlRvOGpZZERIZzVVZnFRPT0tLXFVZ29kckVLdmlIVEc3a08tLS9GWUhhdmh2L3BXNkN3ZzVhSlczWVE9PQ==?cid=2249425773	Get hash	malicious	Unknown	Browse	184.72.144.180
	https://cnn.compromisedblog.com/XSTc5bEY5TVlBdTVyb1pVN0hFNzRzNW9PLzZnLzZxbzBqeUt5RTBtTFUzNjczOGNsMlB3NURuWjF2cStpdXN2ZmYzWUI3TVZGWWtqcFlEem9nNlUvTHJCeEZ0VTZ2SzFDN2dEd2Zxb0FUOHFmUHR3UjJZMURHOEhveUd6TThqUnhvTVhpbURLMndDemhZY3FteFBZKzZwWmpMV2x3aUJWdzRGZG5IdkdIRnhoTmRTdnZlNE1IUHBCZTdnPT0tLXNnRktmT2VjaXgyVExmS1MtLTFRRWd4cnRWcS9ZQzljNE53S2tBdEE9PQ==?cid=2231760484%3E%20%5Bhttps://cnn.compromisedblog.com/XYmtrY2hhSzZlK09tNXhxSGoxMW1vSjFJdDVrN1N5eUxwQW9WcG9uL2V0NVRyUDhZenRQUWFpcUVhREJWVDV2Uk1FOVZEejMyN0llRU5WRHVvU2Z3eTAyY1NaLzNyS2VCaWdHcWJrRXFWUGdGNVpHbU9ZTUllQT09LS0wQmJWUGFlMUwwMDlHQjJhLS1rbmRxUmNwNVFZSHg3ajFPRVR2Z2dBPT0=?cid=2231760484	Get hash	malicious	HTMLPhisher	Browse	3.227.77.167
	survey.pdf	Get hash	malicious	PDFPhish	Browse	3.225.17.203
s3.amazonaws.com	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.216.218.136
s3.amazonaws.com	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	54.231.236.168
cdn2.hubspot.net	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.18.87.62
	https://mail.kb4.io/XT0VNMzRJS3djRnBKZnFha1JaVThBUHFHRmpuS2FmSUY4aUszUlY3Sm0rWmpyUWR3ekQzL2xjN0xhVVJlTzhvZzgyMGtTUkxmSWtGdWlUY2I0NStmRWlLS2xHcGZsNTZUN3VyanNiKzVaNjhaeTRSTXFXVGdwc0J4amUxRFFPMU5DTTd5ejl5aXZxUlBwL1NDaDBRSk9DWVJkc09KRUZodTl0SFh5bFVVWEdYZTMzcm5ZTCtCSGpmZWRIMEprQjhiZExvOE9wSGkwUS9KTjQwSVdjQT0tLVBNYWNLTzcyT0xCdDkzb3ItLURlVmNvdGI3d3BGenM5UWJzc1EreXc9PQ==?cid=2260646675	Get hash	malicious	Unknown	Browse	104.18.90.62
	https://mail.kb4.io/XV2pCbFUvdkZ0U1V3cHZQWXpqL3hjTU9wcmY4ZmEyNXZRWTRiU1VvMTVwRnRrYWdnVjdlM0lLQ3VmVXlCSlpGdkkvQUNJWjZLaHpVWnRmYjY0VktjbmJLUFlpV0xzWTVEdkJsa1hrWXY0dGZHMUNoclZ3aDRORWlpQlNhTlpLSy9pdXMwQXozSHVrYSthQnJrS2J6T0EvSVBMYUFYRG1EZ254WlBRUGdyZU55TkdBZjB0aWhCMFdIN081T2RsdFFIMVpIdFAvU2Q2NXlLKzNJY1JZQ1JNMTBwaDlZPS0tNE01L0hRZXp6Tm50TW1MTS0tSlkrYWNuVllJcXZpelZWZ2ppaVRSdz09?cid=2260646675	Get hash	malicious	Unknown	Browse	104.18.89.62
	https://temp.farenheit.net/XL1VkZE1FVGZjL0VwUUt5cWc4dkk1SWpqVFFTMUtQZ0krRFhobktOS05RSWpVMTZIYzk3b3hOUTBoZ2VYdnAzM21wZnYwMVBmdGN0MW12M09qVmMzbnNVeVpkeXBxeHVGd2V4eDRvVlZ5dERsakpjbGV3ZVZxRVhlZ0F6Q3hwQlptYUUyRFhHRzY3YkRXQ3hjWmhBZDBpMkNpakJDSnhzUG9xa2k2ZkdacVpDZVhFVFppeUJLcHJIaC0teVVJeERBTFd0K3k3b01rYS0tRk9zSWNIVEd0blVHZVlhTlFnVUxldz09?cid=2242420613	Get hash	malicious	Unknown	Browse	104.18.90.62
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	104.18.89.62
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	104.18.91.62
	survey.pdf	Get hash	malicious	PDFPhish	Browse	104.18.88.62
	COVID-19.pdf	Get hash	malicious	PDFPhish	Browse	104.18.87.62
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	104.18.90.62
cdnjs.cloudflare.com	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.17.24.14
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.24.14
	401K .pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	104.17.24.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	104.18.91.62
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.145.203
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	162.247.243.29
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.53.206
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.140
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.142.84
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
FASTLYUS	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	199.232.196.193
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	199.232.196.193
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	151.101.1.140
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	151.101.1.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	151.101.193.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
FASTLYUS	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	199.232.196.193
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	199.232.196.193
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	151.101.1.140
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	151.101.1.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	151.101.193.229
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
AMAZON-AESUS	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	3.93.255.10
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	18.232.196.105
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	18.205.222.128
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	52.71.28.102
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	3.211.113.112
	Order pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	3.5.20.124
	Proforma Fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	3.5.16.19
	LJSS65p4Kz.elf	Get hash	malicious	Unknown	Browse	44.221.131.90
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	54.55.230.199
	v6pwbOEUpl.elf	Get hash	malicious	Unknown	Browse	54.54.116.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	PO.2407010.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	52.72.176.27
	PO-004976.xls	Get hash	malicious	Unknown	Browse	52.72.176.27
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	52.72.176.27
	PO-004976.xls	Get hash	malicious	Unknown	Browse	52.72.176.27
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	52.72.176.27
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	52.72.176.27
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	52.72.176.27
	0001.xls	Get hash	malicious	Remcos	Browse	52.72.176.27
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	52.72.176.27
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	52.72.176.27

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 120x120, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Pixelmator 3.7, datetime=2018:06:20 16:06:96], baseline, precision 8, 900x600, components 3
Category:	dropped
Size (bytes):	199612
Entropy (8bit):	7.754253205423156
Encrypted:	false
SSDEEP:	6144:XDNWpdFg6GS5ldaIbrPT7hpQocgXNoA1d/m:XeP5ldBr/17NoAPO
MD5:	9A9635D19B7B520C04FFF32119871A9F
SHA1:	0DDAA7C506D715261801F84BD61166B1E8A2AE1A
SHA-256:	E69FBD5C12CAE00963D3FBFD0AC8BF7D72CE4AFD0E92AD0679C2AA1CA31A5A40
SHA-512:	5FF4E4E13E2694302F23ECF29A229CA0BC9D83D9C2FC6668B9B9F5FD72E63DF04E33E3F06FA30C19CBB0F2A6086A39CECBC17013D6B585ECCB9E0B5FB1C2443D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.....x.x......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................x.......x....Pixelmator 3.7..2018:06:20 16:06:96......................................X........http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmp:CreatorTool="Pixelmator 3.7" xmp:ModifyDate="2018-06-20T16:06:96"/> </rdf:RDF> </x:xmpmeta>

C:\Users\user\Desktop\AA830000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	211666
Entropy (8bit):	7.736594193246184
Encrypted:	false
SSDEEP:	6144:tFDNWpdFg6GS5ldaIbrPT7hpQocgXNoA1d/XSn6:tFeP5ldBr/17NoAP1
MD5:	F0529AC95AF27E1995C9295FD88BE34F
SHA1:	0E2ABFB3FD4C97A85AE2F53DFD7102ECBDE5C61B
SHA-256:	A6223AE5CBBEC3645804B333E311911AC1B65E70FBEB4299770A627A2453B533
SHA-512:	6200FB9FA401BDE9C27E8C52EAA005731A1DABD60E8868EDDFE0C3DA43E8F5B42FA7BF8D2655CCEC0635ADB2A17A7913F7422E3D05B15B9625FE86CB28366561
Malicious:	false
Reputation:	low
Preview:	PK..........!.kG.....K.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U.j.0.....F.b+I...'.>.m......V"KBR^....'!$.^,...]...p..d....r..:$.Uh.T....[.H...Lj.9Y.#...M..2...V.'...RW..0.i..wJm....V.b...N..ZyP>...../P.........X..$......f.......cI7..f..W...P....a.0.....D.......v....Y...TN.....~k=.....R..u1k.i.3..w5.od..aBmK=.....K..BB}..L.......tx....y..D.....J..r.k.S.5..?.Es.....'tp..A..\....1^.....Y8..[w..A .^....~..y>..@.f.....`........PK..........!..U0#....L......._rels/.rels

C:\Users\user\Desktop\AA830000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\weekly-finances-report.xlsx (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	211666
Entropy (8bit):	7.736594193246184
Encrypted:	false
SSDEEP:	6144:tFDNWpdFg6GS5ldaIbrPT7hpQocgXNoA1d/XSn6:tFeP5ldBr/17NoAP1
MD5:	F0529AC95AF27E1995C9295FD88BE34F
SHA1:	0E2ABFB3FD4C97A85AE2F53DFD7102ECBDE5C61B
SHA-256:	A6223AE5CBBEC3645804B333E311911AC1B65E70FBEB4299770A627A2453B533
SHA-512:	6200FB9FA401BDE9C27E8C52EAA005731A1DABD60E8868EDDFE0C3DA43E8F5B42FA7BF8D2655CCEC0635ADB2A17A7913F7422E3D05B15B9625FE86CB28366561
Malicious:	false
Reputation:	low
Preview:	PK..........!.kG.....K.......[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U.j.0.....F.b+I...'.>.m......V"KBR^....'!$.^,...]...p..d....r..:$.Uh.T....[.H...Lj.9Y.#...M..2...V.'...RW..0.i..wJm....V.b...N..ZyP>...../P.........X..$......f.......cI7..f..W...P....a.0.....D.......v....Y...TN.....~k=.....R..u1k.i.3..w5.od..aBmK=.....K..BB}..L.......tx....y..D.....J..r.k.S.5..?.Es.....'tp..A..\....1^.....Y8..[w..A .^....~..y>..@.f.....`........PK..........!..U0#....L......._rels/.rels

C:\Users\user\Desktop\~$weekly-finances-report.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2164)
Category:	downloaded
Size (bytes):	67300
Entropy (8bit):	6.136507658415569
Encrypted:	false
SSDEEP:	1536:dfOPSmaCJuuqJ0+GutFIDFzFv7aaXVVoi7fyPw+uzukA13k:5isYjZ
MD5:	F8423D7E960F8D5C12564CA8895E92FC
SHA1:	48D594F14B2482FF367DF5D7AB82EF18D6801F6C
SHA-256:	D21D15052544410F779574395DE4F2EDA3D41983C77F12348C0DA9EB5A69728B
SHA-512:	041F827DB8DA8F5084E48CCC14E1AAD5115F15C61BACD608065B0F8614CC08CFF0D800FD923A12E8B75F896503E1C52D18FA95C3CB83D69E09A4A556CBC9C048
Malicious:	false
URL:	https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />. <link rel="stylesheet" href="/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css" media="all" />.. <script>.//<![CDATA[.. $(document).ready(function() {.

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
URL:	https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15368, version 1.0
Category:	downloaded
Size (bytes):	15368
Entropy (8bit):	7.986184968554377
Encrypted:	false
SSDEEP:	384:nTJg6Q5K8YWSW9moijiyOckZiSFQsiEVxU1L:nTJH0K7iUoaOfZigxBe
MD5:	BE7B70AB1265B1047BD93422397C655E
SHA1:	E10BBC7D8529AE3E64D8B08C9F7CD55C98F83D60
SHA-256:	B452C0F212E8BF33965905032F5BA1FAE29CD6F9539DCBC673704E66CE943B2B
SHA-512:	A9A913559EFE29685B7C12456326C3F8C7053D639B849261108A69348EEA02C617BA923561C1CDBE36082B2CEC1C0ADCC22511389791DB328ABC99A57F011F5A
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVIGxA.woff2
Preview:	wOF2......<.......x0..;...........................>..\..\|.`?STAT^..J..\|........\.i.....6.$..,. ..x........l..]{N..#R.-...0.Q.%.T.......Q...U...L..R.)KFQ0.)p..L%d......!3..;..v8..9.........A..'..........v5D80.......&...M...}....g.6.'N..M.y......gk....B.{....}.....q>j...].......o!..AL....b.....f......F..FE,@.Q..cF..6n....g.....Ey..O....^.3...P.)U...AH.y..Z...'%.?8/.......T.S............S..8.w 7..>`.5...........0#.._..(_.P.W....s=......i+i.....`Dn.)k.$.....G...]..=.....w.....n..\|."..4.g.....H.2M..P.(oRg..l~G..dJ.<.U..q..u..4%......<...`.-$.....$[..".....TuM.V..7.[.{.l.. ,....>.&...P9].....S.lg.B.tK..B..\..z..RS.i....3.D."u..Bz..T.E^R.=m...U.\.X...IZ....n]....]...}i.......K.kL.D.6.".5..V..u.....?...\|.a.=.;..0..cL..HpU..t.p)1.k.....^G..:.u.q(E.Q5.o.k.1.0..R....c..`.....A..3.g.0&....$....\| .....C.H....(..F.. .::.......&.$Z4...$N....$.<.%.A6..y.1.?.......w...}....~$....V..Q......x..A'......+...I<n. .......t@...w$ ...@...9..H.h..B...Q

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Y/B:Y/B
MD5:	D8F4A1993546CC4B850CDE3599E27AEC
SHA1:	094B763B4CFCC0B05E5D040581CD513C3CA08067
SHA-256:	907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
SHA-512:	7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
Malicious:	false
URL:	https://secured-login.net/packs/js/vendor-69f70dd3792dc7287ac8.js
Preview:	not found

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5934
Entropy (8bit):	4.931906350831601
Encrypted:	false
SSDEEP:	96:fiIg+VsCy59sZUAcYLoX9U0JePXOBaxAzi80JeaOV7Fzu/B3qn6dk/nGgje/mPFd:fiP+VbyPsZxcYLot7SXsaCQuu/Nq66/v
MD5:	134D934420B13974981A9634B7380865
SHA1:	18C01D3711CF8C21C1CD0CF544002358C1C929C6
SHA-256:	B3C447F15FCE33DFA869B9D2190364509EDE3937AE05B51BA394A78E28C244BA
SHA-512:	7FAE93AD1895DCF7CC58FC2C477BA51D3EB7D7B2884FE117E21C0A7E0160981EB53D23A6ACDA07DA594AF6984F52E1B57B6F157F84220729C7EEBF9AE062C092
Malicious:	false
URL:	https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css
Preview:	/* line 2, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag {. border-bottom: 2px solid tomato;. padding-left: 3px;.}../ line 6, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag::before {. content: ' ';. display: inline-block;. background: url(/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png) no-repeat;. background-size: contain;. height: 12px;. width: 12px;. margin: 0 .1rem;.}../ line 16, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true'] {. display: block;. border-bottom: 0px;.}../ line 21, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true']::after {. font-family: "Courier New", Courier, monospace;. line-height: 1.8;. color: #b65555;. font-weight: bold;. content: attr(data-original-title);.}../ line 29, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true']::before {. content: ' ';. display: inline-block;. background: url(/assets/dark-flag-2846d82c5

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18668, version 1.0
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.988119248989337
Encrypted:	false
SSDEEP:	384:1stcBfAVaR8i6XzMsb4fcjakBudFyBqrgeU0hipgwfqj09nOt/a:1k0F6Xz1bFjaPbyBqr9hIgkM3Fa
MD5:	8655D20BBCC8CDBFAB17B6BE6CF55DF3
SHA1:	90EDBFA9A7DABB185487B4774076F82EB6412270
SHA-256:	E7AF9D60D875EB1C1B1037BBBFDEC41FCB096D0EBCF98A48717AD8B07906CED6
SHA-512:	47308DE25BD7E4CA27F59A2AE681BA64393FE4070E730C1F00C4053BAC956A9B4F7C0763C04145BC50A5F91C12A0BF80BDD4B03EECC2036CD56B2DB31494CBAF
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
Preview:	wOF2......H...........H..........................\|.....h.`?STAT^..0..\|...........+..2..6.$..`. ..x........z'o..w;....6.E....6....E...'$H.#.....n1X..JU/.d.O..JC.'J".v.v.l.h.....u.S...SY.....B.hz.o.}......W......%m6...A..=....\..m. .]..~.[..........]...I..h.=.....6.xt..F....Lt...Qs-.7..{...~BI.".F.Q......F...P..dMw..#I2........Rq.Q&.0@.;..;...3VG..:c.nki..-Q..2##e.u...8n....\?....T..b....^..#...../.J\|OM..St....e.S.}!.....>..i.T/a.ES%.W.P3..`..a.R.A.....!~g..74.np8o.....d[6?.P.4)P.....AG.3.......;#0.y....M..O/2.@.4..N.vA$.:M&H,.AT".........@..a.~..L->...0@h...~.._..N"......t......C./g7..............2E.N.J...TW.F..."A.B...n.......i.?.{\.L.!.B..x...S..!........?.\,... .@.....y"xw.A8.w..!E..-^P O..+.T.r.R.zz..K..].E.....Ri.)g.P...j..w..c.M.F.v../........Q....'...(....X..;.K.!BZ3.........f.....N.A(....cA`.b'...`.~sa^.....?..../.L.S......t..`@h..C.....>N.W...;>..._h.+~=\|......uOGA{.7.....h....q.d.4$.x<.....^0\|...@....@Q[RC.0....b....'...RID

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	7.843362903299294
Encrypted:	false
SSDEEP:	48:1E3hTvNbvJkGGv0nnr5I2rk5boP0gD6EaTMN:1ERb+cr5Z1P0gD6/a
MD5:	29D583007FCD677AA31CA849478BC17A
SHA1:	F354E323218A450060852C344927C3E79D8E7B66
SHA-256:	120EE096F38C1E21083054C15F0F8CFBB02B6740A01D98068E3BE9581E83D453
SHA-512:	4AFC2641D96D1C372D091FD795D39C1AF12149B5EB30DA7BEE6FBFEA0650841067B7D259473BF65706CDD42D1EDF1CC5673B5F5556D1E91F8AE32976490A7E4D
Malicious:	false
Preview:	.PNG........IHDR...<...<.....:..r...IIDATh..{.VE.....Y.E.......Uv.B....=. {....ee....G.%....H/).UR1[.G...d...._m......~:.\|.13..~.e.;s...;g......&g.@..w.G..K......{.u+..^...k.....s+...e..R.z...."..............l.z......C.......V.#.}.5(..f5.N`.......e&3".x..g..w..C.......T\|...v"w..Q>-(/2.x.A.L..!....r..noB..g\|...\|.\....U.T...<3.N-...rU.bp%.<.CE........k....0C..\|.Sw~.g....!....uf+y.KG.O+Y.h&.....F.......sB...7.\|;.r\|..\o......;.$...i.wC.ICO.n.h....AJ.N.+.T).........)9..y..?.hs%.".B..k....#.S.....:..!o..Z...\|.w2....a..+y.e;..A...x.p+2G/!..1..jTr.S...S.....D.<.G.z.+2..E..>.Z6L.......e.2..R..3...~..%.C.!..f..s.'.;.M...5..k.1..L._B.vA_\|.c{......{.......d...Y.'Q.TS:.7.......\|...,.:..-...#.V.*NA..&...iO.....SEE.kW!.y.p.y.m..6b..@=.,.n..i,....q..W...w.f..bg.`\|......3.:.K.<..I.[....a..}..%_....{...~..j...)......n}m[...u...._....{....,.t.[ ..g.....&.v.j..2.r5.r5.B..jp..v-.j./.....c.s..$q@..z...oo..g?.z...%..gW.......}.6h....U....o.u.])]..@B);.o.V

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 11116, version 1.0
Category:	downloaded
Size (bytes):	11116
Entropy (8bit):	7.977966003020195
Encrypted:	false
SSDEEP:	192:c5J6FUS8z9yKW3C62e9A3+t4q965ElM9FxWuPpZ6LpjKQZtX9MRFTj1EHUgaflbN:c5J6FDS9yhyy9Dt4265ElM9FxtPT69H6
MD5:	7E05F5267BBA1AA9FB260096F923BDB7
SHA1:	44E5FE17DC41EB94BB2FE85D77C0904AC766325D
SHA-256:	21E75944D3F77408D1F5F2FAB67C89C7FC43F4A80A3B8E4DCF38185F9D9F46E6
SHA-512:	E3442FC98D171DFE08614751267C2023BF6DE2A2E42BE7B7CB54E15DDBE028534D193D93B086A75549432B2818B0EC1824D2BDBB848B00A9329F22C5DDDE619F
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2
Preview:	wOF2......+l......Q...+..........................>.....X.`?STAT^.."..\|.......(.%.....6.$..6. ..x..R.....Iu...8@.}.G"....~x5.`....J.......t.Tm.....".......e..........C..9.9..R...F?..x.i...._.x.<%2R...d...y........{.om......Oe..u..3Z.....x...#4.I..ES...8=........,...Y.^ ...2.=@...a...a..0.P..#w3.'F...b.,l.........1..".......IB.....b.......e......X....?D.[...iK.....$.F.......nM......4..@M......u../.#.C.X.TC3z.n.Wx...........=...@...t.I..UR....6.v...3...X.~i+..s..J.V.Y...g..Kun.IZ,....%O.u..3.(.+B~.)....M(6r.m......>x..p.MZL....P.Z>....@.*..M.0..5....@\.D.&..H. 2M...N..f.E.UM....B).).m.1.J......'.=D....Z.6.{.5..q......4.T.$:=...r....5..3s..zD[.i ......x.Mtq.\|.#G......._.9P=}..PG.a......l8V.m...P.#..5..6R....`.<K}k.a..a....D.6..A.l...e.F...Z..0...7.0...^.....n`p..o.`.........4F.....H.1.).lh.....u..3WB4.$.............E......Z.{..{.[]...E.m.{.V^kZ..J.y?.w.m......o.k.j<.}...g. 7...-3}C?....<..\..ld9s..p...p..3%....>...F;...6..h.Z..GKh>...k.S..V....

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
URL:	https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 38, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	7.902919939139106
Encrypted:	false
SSDEEP:	48:vnJJCJaqcfDoxU8qAg6opvwr+FYc1lWO1pPGDfMexqwFYRFlIe9BhGtAHIWVRs:vnJJ8CESXp66vwPuGDfMexqwALvhTFTs
MD5:	E154B58FD2CD3F1F2E2C6C810BB1E65B
SHA1:	CAEF301E8550A910909ECE9471669DA0C32EA6F0
SHA-256:	E8C5A2C9860C1A6CC7C949B9D7C793E5E435D75996DEBEB295A959F3D09831C0
SHA-512:	464EC940E824EAB8B7F83EB40852DD3019E84BE7B1A0F75AF288656605426B2EE386FA7FF102E0144AA065F053E88E8356E7C185B4DC393CC4D8EB0ADC877312
Malicious:	false
Preview:	.PNG........IHDR.......&........l....IDATx...{h.U..q...Ms"e.ej,..M.,](&..B...)G.F...2.22oY......L.%...iF......L.e.dsn.Oo.@..?...........y...s...=...D-jQ.D..&C1..Mr_9.n...p.8.W...x....8d..Nl.b..=h...b<.`...W .GI...S.Q....l..b ....G.F2.+ ...C..u...2j.?Z.).....!-...d)2]..d.;p.,.t@>F>.3}9....... ......v@.>4.= ..B.5H..e.....5i.?NP....<.Y.LWx.a.>8..?.M.$S> .C...r...:.,...OLWx.a.v8.....c.....Z../...M........m.,..Rl..1.X.Y........j@.@.%.2l....YJR..?.....5 ..G.d.BF./.L\........,J..~...0]...,...q.7x....h}.m..#...."<...0q....8.9.`...e...EV...m..p.M}H.y...H..l.~...x..0...<.....d..Xh.1.~.Y.M`.].Q....:...8.....M1.'..~.h...g{..OD..f.Hc.g.(..)....,.y.w.\.....HO" /A.\..Z@...$...].,.<.G..WavB...q....\...H..<.t=d...-VWTC.I........jv...!....N@..0..M...."._B....%X.R.q.....W.'WAL..'m].+.j.pF.8,...V.Jc..@....E...\|L...=.[..2&^......y....X..1..(.F..,..f.5..dT...b>..q>.;..d....:.O..)N. ..\.......s..R...UcD..d;ct.,+<.c;.W...!K.$..... .g.../.,5.T..g7l.,...p. .8.]...C_4...?

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4524
Entropy (8bit):	5.108931295370594
Encrypted:	false
SSDEEP:	96:AG5XS7vBkRVkhmRaM44/HLPRaByA+zBRNI:AG5XABkAhmRaM44/H1CyrBRNI
MD5:	DD05B711E15EF201B07E20CB5C87F5D8
SHA1:	41B818B243140D90DA4CA917D454335B603A6BDA
SHA-256:	617F793D125F780AB7BB7C9E92AB427D9E757083E7368E241E8E8FA69F013E4F
SHA-512:	243C149BB8AAF5376EEBAC49833A59F75BA26BEC098AFD8A167D12BDACD3E80D98EE1DA1D82915CC7E4C7FAC747FBFF5D2D687D97F20BDF5C81D67CFA0620F39
Malicious:	false
URL:	https://s3.amazonaws.com/helpimg/landing_pages/css/dd.css
Preview:	.borderRadius{-moz-border-radius:5px; border-radius:5px; }...borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}...borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.....ddcommon {position:relative;display:-moz-inline-stack; zoom:1; display:inline-block; display:inline; cursor:default;}...ddcommon ul{padding:0;margin:0;}...ddcommon ul li{list-style-type:none;}...borderRadiusTp ul li:last-child{-moz-border-radius:0 0 5px 5px ; border-radius:0 0 5px 5px;border-bottom:0 none #c3c3c3; }...borderRadiusBtm ul li:first-child{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 0 0 ;border-bottom:1 solid #c3c3c3; }.....ddcommon .disabled img, .ddcommon .disabled span, .ddcommon.disabledAll{..opacity: .5; / standard: ff gt 1.5, opera, safari /..-ms-filter:"alpha(opacity=50)"; / ie 8 /..filter:alpha(opacity=50); / ie lt 7 /..-khtml-opacity:.5; / safari 1.x /..-moz-opacity:.5; / ff lt 1.5, netscape */..color:#999999;..}...ddcommo

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1666
Entropy (8bit):	7.843362903299294
Encrypted:	false
SSDEEP:	48:1E3hTvNbvJkGGv0nnr5I2rk5boP0gD6EaTMN:1ERb+cr5Z1P0gD6/a
MD5:	29D583007FCD677AA31CA849478BC17A
SHA1:	F354E323218A450060852C344927C3E79D8E7B66
SHA-256:	120EE096F38C1E21083054C15F0F8CFBB02B6740A01D98068E3BE9581E83D453
SHA-512:	4AFC2641D96D1C372D091FD795D39C1AF12149B5EB30DA7BEE6FBFEA0650841067B7D259473BF65706CDD42D1EDF1CC5673B5F5556D1E91F8AE32976490A7E4D
Malicious:	false
URL:	https://i.imgur.com/QRF01zv.png
Preview:	.PNG........IHDR...<...<.....:..r...IIDATh..{.VE.....Y.E.......Uv.B....=. {....ee....G.%....H/).UR1[.G...d...._m......~:.\|.13..~.e.;s...;g......&g.@..w.G..K......{.u+..^...k.....s+...e..R.z...."..............l.z......C.......V.#.}.5(..f5.N`.......e&3".x..g..w..C.......T\|...v"w..Q>-(/2.x.A.L..!....r..noB..g\|...\|.\....U.T...<3.N-...rU.bp%.<.CE........k....0C..\|.Sw~.g....!....uf+y.KG.O+Y.h&.....F.......sB...7.\|;.r\|..\o......;.$...i.wC.ICO.n.h....AJ.N.+.T).........)9..y..?.hs%.".B..k....#.S.....:..!o..Z...\|.w2....a..+y.e;..A...x.p+2G/!..1..jTr.S...S.....D.<.G.z.+2..E..>.Z6L.......e.2..R..3...~..%.C.!..f..s.'.;.M...5..k.1..L._B.vA_\|.c{......{.......d...Y.'Q.TS:.7.......\|...,.:..-...#.V.*NA..&...iO.....SEE.kW!.y.p.y.m..6b..@=.,.n..i,....q..W...w.f..bg.`\|......3.:.K.<..I.[....a..}..%_....{...~..j...)......n}m[...u...._....{....,.t.[ ..g.....&.v.j..2.r5.r5.B..jp..v-.j./.....c.s..$q@..z...oo..g?.z...%..gW.......}.6h....U....o.u.])]..@B);.o.V

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	2368
Entropy (8bit):	7.857782123483033
Encrypted:	false
SSDEEP:	48:eN+jd/MwX0F4lR7ZlqMmlNl08Q0+mNUjxulVE2Uh9wg0n:Njd/M62KJZVmlDJQ0+mGxykh9wg0
MD5:	402214A564EAB22101571DF8C6E30B79
SHA1:	D5E452981A5C325383F92BFB964BA28ECEA6FFA6
SHA-256:	8D63A7ED00572C8B418FF91F5B2E5CD667AA7226CE280E48FC8FE9D58A4D98AC
SHA-512:	D7FD2C24B182ACEA57713FB9EFD19371802B1AE748F7B01FA82D822A86F70267D94C5105FB6BD1967BCDBC1FC43DE484F2B647DFD1EC729531BD4E89814CA42C
Malicious:	false
URL:	https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Preview:	RIFF8...WEBPVP8L,.../.@...0..M._.w..1..WVaU.W,K..m..}.J.]...=..:].Dz.=....~......M.O.PneX(.......3.4..........;.f;..I2..L.....$[J....wA.a....,....@.$.].m.m.m..l.N.mcO..l.-....[t...5....-.%.....A.f ..D.`._@+.q.?.....8...(..-.^.i.,...]f..a...i....Tw.p..B....."...J'......O..J9..L.%P...{..H..JP.jP-.Cu...P{jFU..%.P[.%B....3....X.'PO.Y.....bE....P........?J.U...P!......O5.M..rT./LQ"JI..uCR...BR...S...-U.].YR...(..R..t4.....J...c..J1)\|....) ^.C....=`.bR..~+.h.5.T......".....GS.u..\|.._Dj..".D....,.7....<1.PU.t...X}.[8H1;T!+....H...R..I.\..f..V..P.S..+...m..s.659FlS.I....Ph.).....GhV.v+...&......l...K.^Q.)...7....5.<....a..%.t....<.(.....;2.n....K...9.J.B....Lf...T..!a..(....0H....E1......Qn.+.j.....v.R6.1G..?B......~.....&R....F...2.....}.(m.....).....]..I.....~.e.Z.T..U..C.OE.[......Zq..F.hc.W..,E.\|.Bu..SQ;..`.a.......\|..?..}..COX4.....!{'P..J.8:..U...\..S.{8U1......J.P.N*._...9L......#<...v..n...M...8..##.r..]\..e\|.....D.t.@...

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9344, version 1.0
Category:	downloaded
Size (bytes):	9344
Entropy (8bit):	7.975595436620788
Encrypted:	false
SSDEEP:	192:iy1J4xqYLC2akqiC1YV/R582UeGFc/AUGlF0djsT7qWPcC/Cdv:D2J7h5bV/37WUFGT7lPcC/Cdv
MD5:	CBCA61F27F93FD71171FE8D314C66AB9
SHA1:	C46A51672FFFF100945F84C3EB87826B7844A1E2
SHA-256:	F9A9A7A4B9D40BCC3047928DFA60695D53E6AE1D6EE699EA70146E171322ACAD
SHA-512:	7F9E8520DFB64197CE233AF7671A5A5643AE116478C6E2F5F67FBD8A092117126ADF1E2EDDA13FF1C19D68AEA3D04288310A2109D7C81183330F2B8DAD0785D4
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4jaVIGxA.woff2
Preview:	wOF2......$.......A`..$..........................L.. ....`?STAT^.t..\|.......t.Z..N..6.$.... ..x..h....B;%c[.08.@D..=.E...O...q2.0..i......v.p.0......Y. ..P)......N.C...K,.W!.Wutp..I.2...6.....Y..X...W..z.U.nq.j^;.8.zO..gw.d.^U?p.........7.. ....S..d......d./.-.7....$...V(V(\|.........c~........B[H.D(.$2.1<....N7..n.9k...D.@.(.(...H.D....qsQ."..O..{Oh..r.T.Iw..9I...rq.2.n....SW.O..\b5B.n..M.06.j..L.Sx?.........t.\|z}..V...G..J....x..Co].5HC..6p..,.2..&..}`.I.n......S}'....$..iV.[.....W......6...m.I'M...a......c...\|.a.FK.d.zW9xi'Y8v..lWi....T-..F\...^p.<.TT!wvQ.i0.0.f.\.A.. .Hq..J...=/.....\.]..Dq...:..+...W..]4uZ.._.l...e-..........k..."p....c......X..=.9..1.....2.......],.....R\|J......r.x./...pa...ef.......{..&.........=.5..>....5@...x.v..o.Io.L.t[Wu^.=..Z.r?xV..V..jV..`...+.2..8..P....[.r.....4.,Y....&.\|.W<..7..Y.s.=,2..A.i..je..P..`pV..!VW-...`.>YBRJY[...!rY5...l........Z.5_..B.....cP.....v1....(.5...[....n.....vlx=I.*1..9R....=..2..u\..p...iFD...

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Y/B:Y/B
MD5:	D8F4A1993546CC4B850CDE3599E27AEC
SHA1:	094B763B4CFCC0B05E5D040581CD513C3CA08067
SHA-256:	907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
SHA-512:	7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
Malicious:	false
URL:	https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css
Preview:	not found

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
URL:	https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	6193
Entropy (8bit):	5.401714743814202
Encrypted:	false
SSDEEP:	96:ZOEbaJJOEbaiDFZ8OEbaXkOEbahYOEbalOEba5y+aZjzBrWOEbafubqGIFuV4UOQ:aJKAXzhXm5qJ2bqGIwV4jlZYF
MD5:	F2D1D2937C3546E15C471236646AC74E
SHA1:	DD8D90F6D4AC8D72C718C10424788612689D89DB
SHA-256:	719D2FC548145FA8D8361205F6FCB49EEFC54C71FBB18E6320A60A263F40637A
SHA-512:	7B400281407249F805AB4695E0B7D3CDF4F7F5F776F9F7E60872D5208B7324DADDDAD79D76AC9991C74563520FB6BFF3A6343C8C10591C9EB5682733592668A4
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4taVIGxA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4kaVIGxA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext */.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: 100%;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4saVIGxA.woff2) for

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Y/B:Y/B
MD5:	D8F4A1993546CC4B850CDE3599E27AEC
SHA1:	094B763B4CFCC0B05E5D040581CD513C3CA08067
SHA-256:	907BA78B4545338D3539683E63ECB51CF51C10ADC9DABD86E92BD52339F298B9
SHA-512:	7C696247F98AA6FE4E1DF001FD6029ABBBCCF45B122D65DFDEDE8F8A400CDA775387C657F96BD1E4E52DA7409187892B1F0786C54D835D2E44227B2E1335EAF6
Malicious:	false
URL:	https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
Preview:	not found

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (407)
Category:	downloaded
Size (bytes):	461
Entropy (8bit):	5.852709961648038
Encrypted:	false
SSDEEP:	12:3R+xnll26kUlPMReF4YeOZ/ZDXSMcc0gkb4AEdeIQL:3E6ul0Re7Z7SFdPbNEkj
MD5:	E982AB5A676673A16FE765E97E3D0098
SHA1:	25EDE70A670EE1075EAEB8008D34888A3D151E51
SHA-256:	B0427730FCD85299ADA16459C60305E38C642CCA797042522174AC7F2AA2BAC6
SHA-512:	F452A99426CBF97CD26EAD573D4BE55B8937BAF093F6889C89A71E3C7EC5F314C9CDD18680172500AD55EC793E3190AF99DD2E985CCDBB056F7B9DB793493DF4
Malicious:	false
URL:	https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963
Preview:	<html>. <head>. <script>window.location.href = 'https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 17576, version 1.0
Category:	downloaded
Size (bytes):	17576
Entropy (8bit):	7.986135354736866
Encrypted:	false
SSDEEP:	384:9FlzBIAFMur/ziLBGLlbxN8j/70j6vmoXB:bIEbXiNhP0+mox
MD5:	EFB3F28447C9EF35FD5882FB763B37C3
SHA1:	158DDD8C0348DEFA3192F26DA60A746727F4A8A3
SHA-256:	6D4370B59E36AC955C8B97F12FD5E86F7D3E80285D6AF2BFF0DAFA8E122D3C3B
SHA-512:	C0521D7C7BE4F635F70F0F466BC7A179C647C43C5AB400C8E490466BDDDE7175809B594C3D7B1A2F2AE9841CDE2F9AABFB8A967618FFB2CC7456A9B3231E0CDD
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B5caVIGxA.woff2
Preview:	wOF2......D.......}...D=.........................N.......`?STAT^.....\|........<.....T..6.$..$. ..x........n'...........#.`.........9IE.LZLJ....Cf.`....0....I.Y\|...`.{j.K....EW..zG=xA..P.6....6..n.+V....+..J.. ........ ..6~.f.....o.........}.H?..1.j^.^..?...z^.J.X.6.._...I....."..5..3<Bc.......oI.av}.s.{>.. z.c...........&@-w.S..P_.~..f..~..'+.....m..s...`D..(.....`.b...U.Vcn:..5.\.j.......v.. .I..K..mS#.=...w.%[.}I..>.O..'.k.k..}Gh...v..eB.....E..'"!.I...I.D...jo2.X.U.....OC.......H......8..[.... @..M.....=U/...E<.BH.I}h.j..H'..R.&O...i...kE%.....oTns.U..9.7...._....fL8....Um.@...g.[...%...0vU_.<.........Mp.."R.l.A....t..&..... X@.P..o..wI..4...c.........n.~9....U.`....gj...pu.... ..'.B,..C.\T!.v.......x.b...(0(....J......2...$...'..+..s.u]..m.E]....QS.......}.Z=.$.....q.0..2.kKK.....[.\|kg.....y....`DZGC.....A8....'.....,.Iy...h.K#........)r.P)~...!o.2t........._AAvQ~.!.@hy;c.-....p.'...:4...5......!..yS4A..........yD...T..A.!......dK

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 7728, version 1.0
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	7.973684421983582
Encrypted:	false
SSDEEP:	192:RqbUht1WYnRpoFA36C6PZgm9hGwy+ymZMcVB:Q4h3WIoKqxPZp9hDy8ZMcVB
MD5:	80210D1FF4DE56C6704607F3831E8F6C
SHA1:	32FB4E1E177D5DE97AAD6E0D57100755D8DD2CFD
SHA-256:	F515A6F8BAE422286936B110653FB8EE0F58FE32D61390EE5DE77029BE23EFD6
SHA-512:	E24520E29F2073F03A0FF1E72EB632CCFB6FC1451BCB0735671EAE03CAFFB1CA6731050318F43544CC99AC7127015664464A0DEF587058535F9F7F743F166713
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4iaVIGxA.woff2
Preview:	wOF2.......0......:..............................V..\..f.`?STAT^..4..\|............$..6.$..D. ..x..,.....4%...<...}G.H..T.0...L.F...._[e.'.B"...).J...55. ).M.u..J}bV.,.q.#.I.C.(O....0.J....$...c...}.E'/.n.k...A..#m..d...9{.fV...!..[qj.,5...P..u..p.T.N\...{...d...f+.pt...+..y.A...Z.3&..H.VuX...^..R9.q@...s...]...c.pMS .GH...z..e?.n.....Z...V........,.8..t......p....X..i.w.....j.....2]sP.%Z.....XQU.....7..3.u.]...+.I.....!......c.ey...b_...M.....aXp: ..$.....^........8+..Z.~.!..BXR..E#WbC....1..P;@...e...c....&<0.(..2..,.e.....n..C.`....n,7\.DV.B..._.=...Ko}..O......A.......@C.}I}.....z.8._J....5.t....&.$....a.PS.}.....^....$..@...;.<.'.F.t.....\........~.w."..w...7...8..-r...r.Z.`.K..Y.R8.#R.....Ijz.vc.Xk....g..E.n...Q.x........>....gH..t...:Z..v..+.z.^H..A.@.....\|W9.}+.Ury.......Q,@...!.. .'kN..X..RA.oHWF$O...<..r.....\|N..!.fT...F.....~.....1..(jD...e..i..!....cD.h.Y.....A....r.dfD5.P..x...g.../@..._g\.h....pH..~..e..../MR.....).]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65371)
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8572, version 1.0
Category:	downloaded
Size (bytes):	8572
Entropy (8bit):	7.968224802101464
Encrypted:	false
SSDEEP:	192:7kVuVBCnQlLJQwaKzxipCMvtCYuZQ9lABAbdsPyY5pfFqC:7+uVKI9OOMnuZQIBcb0Th
MD5:	776FDC253D54124DD63F274BF5EA35F0
SHA1:	7761DAC9A7FBB2814989092003506BA594C6EE45
SHA-256:	0B81CC8358F236821ADA286C94726C7FEBC9CAD8BD4F59FB39C515956B644E99
SHA-512:	4689A0D6723243E796D5DC1B031F5E1E8CE1D038921F1CC612169F179147DFC1B74CCA87CD7E2C8BEB38D9A8ED99F42FF369BDCB2FA9EA80B1BC00CC36CAEB10
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4vaVIGxA.woff2
Preview:	wOF2......!\|......G@..!..........................j..l..&.`?STAT^..8..\|.......$."..&..6.$..H. ..x..T.....A...........ZuVQ.......Kn..`...%.$T6I....\G.Q.X9uK8.ct?..........P.\5..;.I{...r}E......?.E7....8A..R.k."....^.4..^..j?.2h..bg.8.5.....7;..I..JH..j...4B!jI_v....=..S.."+eQX....h...X11........t.....rw-.2..X..J..z@.8@.a.........+JCV..df.p.4..B.U ....]..n. ...u..+..d.C.P8.,.8F.P.L.bL...=..=...5..O..T.<..I...].....O...`.Q.9....WT...r.>.b...3U..`.&.. .<..X-.'.s-....E;?.T."c.%4....ue.>...0A+`.X/.y..T.......O`...sHEE8E>...f...........%.p.t ....RrH.Sy!..)...Z....E...w^....V"..z..=O....B.........&XV..{..B.....>...=........]..Z.._..c.I.....U.^..j...B..A....Z.......T..N.F822.....G......h.(.`'E1..;..)...q.....%........... uK......@...7..DEd....N.l..,.,....oI...z... .eq.t:.HG/;4..3.F+...A........WFNm..._.\|-! Y.Utv.},......,..G.O.#...w.G..?.C..5_.)O{.G<.^.u..b..p,...P.MR.... ./C.)...s..{.,.}..z.....L..A...~..J..W.)}....r/u..:Q..aM......W...

Static File Info

General

File type:	Microsoft OOXML
Entropy (8bit):	7.996524815097187
TrID:	Excel Microsoft Office Open XML Format document (35004/1) 81.40% ZIP compressed archive (8000/1) 18.60%
File name:	weekly-finances-report.xlsx
File size:	174'581 bytes
MD5:	f5b20f951569b6c6e6f0e398b692512c
SHA1:	cb5c3731d3e1a534501df6df842983a97426a95d
SHA256:	eab6f5d40791e2ef277809112b588028237e7ed0d769a0f9735fe29c2adaaaf5
SHA512:	0447b7d7d9891ab17bcd3a740d063f76d72727a96278b95c1122f77a17bfbede7f216786aeaffc6705d341ad9f66867d5297805655510f776e04ad8955972228
SSDEEP:	3072:zw92pRgj0OuGSS3NuurKiw7rj3EWKp8r+z5BqoCiqFo7UuCsY:Mwgjp3SYuyReEWK2IBuiqFcURF
TLSH:	EA0423364FBE914ED72EC1B0F8A43CE4EB03A01C5227F566657A7901BFD2DECA641096
File Content Preview:	PK.........u^YkG..r...K.......[Content_Types].xml.U.j.0.....F.b+I...'...6...Tkl+..F.....PB...h/.m.m...?\*....0:'..C....BW9.....$A.4g.h.......7....&..1'....R,jP.3cA...8.\|.t......h..y.....O}. ....l&}.....I.H$.....r....`>....{...!......x....t.;....&.....+.X.

File Icon


Icon Hash:	2562ab89a7b7bfbf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 15:52:26.337558985 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:26.337588072 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:26.337665081 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:26.346206903 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:26.346230030 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.172671080 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.172780991 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.178117037 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.178122997 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.178519964 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.178579092 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.245889902 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.287338018 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.508832932 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.508922100 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.508932114 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.508969069 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.509062052 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.509080887 CET	443	49162	52.72.176.27	192.168.2.22
Oct 30, 2024 15:52:27.509090900 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:27.509129047 CET	49162	443	192.168.2.22	52.72.176.27
Oct 30, 2024 15:52:55.621233940 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.621284008 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:55.621332884 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.621624947 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.621638060 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:55.625724077 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.625766993 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:55.625974894 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.628045082 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:55.628057957 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.441143036 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.441499949 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.441514969 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.442796946 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.442846060 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.444142103 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.444274902 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.444340944 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.444348097 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.637559891 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.839366913 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.839732885 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.839751005 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.840823889 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.840955973 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.841243029 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.841309071 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.847731113 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.847800970 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.847862959 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.848773003 CET	49166	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.848789930 CET	443	49166	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.905751944 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.905781031 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.905833006 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.908400059 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.908449888 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.908499956 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.908762932 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.908775091 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:56.908934116 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:56.908946991 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.037609100 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:57.037633896 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.237610102 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:57.743248940 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.753398895 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.850579977 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:57.850614071 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.850770950 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:57.850794077 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.851911068 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.851922989 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.851975918 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:57.852135897 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.852145910 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:57.852185965 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.043838024 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.044027090 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:58.044084072 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.048091888 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.048294067 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:58.087338924 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:58.247641087 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.247668028 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:58.263331890 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:52:58.263386965 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:58.339719057 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:58.339766026 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:58.339865923 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:58.340219021 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:58.340226889 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:58.449676991 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:52:59.231580973 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:59.231956005 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:59.231977940 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:59.233127117 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:59.233259916 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:59.234297991 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:59.234365940 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:59.429714918 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:52:59.429732084 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:52:59.629722118 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:00.193470955 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193525076 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193535089 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193552017 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193574905 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.193583012 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193608999 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193619967 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.193629980 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.193629980 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.193629980 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.193653107 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.193726063 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195540905 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195555925 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195581913 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195589066 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195601940 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195615053 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195626020 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195626974 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195643902 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195652962 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.195658922 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195696115 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.195713997 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.218923092 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.228250980 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.228302002 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.228358030 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.231837988 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.231895924 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.231941938 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.234289885 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.234301090 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.234344959 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.234694004 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.234724045 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.234776020 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.234899044 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.235145092 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.235157013 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.235594988 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.235615015 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.235765934 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.235774040 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.235935926 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.235945940 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.241715908 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.241751909 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.241795063 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.242276907 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.242292881 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.252439976 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.252476931 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.252643108 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.252971888 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.252990961 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.279335976 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310621977 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310632944 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310669899 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310691118 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310691118 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.310702085 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310724974 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310740948 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.310740948 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.310746908 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.310781956 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.311032057 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312103987 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312114000 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312153101 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312166929 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312175035 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312180996 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312201023 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312222004 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312408924 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312787056 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312828064 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.312834024 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312869072 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.312908888 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.313069105 CET	49170	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.313091993 CET	443	49170	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.313409090 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.313436985 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.313488960 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.316206932 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.316216946 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.657351971 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.657375097 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.657453060 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.657470942 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.657488108 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.658560991 CET	49169	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.658577919 CET	443	49169	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.659024954 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.659054041 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.659095049 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.661250114 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.661262035 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.864204884 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.864517927 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.864541054 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.866969109 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.867033005 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.868269920 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.868335009 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.868352890 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:00.905133963 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.905472040 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.905489922 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.905921936 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.907069921 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.907231092 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.907335997 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.907367945 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.908417940 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.908461094 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.908514977 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.908580065 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.908977985 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.909040928 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.909183979 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.909192085 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.909413099 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.909432888 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.915333033 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:00.928898096 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.929250002 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.929265022 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.930325031 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.930411100 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.930428982 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.931561947 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.931648970 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.931917906 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:00.931929111 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:00.938925982 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.939276934 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.939299107 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.939354897 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.939619064 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.939642906 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.939663887 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.940115929 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.940130949 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.940198898 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.940318108 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.940756083 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.940840960 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.941446066 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.983338118 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.983341932 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.995310068 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.995666981 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.995675087 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.996793032 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.996848106 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.997237921 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.997294903 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:00.997509003 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:00.997513056 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.005841970 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.005873919 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.005908966 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.005944967 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.005948067 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.005955935 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.006058931 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.006087065 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.006102085 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.006105900 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.006207943 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.006633043 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.071542978 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.071624994 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.071646929 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.071733952 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.073957920 CET	49174	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.073982954 CET	443	49174	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.085458994 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.085514069 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.086266994 CET	49175	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.086288929 CET	443	49175	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.109600067 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:01.109678984 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:01.109685898 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:01.109716892 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:01.118182898 CET	49176	443	192.168.2.22	16.15.176.94
Oct 30, 2024 15:53:01.118220091 CET	443	49176	16.15.176.94	192.168.2.22
Oct 30, 2024 15:53:01.122786045 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.122880936 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.122956991 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.122965097 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123065948 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123423100 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123451948 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123486996 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.123492956 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123502970 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123550892 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.123555899 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.123876095 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.124125957 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124157906 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124207020 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.124212980 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124248028 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124269962 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124314070 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.124320030 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.124371052 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.124452114 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.124537945 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.125107050 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.125173092 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.125179052 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.125243902 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.125272036 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.125319958 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.125332117 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.126111984 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.126837969 CET	49172	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.126853943 CET	443	49172	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.126861095 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.126867056 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.180679083 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.181907892 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.182713985 CET	49179	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.182743073 CET	443	49179	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.236243963 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.236270905 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.236285925 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.236372948 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.236402035 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.236449957 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.236542940 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.238920927 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.238945961 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.239018917 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.239043951 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.239082098 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.241861105 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.241955996 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.241992950 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242003918 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.242022991 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242099047 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242135048 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242145061 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.242160082 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242217064 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242250919 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242286921 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242338896 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.242345095 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242408037 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.242784977 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242794991 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.242855072 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.243191957 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243200064 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243233919 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.243834972 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243843079 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243882895 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243897915 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.243905067 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.243927002 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.244684935 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.244746923 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.244750977 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.244759083 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.244787931 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.244808912 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.245532036 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.245609045 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.245655060 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.245655060 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.245662928 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.245690107 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.246469021 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.246510029 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.246539116 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.246545076 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.246587992 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359067917 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359117985 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359150887 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359175920 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359189987 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359200954 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359208107 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359298944 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359364986 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359369993 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359483957 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359518051 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359538078 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359541893 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.359565020 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.359653950 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.360121012 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.360208035 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.360240936 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.360241890 CET	49178	443	192.168.2.22	104.17.24.14
Oct 30, 2024 15:53:01.360250950 CET	443	49178	104.17.24.14	192.168.2.22
Oct 30, 2024 15:53:01.360265017 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.360291958 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.360305071 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.361124039 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.361757040 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.361764908 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.361794949 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.361814022 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.361833096 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.361845970 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.363420963 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.363914013 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.363929987 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.363974094 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.363995075 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.364006996 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.364113092 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.401566982 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.401592016 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.401628971 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.401659966 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.401673079 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.401750088 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.484354019 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.484390020 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.484483004 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.484513044 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.484627008 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.484972000 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.484992981 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.485018969 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.485025883 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.485038996 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.485379934 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.486265898 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.486283064 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.486331940 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.486341000 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.486421108 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.487229109 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.487250090 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.487298012 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.487310886 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.487395048 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.488955021 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.488972902 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.489028931 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.489028931 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.489037037 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.489124060 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.489842892 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.489864111 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.489896059 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.489903927 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.489917040 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.490057945 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.525794029 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.525819063 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.525875092 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.525885105 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.525922060 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.525989056 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.607841015 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.607878923 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.607918978 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.607949018 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.607966900 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.608037949 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.608550072 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.608566999 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.608622074 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.608622074 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.608630896 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.608872890 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.609093904 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.609110117 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.609170914 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.609175920 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.609198093 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.613053083 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613078117 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613107920 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.613114119 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613123894 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.613737106 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613754034 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613795996 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.613802910 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.613812923 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.614129066 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.614151001 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.614171982 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.614176989 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.614187002 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.614712954 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.614727974 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.614773035 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.614778996 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.615443945 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.615464926 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.615493059 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.615499020 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.615511894 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616271973 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616286993 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616324902 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616331100 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616339922 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616485119 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616504908 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616534948 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616540909 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616549969 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616549969 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616586924 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616594076 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616627932 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616810083 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.616817951 CET	443	49173	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.616827965 CET	49173	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.638978004 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:01.639028072 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:01.639075994 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:01.639333010 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.639374018 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.639436960 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.639657021 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:01.639669895 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:01.640733004 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.640747070 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.648473024 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.648514986 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:01.648583889 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.648823023 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:01.648833036 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.250667095 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.253144026 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.253173113 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.254348993 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.254465103 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.254486084 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.255819082 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.255907059 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.257935047 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.257963896 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.322781086 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.330398083 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.373873949 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.376221895 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.376247883 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.376286030 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.376305103 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.376374960 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.376388073 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.376905918 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.377348900 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.377392054 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.377465963 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.377480984 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.377507925 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.380105019 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.380207062 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.380589008 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.380713940 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.380955935 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.381030083 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.381114960 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.381340981 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.381351948 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.381400108 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.381411076 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.423326015 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.462877035 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.491580009 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491691113 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491729975 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.491731882 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491760015 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491791010 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.491797924 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491822958 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.491859913 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.511406898 CET	49182	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:02.511440039 CET	443	49182	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:02.591324091 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.591339111 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:02.591376066 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:02.591398954 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.577714920 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.577713966 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.577841043 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.577841997 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.577944040 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.577951908 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.579843998 CET	49180	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.579864979 CET	443	49180	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.580137014 CET	49184	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.580149889 CET	443	49184	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585186958 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585217953 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585230112 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585246086 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585277081 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585311890 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.585324049 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.585364103 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.585479975 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.585772991 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:03.585807085 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:03.586286068 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:03.586870909 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:03.586884975 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:03.587409019 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.587429047 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.587464094 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.587483883 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.587502003 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.589221954 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.592644930 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.592664003 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.592801094 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.592819929 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.593290091 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.596278906 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:03.596312046 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:03.596368074 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:03.596493959 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.596512079 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.596579075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.596579075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.596592903 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.596617937 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:03.596633911 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:03.596682072 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.598309040 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.598325968 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.598409891 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.598409891 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.598423958 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.598507881 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.599884033 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.599905968 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.599992990 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.600008011 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.600022078 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.602484941 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.602503061 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.602566957 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.602583885 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.602683067 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.603230953 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.603251934 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.603280067 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.603291035 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.603303909 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.603389978 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.605882883 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.605902910 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.605945110 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.605961084 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.605981112 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.606102943 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.606125116 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.606144905 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.606152058 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.606168985 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.607646942 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.607666969 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.607706070 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.607717991 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.607734919 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.608249903 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.609081984 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.609097004 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.609169006 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.609169006 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.609179974 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.609232903 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610165119 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610183954 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610238075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610238075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610249996 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610300064 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610565901 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610580921 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610624075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610624075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610632896 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610850096 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610871077 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610897064 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.610905886 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.610920906 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.611221075 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.611634016 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.611651897 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.611686945 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.611695051 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.611713886 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.612071991 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.612092972 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.612116098 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.612128019 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.612144947 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.612158060 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613351107 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613368988 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613428116 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613428116 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613441944 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613568068 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613589048 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613591909 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613611937 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613626957 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.613650084 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.613739014 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614237070 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614257097 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614310980 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614310980 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614319086 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614444017 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614558935 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614579916 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614628077 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614628077 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.614635944 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.614696026 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.615483999 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.615509033 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.615534067 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.615540981 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.615583897 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.615618944 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616195917 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616211891 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616266966 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616267920 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616276026 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616291046 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616343975 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616343975 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616349936 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616363049 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:03.616434097 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616736889 CET	49183	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:03.616750002 CET	443	49183	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.031076908 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.031110048 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.031183958 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.031616926 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.031625986 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.225378036 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.225975990 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.225994110 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.227089882 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.227252007 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.227262974 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.227564096 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.227622986 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.227783918 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.227797985 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.354756117 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.355185986 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.355202913 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.356331110 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.356482983 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.357614040 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.357681036 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.357817888 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.357827902 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.415431976 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.415477037 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.415513992 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.415546894 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.415546894 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.415565014 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.415579081 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.415620089 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.416549921 CET	49185	443	192.168.2.22	104.18.90.62
Oct 30, 2024 15:53:04.416572094 CET	443	49185	104.18.90.62	192.168.2.22
Oct 30, 2024 15:53:04.487850904 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.487957001 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.487961054 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.487994909 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.488909006 CET	49186	443	192.168.2.22	199.232.196.193
Oct 30, 2024 15:53:04.488934994 CET	443	49186	199.232.196.193	192.168.2.22
Oct 30, 2024 15:53:04.501491070 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:04.501535892 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:04.501585960 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:04.501780033 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:04.501794100 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:04.700208902 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.700521946 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.700536013 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.700982094 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.701303005 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.701359987 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.701456070 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.743324041 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.867444038 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.867470980 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.867516041 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.867544889 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.867563963 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:04.867604017 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.935520887 CET	49192	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:04.935545921 CET	443	49192	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.135430098 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.135443926 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.135514021 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.136086941 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.136101007 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.230195045 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.230462074 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.230482101 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.232641935 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.232695103 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.233086109 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.233170986 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.233270884 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.233279943 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.358681917 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.358788013 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.358798981 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.358828068 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.360605001 CET	49193	443	192.168.2.22	199.232.192.193
Oct 30, 2024 15:53:05.360629082 CET	443	49193	199.232.192.193	192.168.2.22
Oct 30, 2024 15:53:05.816132069 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.816176891 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.816226006 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.816823959 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.816843033 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.816986084 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.819721937 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.819731951 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.820152044 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.820895910 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.820979118 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.821063042 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.867330074 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.990874052 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.990928888 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.991020918 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.991038084 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.991132975 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:05.991216898 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.992136955 CET	49195	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:05.992152929 CET	443	49195	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.488039970 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.488410950 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.488437891 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.488814116 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.489116907 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.489197016 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.489272118 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.535336018 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.852099895 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.852432013 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.852531910 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.852907896 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.852927923 CET	443	49196	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.852937937 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.852972031 CET	49196	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.856964111 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.856987000 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:06.857040882 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.857533932 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:06.857547045 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:07.526680946 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:07.627500057 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:07.627531052 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:07.628194094 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:07.628957987 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:07.629049063 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:07.637918949 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:07.683325052 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:08.257360935 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:08.257473946 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:08.257550001 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:08.258476019 CET	49198	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:08.258496046 CET	443	49198	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:09.220482111 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:09.220555067 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:09.220854998 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:10.548619032 CET	49171	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:10.548654079 CET	443	49171	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:42.049120903 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:42.049153090 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:51.191828012 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:51.191903114 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:51.192076921 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:52.556132078 CET	49167	443	192.168.2.22	3.93.255.10
Oct 30, 2024 15:53:52.556171894 CET	443	49167	3.93.255.10	192.168.2.22
Oct 30, 2024 15:53:58.368724108 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:58.368773937 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:58.368849993 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:58.369048119 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:58.369060993 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:59.228317022 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:59.228705883 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:59.228730917 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:59.229047060 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:59.229403019 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:53:59.229449987 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:53:59.435924053 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:54:09.224330902 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:54:09.224405050 CET	443	49200	172.217.18.4	192.168.2.22
Oct 30, 2024 15:54:09.224477053 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:54:10.560235977 CET	49200	443	192.168.2.22	172.217.18.4
Oct 30, 2024 15:54:10.560267925 CET	443	49200	172.217.18.4	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 15:52:26.323365927 CET	62751	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:26.330997944 CET	53	62751	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:54.072033882 CET	53	54719	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:54.082174063 CET	53	54998	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:54.220068932 CET	53	62672	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:55.600481033 CET	53	58105	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:55.607223988 CET	64928	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:55.607803106 CET	57390	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:55.614826918 CET	53	64928	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:55.617984056 CET	53	57390	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:56.884381056 CET	60507	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:56.886310101 CET	50446	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:56.894382954 CET	53	60507	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:56.896202087 CET	53	50446	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:58.298574924 CET	61486	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:58.298805952 CET	62453	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:52:58.305594921 CET	53	61486	8.8.8.8	192.168.2.22
Oct 30, 2024 15:52:58.306624889 CET	53	62453	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:00.232417107 CET	61618	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:00.232939959 CET	54422	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:00.233807087 CET	61826	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:00.233927965 CET	56329	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:00.240816116 CET	53	56329	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:00.241066933 CET	53	61826	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:00.241337061 CET	53	50337	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:00.243356943 CET	53	61618	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:00.244925976 CET	53	54422	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:01.625264883 CET	53406	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:01.625417948 CET	56345	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:01.625658035 CET	51870	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:01.625778913 CET	65009	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:01.633682013 CET	53	65009	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:01.635426998 CET	53	56345	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:01.637970924 CET	53	53406	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:01.638859987 CET	53	51870	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:02.534075022 CET	54521	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:02.534075022 CET	49750	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:03.546401978 CET	65084	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:03.546401978 CET	63373	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:03.583636999 CET	53	49750	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.585108042 CET	53	54521	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.586288929 CET	51955	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:03.586651087 CET	58971	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:03.588937044 CET	53	65084	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.589901924 CET	53	63373	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.593652964 CET	53	58971	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.593967915 CET	53	51955	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.597470999 CET	53	49690	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.605633974 CET	53	51014	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:03.630419016 CET	53	60169	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:04.493136883 CET	53060	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:04.493402004 CET	49949	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:04.500271082 CET	53	53060	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:04.501107931 CET	53	49949	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:12.572264910 CET	53	58754	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:19.588629007 CET	53	59604	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:30.608983040 CET	53	61549	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:49.193769932 CET	53	56156	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:53.892712116 CET	53	59514	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:58.360825062 CET	60624	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:58.360995054 CET	58974	53	192.168.2.22	8.8.8.8
Oct 30, 2024 15:53:58.367675066 CET	53	58974	8.8.8.8	192.168.2.22
Oct 30, 2024 15:53:58.367856026 CET	53	60624	8.8.8.8	192.168.2.22
Oct 30, 2024 15:54:34.754354000 CET	53	63535	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 30, 2024 15:53:03.589061975 CET	192.168.2.22	8.8.8.8	d056	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 15:52:26.323365927 CET	192.168.2.22	8.8.8.8	0xc3e2	Standard query (0)	token.onelogin.com-token-auth.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.607223988 CET	192.168.2.22	8.8.8.8	0x5225	Standard query (0)	token.onelogin.com-token-auth.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.607803106 CET	192.168.2.22	8.8.8.8	0x144d	Standard query (0)	token.onelogin.com-token-auth.com	65	IN (0x0001)	false
Oct 30, 2024 15:52:56.884381056 CET	192.168.2.22	8.8.8.8	0xc69c	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.886310101 CET	192.168.2.22	8.8.8.8	0x1c41	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Oct 30, 2024 15:52:58.298574924 CET	192.168.2.22	8.8.8.8	0x3910	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:58.298805952 CET	192.168.2.22	8.8.8.8	0x961e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 15:53:00.232417107 CET	192.168.2.22	8.8.8.8	0x72ec	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.232939959 CET	192.168.2.22	8.8.8.8	0xf113	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 30, 2024 15:53:00.233807087 CET	192.168.2.22	8.8.8.8	0x4b9a	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.233927965 CET	192.168.2.22	8.8.8.8	0xb726	Standard query (0)	s3.amazonaws.com	65	IN (0x0001)	false
Oct 30, 2024 15:53:01.625264883 CET	192.168.2.22	8.8.8.8	0xc6a8	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.625417948 CET	192.168.2.22	8.8.8.8	0x9da5	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Oct 30, 2024 15:53:01.625658035 CET	192.168.2.22	8.8.8.8	0xdaf9	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.625778913 CET	192.168.2.22	8.8.8.8	0x6d22	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Oct 30, 2024 15:53:02.534075022 CET	192.168.2.22	8.8.8.8	0x9580	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:02.534075022 CET	192.168.2.22	8.8.8.8	0x1fc6	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Oct 30, 2024 15:53:03.546401978 CET	192.168.2.22	8.8.8.8	0xf755	Standard query (0)	cdn2.hubspot.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.546401978 CET	192.168.2.22	8.8.8.8	0xb4d	Standard query (0)	cdn2.hubspot.net	65	IN (0x0001)	false
Oct 30, 2024 15:53:03.586288929 CET	192.168.2.22	8.8.8.8	0x26d9	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.586651087 CET	192.168.2.22	8.8.8.8	0xde90	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Oct 30, 2024 15:53:04.493136883 CET	192.168.2.22	8.8.8.8	0xf4ba	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:04.493402004 CET	192.168.2.22	8.8.8.8	0x11b1	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Oct 30, 2024 15:53:58.360825062 CET	192.168.2.22	8.8.8.8	0xbb5c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:58.360995054 CET	192.168.2.22	8.8.8.8	0xd0ab	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	token.onelogin.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		52.72.176.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		3.93.255.10	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		44.195.159.156	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		18.232.196.105	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		34.199.167.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:26.330997944 CET	8.8.8.8	192.168.2.22	0xc3e2	No error (0)	landing.training.knowbe4.com		34.197.84.21	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	token.onelogin.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		3.93.255.10	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		34.199.167.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		52.72.176.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		44.195.159.156	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		18.232.196.105	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.614826918 CET	8.8.8.8	192.168.2.22	0x5225	No error (0)	landing.training.knowbe4.com		34.197.84.21	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:55.617984056 CET	8.8.8.8	192.168.2.22	0x144d	No error (0)	token.onelogin.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		3.93.255.10	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		34.199.167.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		52.72.176.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		44.195.159.156	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		18.232.196.105	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:56.894382954 CET	8.8.8.8	192.168.2.22	0xc69c	No error (0)	secured-login.net		34.197.84.21	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:58.305594921 CET	8.8.8.8	192.168.2.22	0x3910	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:52:58.306624889 CET	8.8.8.8	192.168.2.22	0x961e	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		16.15.176.94	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		16.182.97.120	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		16.182.108.40	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		52.217.125.200	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		52.217.101.230	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		54.231.165.136	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		52.216.61.248	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.241066933 CET	8.8.8.8	192.168.2.22	0x4b9a	No error (0)	s3.amazonaws.com		52.217.126.120	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.243356943 CET	8.8.8.8	192.168.2.22	0x72ec	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.243356943 CET	8.8.8.8	192.168.2.22	0x72ec	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:00.244925976 CET	8.8.8.8	192.168.2.22	0xf113	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 30, 2024 15:53:01.635426998 CET	8.8.8.8	192.168.2.22	0x9da5	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Oct 30, 2024 15:53:01.637970924 CET	8.8.8.8	192.168.2.22	0xc6a8	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.637970924 CET	8.8.8.8	192.168.2.22	0xc6a8	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.637970924 CET	8.8.8.8	192.168.2.22	0xc6a8	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.637970924 CET	8.8.8.8	192.168.2.22	0xc6a8	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.637970924 CET	8.8.8.8	192.168.2.22	0xc6a8	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		3.93.255.10	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		18.232.196.105	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		52.72.176.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		34.197.84.21	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		44.195.159.156	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:01.638859987 CET	8.8.8.8	192.168.2.22	0xdaf9	No error (0)	secured-login.net		34.199.167.68	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.583636999 CET	8.8.8.8	192.168.2.22	0x1fc6	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Oct 30, 2024 15:53:03.585108042 CET	8.8.8.8	192.168.2.22	0x9580	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.585108042 CET	8.8.8.8	192.168.2.22	0x9580	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.585108042 CET	8.8.8.8	192.168.2.22	0x9580	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.585108042 CET	8.8.8.8	192.168.2.22	0x9580	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.585108042 CET	8.8.8.8	192.168.2.22	0x9580	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.588937044 CET	8.8.8.8	192.168.2.22	0xf755	No error (0)	cdn2.hubspot.net		104.18.89.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.588937044 CET	8.8.8.8	192.168.2.22	0xf755	No error (0)	cdn2.hubspot.net		104.18.90.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.588937044 CET	8.8.8.8	192.168.2.22	0xf755	No error (0)	cdn2.hubspot.net		104.18.87.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.588937044 CET	8.8.8.8	192.168.2.22	0xf755	No error (0)	cdn2.hubspot.net		104.18.91.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.588937044 CET	8.8.8.8	192.168.2.22	0xf755	No error (0)	cdn2.hubspot.net		104.18.88.62	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.589901924 CET	8.8.8.8	192.168.2.22	0xb4d	No error (0)	cdn2.hubspot.net			65	IN (0x0001)	false
Oct 30, 2024 15:53:03.593652964 CET	8.8.8.8	192.168.2.22	0xde90	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:53:03.593967915 CET	8.8.8.8	192.168.2.22	0x26d9	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:53:03.593967915 CET	8.8.8.8	192.168.2.22	0x26d9	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:03.593967915 CET	8.8.8.8	192.168.2.22	0x26d9	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:04.500271082 CET	8.8.8.8	192.168.2.22	0xf4ba	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:53:04.500271082 CET	8.8.8.8	192.168.2.22	0xf4ba	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:04.500271082 CET	8.8.8.8	192.168.2.22	0xf4ba	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Oct 30, 2024 15:53:04.501107931 CET	8.8.8.8	192.168.2.22	0x11b1	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 15:53:58.367675066 CET	8.8.8.8	192.168.2.22	0xd0ab	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 15:53:58.367856026 CET	8.8.8.8	192.168.2.22	0xbb5c	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

token.onelogin.com-token-auth.com

https:

secured-login.net

cdnjs.cloudflare.com

s3.amazonaws.com

cdn2.hubspot.net

i.imgur.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	52.72.176.27	443	3336	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:52:27 UTC	612	OUT	GET /XRFZaREExRTA0Wko4MHRSeXFnWEhUUW5oNEF5cFdzN1RvN3dzVzlMWHdHdzlma2Jjc1BNYnNEc1g0WXJQYy9JSWlFVUpIbDE4cGdMcDBLdk54bEZydEJqRTBYdFpoeDZHUGtwZ0tTaVZ3cWZjL2ppVG5KQks1RE0xU21IUzd3PT0tLXVERnZSL2NmN25kNkovUUEtLUIxb3JrOUhOcUxJS1puMmpQNU5DN1E9PQ==?cid=2262276963 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: token.onelogin.com-token-auth.com Connection: Keep-Alive
2024-10-30 14:52:27 UTC	486	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:52:27 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Content-Security-Policy: X-Request-Id: e4ac5faf-7d0f-4629-917e-6834b2e4f7b0 X-Runtime: 0.102716 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:52:56 UTC	1005	OUT	GET /XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963 HTTP/1.1 Host: token.onelogin.com-token-auth.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:52:56 UTC	574	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:52:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 461 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"b0427730fcd85299ada16459c60305e3" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 41b8e52e-b81a-4979-9b60-e66d5d78fbce X-Runtime: 0.100980 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:52:56 UTC	461	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 64 2d 6c 6f 67 69 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 35 62 36 65 32 64 38 37 39 36 31 62 2f 58 53 58 6c 68 63 57 56 58 4e 54 4e 44 65 48 68 75 62 58 4a 4c 55 54 42 77 65 58 46 7a 56 7a 56 4d 57 58 63 72 4d 58 46 51 4d 31 4a 4b 56 58 5a 69 56 7a 4e 49 56 57 55 78 52 33 42 77 56 6a 46 49 55 6d 78 74 61 6b 39 48 4c 33 68 74 4b 33 46 36 54 6c 6c 43 54 56 4e 6c 65 6e 41 76 4e 6c 46 51 63 6e 52 33 61 57 70 6c 54 6c 5a 6c 5a 33 4d 76 51 33 68 57 4d 6a 64 72 52 47 31 42 59 55 35 4e 53 6d 52 36 51 57 4a 69 51 58 5a 4a 5a 30 74 49 65 6d 31 6a 62 6a 67 77 4f 47 30 Data Ascii: <html> <head> <script>window.location.href = 'https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49170	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:52:58 UTC	1360	OUT	GET /pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:00 UTC	954	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:52:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 67300 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"d21d15052544410f779574395de4f2ed" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: c317bf9a-a196-4d50-b467-053e540b5308 X-Runtime: 1.863502 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:00 UTC	15430	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac
2024-10-30 14:53:00 UTC	16384	IN	Data Raw: 2e 36 35 2d 31 37 30 2e 32 38 2d 31 34 2e 39 2d 31 34 39 2e 38 36 2d 32 34 38 2e 33 34 63 31 38 2e 32 35 2d 32 31 31 2e 32 35 2c 35 33 2e 33 32 2d 31 36 37 2e 31 35 2c 37 30 2e 30 38 2d 31 34 38 2e 32 6c 34 2e 33 35 2d 33 36 2e 34 35 0a 09 09 09 09 09 63 33 2e 32 39 2d 32 36 2e 39 39 2c 36 37 2e 32 34 2d 31 39 2e 37 36 2c 36 35 2e 33 38 2c 31 2e 35 32 6c 33 2e 31 34 2d 33 33 2e 33 63 33 2e 33 33 2d 33 35 2e 33 38 2c 37 37 2e 32 37 2d 32 35 2e 31 38 2c 37 35 2e 36 39 2d 31 2e 37 37 6c 2d 32 2e 38 33 2c 34 35 2e 36 38 63 32 2e 39 34 2d 32 35 2e 36 32 2c 36 31 2e 34 2d 33 30 2e 33 2c 35 38 2e 38 38 2c 31 39 2e 38 34 0a 09 09 09 09 09 63 2d 36 2e 38 2c 37 37 2e 37 34 2d 31 34 2e 38 32 2c 31 36 31 2e 34 33 2d 31 37 2e 39 34 2c 31 38 36 2e 33 34 63 32 37 2e 31 Data Ascii: .65-170.28-14.9-149.86-248.34c18.25-211.25,53.32-167.15,70.08-148.2l4.35-36.45c3.29-26.99,67.24-19.76,65.38,1.52l3.14-33.3c3.33-35.38,77.27-25.18,75.69-1.77l-2.83,45.68c2.94-25.62,61.4-30.3,58.88,19.84c-6.8,77.74-14.82,161.43-17.94,186.34c27.1
2024-10-30 14:53:00 UTC	56	IN	Data Raw: e0 a5 87 20 e0 a4 b9 e0 a4 ae e0 a5 87 e0 a4 b6 e0 a4 be 20 e0 a4 a7 e0 a5 8d e2 80 8d e0 a4 af e0 a4 be e0 a4 a8 20 e0 a4 a6 e0 a5 87 e0 a4 82 21 3c 2f 73 70 61 6e 3e Data Ascii: !</span>
2024-10-30 14:53:00 UTC	16384	IN	Data Raw: 3c 2f 68 32 3e 0a 0a 09 09 09 3c 68 32 20 63 6c 61 73 73 3d 22 53 45 49 68 6f 76 65 72 22 20 74 6b 65 79 3d 22 53 45 49 68 6f 76 65 72 22 3e e0 a4 b5 e0 a4 bf e0 a4 b8 e0 a5 8d e0 a4 a4 e0 a5 83 e0 a4 a4 20 e0 a4 b8 e0 a5 82 e0 a4 9a e0 a4 a8 e0 a4 be 20 e0 a4 a6 e0 a5 87 e0 a4 96 e0 a4 a8 e0 a5 87 20 e0 a4 95 e0 a5 87 20 e0 a4 b2 e0 a4 bf e0 a4 8f 20 e0 a4 b2 e0 a4 be e0 a4 b2 20 e0 a4 a7 e0 a5 8d e0 a4 b5 e0 a4 9c e0 a5 8b e0 a4 82 20 e0 a4 aa e0 a4 b0 20 e0 a4 b9 e0 a5 8b e0 a4 b5 e0 a4 b0 20 e0 a4 95 e0 a4 b0 e0 a5 87 e0 a4 82 3a 3c 2f 68 32 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 6f 70 74 69 6f 6e 73 20 68 75 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 Data Ascii: </h2><h2 class="SEIhover" tkey="SEIhover"> :</h2></div></section><section class="options hu"><div clas
2024-10-30 14:53:00 UTC	16384	IN	Data Raw: 64 65 20 65 6d 70 72 65 73 61 73 20 64 65 20 63 6f 6e 66 69 61 6e 7a 61 2e 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 6f 70 74 69 6f 6e 73 20 6d 78 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 69 73 63 6c 61 69 6d 65 72 22 3e 0a 09 09 09 3c 70 20 74 6b 65 79 3d 22 64 69 73 63 6c 61 69 6d 65 72 2d 31 22 3e 54 65 6e 67 61 20 65 6e 20 63 75 65 6e 74 61 20 6c 6f 20 73 69 67 75 69 65 6e 74 65 3a 20 45 73 74 65 20 6d 65 6e 73 61 6a 65 20 70 72 6f 76 69 65 6e 65 20 64 65 20 4b 6e 6f 77 42 65 34 2c 20 49 6e 63 2e 20 4c 61 73 20 6f 72 67 61 6e 69 7a 61 63 69 6f 6e 65 73 20 61 20 6c 61 73 20 71 75 65 20 73 65 20 68 61 63 65 20 72 Data Ascii: de empresas de confianza.</span></p></div></section><section class="options mx"><div class="disclaimer"><p tkey="disclaimer-1">Tenga en cuenta lo siguiente: Este mensaje proviene de KnowBe4, Inc. Las organizaciones a las que se hace r
2024-10-30 14:53:00 UTC	2662	IN	Data Raw: 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 20 4f 6e 65 44 72 69 76 65 20 26 6c 74 6e 6f 2d 72 65 70 6c 79 40 6e 6f 74 69 63 65 2d 6f 6e 65 64 72 69 76 65 2e 63 6f 6d 26 67 74 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 73 74 72 6f 6e 67 3e 53 75 62 6a 65 63 74 3a 26 6e 62 73 70 3b 3c 2f 73 74 72 6f 6e 67 3e 20 3c 78 2d 73 65 69 20 74 69 74 6c 65 3d 22 57 65 72 65 20 79 6f 75 20 65 78 70 65 63 74 69 6e 67 20 61 6e 20 65 6d 61 69 6c 20 66 72 6f 6d 20 74 68 69 73 20 73 65 6e 64 65 72 3f 22 3e 27 57 65 65 6b 6c 79 20 46 69 6e 61 6e 63 65 73 20 52 65 70 6f 72 74 27 20 68 61 73 20 62 65 65 6e 20 73 68 61 72 65 64 20 77 69 74 68 20 79 6f 75 3c 2f 78 2d 73 65 69 3e 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 6d Data Ascii: /strong></span> OneDrive &ltno-reply@notice-onedrive.com&gt</div> <div><strong>Subject: </strong> <x-sei title="Were you expecting an email from this sender?">'Weekly Finances Report' has been shared with you</x-sei></div> <div id="m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49169	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	959	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:00 UTC	263	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:00 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:00 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49178	104.17.24.14	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	923	OUT	GET /ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	943	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:00 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb04010-1d970" Last-Modified: Mon, 04 May 2020 16:17:20 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 629324 Expires: Mon, 20 Oct 2025 14:53:00 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H1DBz5T7u3fC8T24vtSvu9WZnR1DSkMjLQpc3qKddJaEUDqq99f1m2GVTcqSSWsOfU3kHy5hODeMk9N%2B8XNxeUQq444xBXXeZhR8%2FV1YgpQCkjVzzRjg8nKPeZXWlheN0zpZUQst"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8dac3b80d8f4e81b-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 14:53:01 UTC	426	IN	Data Raw: 33 39 38 38 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 33 2e 37 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 36 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 33 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 68 74 6d 6c 7b Data Ascii: 3988/! Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d 7b 62 6f 72 64 65 72 2d 62 6f 74 Data Ascii: tion,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bot
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 75 74 6f 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 7d 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 66 69 Data Ascii: uto}input[type=search]{-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}fi
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 64 20 23 64 64 64 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 47 6c 79 70 68 69 63 6f 6e 73 20 48 61 6c 66 6c 69 6e 67 73 27 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 67 6c 79 70 68 69 63 6f 6e 73 2d 68 61 6c 66 6c 69 6e 67 73 2d 72 65 67 75 6c 61 72 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 Data Ascii: d #ddd!important}}@font-face{font-family:'Glyphicons Halflings';src:url(../fonts/glyphicons-halflings-regular.eot);src:url(../fonts/glyphicons-halflings-regular.eot?#iefix) format('embedded-opentype'),url(../fonts/glyphicons-halflings-regular.woff2) forma
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 6c 79 70 68 69 63 6f 6e 2d 74 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 7a 6f 6f 6d 2d 6f 75 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 31 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6f 66 66 3a Data Ascii: lyphicon-th:before{content:"\e011"}.glyphicon-th-list:before{content:"\e012"}.glyphicon-ok:before{content:"\e013"}.glyphicon-remove:before{content:"\e014"}.glyphicon-zoom-in:before{content:"\e015"}.glyphicon-zoom-out:before{content:"\e016"}.glyphicon-off:
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 61 72 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 61 6d 65 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6f 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 62 6f 6c 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 69 74 61 6c 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 34 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 65 78 74 2d 68 65 69 67 68 74 3a 62 65 66 6f 72 Data Ascii: ark:before{content:"\e044"}.glyphicon-print:before{content:"\e045"}.glyphicon-camera:before{content:"\e046"}.glyphicon-font:before{content:"\e047"}.glyphicon-bold:before{content:"\e048"}.glyphicon-italic:before{content:"\e049"}.glyphicon-text-height:befor
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 65 70 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 65 6a 65 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 37 39 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 30 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 6c 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 69 6e 75 73 2d 73 69 67 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 30 38 Data Ascii: ep-forward:before{content:"\e077"}.glyphicon-eject:before{content:"\e078"}.glyphicon-chevron-left:before{content:"\e079"}.glyphicon-chevron-right:before{content:"\e080"}.glyphicon-plus-sign:before{content:"\e081"}.glyphicon-minus-sign:before{content:"\e08
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 63 6f 6e 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 68 65 76 72 6f 6e 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 72 65 74 77 65 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 31 Data Ascii: con-comment:before{content:"\e111"}.glyphicon-magnet:before{content:"\e112"}.glyphicon-chevron-up:before{content:"\e113"}.glyphicon-chevron-down:before{content:"\e114"}.glyphicon-retweet:before{content:"\e115"}.glyphicon-shopping-cart:before{content:"\e11
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 31 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 61 70 65 72 63 6c 69 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 32 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 68 65 61 72 74 2d 65 6d 70 74 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 6c 69 6e 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 68 6f 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 70 75 73 68 70 69 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 34 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 75 73 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 Data Ascii: {content:"\e141"}.glyphicon-paperclip:before{content:"\e142"}.glyphicon-heart-empty:before{content:"\e143"}.glyphicon-link:before{content:"\e144"}.glyphicon-phone:before{content:"\e145"}.glyphicon-pushpin:before{content:"\e146"}.glyphicon-usd:before{conte
2024-10-30 14:53:01 UTC	1369	IN	Data Raw: 74 3a 22 5c 65 31 37 33 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 34 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 73 61 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 35 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 66 6c 6f 70 70 79 2d 6f 70 65 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 36 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 72 65 64 69 74 2d 63 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 37 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 74 72 61 6e 73 66 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 65 31 37 38 22 7d 2e 67 6c 79 70 68 69 63 6f 6e 2d 63 75 74 6c 65 Data Ascii: t:"\e173"}.glyphicon-floppy-remove:before{content:"\e174"}.glyphicon-floppy-save:before{content:"\e175"}.glyphicon-floppy-open:before{content:"\e176"}.glyphicon-credit-card:before{content:"\e177"}.glyphicon-transfer:before{content:"\e178"}.glyphicon-cutle

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49174	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	952	OUT	GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	263	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:00 GMT Content-Type: text/css Content-Length: 5934 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:01 UTC	5934	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 32 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 73 65 69 2d 73 74 79 6c 65 73 2e 73 63 73 73 20 2a 2f 0a 78 2d 73 65 69 2e 73 65 69 2d 66 6c 61 67 20 7b 0a 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 6f 6d 61 74 6f 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 33 70 78 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 36 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 73 65 69 2d 73 74 79 6c 65 73 2e 73 63 73 73 20 2a 2f 0a 78 2d 73 65 69 2e 73 65 69 2d 66 6c 61 67 3a 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 27 20 27 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 62 61 63 6b 67 Data Ascii: /* line 2, app/assets/stylesheets/sei-styles.scss /x-sei.sei-flag { border-bottom: 2px solid tomato; padding-left: 3px;}/ line 6, app/assets/stylesheets/sei-styles.scss */x-sei.sei-flag::before { content: ' '; display: inline-block; backg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49175	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	959	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 14:53:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 5dea109c-91de-41ac-8417-193cf15c55d5 X-Runtime: 0.012093 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:01 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	16.15.176.94	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	896	OUT	GET /helpimg/landing_pages/css/dd.css HTTP/1.1 Host: s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	468	IN	HTTP/1.1 200 OK x-amz-id-2: L0OUH+HVHi5ql2dS+c76Q+E0ARGRAdsl9K5syxe2zLV3aJweP8umfY6JtFaFOIk79KPDhxK2Q2B4IL0KvxSMDZkY+PUgJdz7tgplWEzrAdA= x-amz-request-id: TKQX32SHS8HNFWZN Date: Wed, 30 Oct 2024 14:53:02 GMT x-amz-replication-status: COMPLETED Last-Modified: Tue, 08 Aug 2017 20:12:22 GMT ETag: "dd05b711e15ef201b07e20cb5c87f5d8" x-amz-version-id: null Accept-Ranges: bytes Content-Type: text/css Content-Length: 4524 Server: AmazonS3 Connection: close
2024-10-30 14:53:01 UTC	4524	IN	Data Raw: 2e 62 6f 72 64 65 72 52 61 64 69 75 73 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 20 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 54 70 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 30 20 30 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 2e 62 6f 72 64 65 72 52 61 64 69 75 73 42 74 6d 7b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 35 70 78 20 35 70 78 20 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 20 35 70 78 20 35 70 78 20 35 70 78 3b 7d 0d 0a 0d 0a 2e 64 64 63 6f 6d 6d 6f 6e 20 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b Data Ascii: .borderRadius{-moz-border-radius:5px; border-radius:5px; }.borderRadiusTp{-moz-border-radius:5px 5px 0 0; border-radius:5px 5px 5px 5px;}.borderRadiusBtm{-moz-border-radius:0 0 5px 5px ; border-radius:5px 5px 5px 5px;}.ddcommon {position:relative;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49173	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	938	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:01 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:01 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-10-30 14:53:01 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-10-30 14:53:01 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49172	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	938	OUT	GET /assets/application-3ab7c63a41a8761925d45817a71fb79e0ef7208b59de505ac640c8a2a183ec19.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 14:53:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 83b81354-4f93-44e6-9127-bc453b7348fc X-Runtime: 0.011320 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:01 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49179	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:00 UTC	891	OUT	GET /packs/js/vendor-69f70dd3792dc7287ac8.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:01 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 14:53:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: b5b98189-7538-4a33-a893-bdb834a454b0 X-Runtime: 0.016110 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:01 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49182	104.18.90.62	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:02 UTC	955	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:02 UTC	1331	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:02 GMT Content-Type: image/webp Content-Length: 2368 Connection: close CF-Ray: 8dac3b898bc6143e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 439386 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 Content-Disposition: inline; filename="KB4-logo.webp" ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 f16991a19cc348d88a5c4397ded6f796.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origFmt=png, origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: dJkFMcwrbypnu2ML92qh5WVS1OnFwGwP4Hepb3IF-WntYHugw5pwKA== X-Amz-Cf-Pop: DFW57-P8 x-amz-id-2: 6qsrcCwQxGmu7LjmEjndwQ77qeF7N5PBNvM2UcXuFg/XDapr+yevNXFIKVwBLvvOh1KSfu4dP0o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5YJ3T69DCK953F32 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING
2024-10-30 14:53:02 UTC	595	IN	Data Raw: 78 2d 61 6d 7a 2d 76 65 72 73 69 6f 6e 2d 69 64 3a 20 47 4f 75 41 4a 7a 41 31 2e 62 6f 31 76 6a 6f 74 5f 48 73 71 30 6f 77 45 59 39 38 58 6a 59 48 39 0d 0a 58 2d 43 61 63 68 65 3a 20 4d 69 73 73 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c Data Ascii: x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9X-Cache: Miss from cloudfrontX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel
2024-10-30 14:53:02 UTC	812	IN	Data Raw: 52 49 46 46 38 09 00 00 57 45 42 50 56 50 38 4c 2c 09 00 00 2f c7 40 09 10 e2 30 90 b6 4d e3 5f f8 77 07 11 31 01 e9 57 56 61 55 0f 57 2c 4b db b6 fe 6d 93 a3 7d bc 4a da 5d 8f 80 97 3d 83 ee 3a 5d f7 44 7a 0e 3d 80 9e 01 fd 7e bf ef f7 fd ff 1e 4d b7 4f c9 50 6e 65 58 28 0c e6 e0 bf 0c f2 84 99 93 7f 33 d6 34 cc cc cc cc 8c 8a 03 0a 93 1c 86 3b 8c 66 3b 9c 98 49 32 d3 df 4c 1a cf fc b3 89 24 5b 4a ff 1f df f9 77 41 91 61 00 1d e4 97 05 2c e1 04 11 d8 40 02 24 db a6 5d d9 b6 6d db b6 6d db b6 6d db b6 ed a4 6c db 4e be 6d 63 4f 00 d4 6c db 96 2d db fe b8 bb 5b 74 a9 ae dd 35 b9 bb d3 dc 2d b9 25 97 01 fe 01 d8 82 41 1c 66 20 f9 0a 44 16 60 02 5f 40 2b c7 71 b5 3f fd 03 e0 f5 e9 38 0c d0 7f 28 b6 b5 2d ab 5e dc 69 96 2c b9 0e c0 5d 66 a0 c9 61 0c d0 a0 d1 Data Ascii: RIFF8WEBPVP8L,/@0M_w1WVaUW,Km}J]=:]Dz=~MOPneX(34;f;I2L$[JwAa,@$]mmmlNmcOl-[t5-%Af D`_@+q?8(-^i,]fa
2024-10-30 14:53:02 UTC	1369	IN	Data Raw: 5d 88 8a 49 a8 c7 90 06 f5 1d 7e 1e 65 84 5a 04 54 a0 03 55 06 c0 43 aa 4f 45 be 5b bb f8 86 0b 01 f5 5a 71 06 a9 46 e8 a0 68 63 cd 57 df e0 2c 45 e5 7c aa 42 75 c1 8e 2a 53 51 3b b9 c9 60 e0 61 02 c5 f5 10 f0 8d 0b 7c ff 0b 3f fc c3 84 7d 0f df be 43 4f 58 34 c0 f6 e6 c0 95 21 7b 27 50 c2 01 4a 05 38 3a 86 e2 55 eb 80 9a ac 04 5c 00 b4 53 b1 7b 38 55 31 dd 00 a8 cb 11 01 4a 02 50 f1 4e 2a 8a 5f d5 fd a9 39 4c e1 1e 0e bd 95 b2 23 3c 03 83 8f 76 a6 e2 6e 07 bd f6 4d b9 e5 13 38 1e fb 23 23 df 72 8a fc 5d 5c 14 9c 65 7c ed e2 12 ba af 44 ce 74 89 40 01 b7 ad b4 d5 19 fc a3 92 a5 68 80 87 40 25 07 a8 3c 50 77 ce ea 38 25 f9 b6 d2 53 71 6a 19 60 d6 08 67 5f 7f 2d 5c bb 89 b3 2b aa 1a 50 69 59 95 db 41 3d 28 cc 94 c5 40 a7 a0 d2 c6 80 8a 76 0c e8 35 c0 81 fd Data Ascii: ]I~eZTUCOE[ZqFhcW,E\|BuSQ;`a\|?}COX4!{'PJ8:U\S{8U1JPN_9L#<vnM8##r]\e\|Dt@h@%<Pw8%Sqj`g_-\+PiYA=(@v5
2024-10-30 14:53:02 UTC	187	IN	Data Raw: 16 9d b7 04 3e 1c 55 38 57 7e ff 61 98 fa d6 54 72 68 d7 83 80 83 1a 42 2a ea 05 f0 bf 9a 3c 79 a7 2b ff 8a 03 1b 17 b7 23 ef 93 c5 e7 ad 81 df 6d 54 38 bb d3 bc fa ac b5 4f 1b ef 9c 6f 01 c3 1c 7c 14 a0 fa 5d 08 b5 d3 34 d4 39 37 bf 75 c7 b0 ab ff 5a a0 07 4f 79 f7 bc 7c a5 41 e5 6a 65 bf d2 1e d4 a5 cb c4 3c 75 b5 17 cc 0e b1 f7 b8 b4 e3 84 05 0b 0e bd 73 d7 11 ce 3d a0 ed bd 6d 15 63 d8 f5 17 ec 5e 7b 7a d0 bf 94 d3 f1 aa fa 93 1e 6d d4 dd 67 87 b7 f9 db 95 6f 28 a3 8d 56 01 21 e6 d0 33 3b aa e1 3f 9f bc 41 9b 35 97 76 ec f9 b1 e3 de ab d5 5b 9b e3 00 Data Ascii: >U8W~aTrhB*<y+#mT8Oo\|]497uZOy\|Aje<us=mc^{zmgo(V!3;?A5v[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49184	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:02 UTC	959	OUT	GET /assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:03 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 14:53:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 4043fdf1-8209-4be4-b50c-fab093f3a264 X-Runtime: 0.011199 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:03 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49183	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:02 UTC	427	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:03 UTC	279	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:02 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:03 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-10-30 14:53:03 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-10-30 14:53:03 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49180	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:02 UTC	936	OUT	GET /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:03 UTC	514	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 14:53:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-cache Content-Security-Policy: X-Request-Id: d0786649-de60-49ab-a759-38873ef78c11 X-Runtime: 0.014256 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:03 UTC	9	IN	Data Raw: 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49185	104.18.90.62	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:04 UTC	385	OUT	GET /hubfs/241394/html_file/files/img/KB4-logo.png HTTP/1.1 Host: cdn2.hubspot.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:04 UTC	1345	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:04 GMT Content-Type: image/png Content-Length: 3014 Connection: close CF-Ray: 8dac3b95db071445-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 439388 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ddf47be00ad3eebaabd63fec4c5733f2" Last-Modified: Fri, 29 Mar 2024 19:46:11 GMT Vary: Accept Via: 1.1 f16991a19cc348d88a5c4397ded6f796.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: origSize=3873 Edge-Cache-Tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL Timing-Allow-Origin: cdn2.hubspot.net X-Amz-Cf-Id: dJkFMcwrbypnu2ML92qh5WVS1OnFwGwP4Hepb3IF-WntYHugw5pwKA== X-Amz-Cf-Pop: DFW57-P8 x-amz-id-2: 6qsrcCwQxGmu7LjmEjndwQ77qeF7N5PBNvM2UcXuFg/XDapr+yevNXFIKVwBLvvOh1KSfu4dP0o= x-amz-meta-access-tag: public-not-indexable x-amz-meta-cache-tag: F-3711502880,FD-3711502755,P-241394,FLS-ALL x-amz-meta-created-unix-time-millis: 1447343595191 x-amz-meta-index-tag: none x-amz-replication-status: COMPLETED x-amz-request-id: 5YJ3T69DCK953F32 x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: GOuAJzA1.bo1vjot_Hsq0owEY98XjYH9 X-Cache: Miss from cloudfront
2024-10-30 14:53:04 UTC	506	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 6e 6f 6e 65 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 4b 47 57 4a 49 32 50 51 34 25 32 42 66 63 45 62 50 30 70 68 25 32 46 61 65 55 54 61 48 63 37 38 44 38 58 45 66 6e 56 32 41 39 4a 75 54 56 67 54 64 7a 67 25 32 Data Ascii: X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: noneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KGWJI2PQ4%2BfcEbP0ph%2FaeUTaHc78D8XEfnV2A9JuTVgTdzg%2
2024-10-30 14:53:04 UTC	887	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 26 08 06 00 00 00 81 16 d4 6c 00 00 0b 8d 49 44 41 54 78 da ec da 7b 68 97 55 1c c7 71 f7 9b b7 4d 73 22 65 a9 65 6a 2c bb 98 4d cc 2c 5d 28 26 d4 e8 42 17 b0 12 29 47 e2 46 9a b8 84 32 f3 32 32 6f 59 ce d4 c2 14 91 d4 4c 12 25 c3 b4 0b 16 69 46 a6 a5 2e 99 97 92 4c a7 65 da 98 64 73 6e ce 4f 6f f0 40 a7 83 3f f7 9c df cf 07 f6 1b cf 81 d7 1f db 79 be cf d9 73 9e f3 f9 3d 97 fd 9a 44 2d 6a 51 bb 44 d3 c8 26 43 31 dc c8 4d 72 5f 39 18 6e e9 1e cd 70 83 38 c7 57 a1 00 c5 78 17 eb b0 05 a5 38 64 ec c7 4e 6c c2 62 8c c5 3d 68 d6 08 e7 62 3c 16 60 06 ba d7 57 20 cb 47 49 0c 9c 8d 53 90 51 8e f6 d1 f2 6c 10 8b 62 20 94 a0 0a cc 47 e7 46 32 17 2b 20 a3 12 ed 43 0f 08 75 99 f8 09 32 6a d1 3f 5a Data Ascii: PNGIHDR&lIDATx{hUqMs"eej,M,](&B)GF222oYL%iF.LedsnOo@?ys=D-jQD&C1Mr_9np8Wx8dNlb=hb<`W GISQlb GF2+ Cu2j?Z
2024-10-30 14:53:04 UTC	1369	IN	Data Raw: 3e b9 3b 9a ee 64 03 b2 10 1f 3a b7 4f b3 d0 29 4e ed 20 94 fb 5c c9 e8 bf 05 95 10 80 d7 73 a5 f2 52 d5 db aa 2a a5 55 63 44 98 dc 90 64 3b 63 74 87 2c 2b 3c e6 63 3b 04 57 ef 80 f5 83 21 4b cf 24 02 e2 d6 dd 86 ef 20 cb 67 88 05 ac 2f 80 2c 35 98 54 cf f3 67 37 6c 84 2c 07 90 19 70 cc bb 20 cb 94 38 db 5d 83 fe c8 43 5f 34 f7 0e 08 3f 5f 81 03 90 51 87 7b 4d 77 d2 01 71 1e f8 cb d1 33 40 fd ad a8 81 8c 0a b4 8c b3 6d 2b ec 83 00 b0 e0 75 be 4e 12 ed 5c 8d b4 ed 7d 69 c9 30 69 6a 2f e9 d5 db a5 f9 0f 48 1b a6 4b 15 47 64 da 85 2b ca e8 4c 7b 9e 76 a3 a5 33 d6 5e e7 53 2f 16 e0 58 ae 85 2c 76 90 a7 06 9c cf 39 90 f1 6b c0 b7 58 b3 91 03 57 2e 1e c6 64 7c 03 39 d6 7a 2c d4 6e ce 6d 59 35 06 05 ac 8d 61 31 64 99 1e a4 ce 79 4e fe 0d 19 71 b6 2d 86 2c 5d bc Data Ascii: >;d:O)N \sR*UcDd;ct,+<c;W!K$ g/,5Tg7l,p 8]C_4?_Q{Mwq3@m+uN\}i0ij/HKGd+L{v3^S/X,v9kXW.d\|9z,nmY5a1dyNq-,]
2024-10-30 14:53:04 UTC	758	IN	Data Raw: 44 b0 a7 c1 b7 df b1 00 c4 71 17 6c 31 08 8a 4e 13 81 e0 3c b3 07 da be 9c 22 02 c1 11 d8 9e cd 25 24 c5 f9 bb 9a 9b e4 96 1e 0e 7d dc ef 92 b3 35 3d 46 34 9a 14 66 2b f1 a9 6e 86 84 82 04 0b 24 0f 63 63 9a 3a 2d ea ba 81 c9 f0 51 1c 69 90 40 19 24 5d c6 02 01 9f ff 15 98 0b cf 49 21 81 2c 64 c8 0e f1 84 75 b6 93 53 7e fa 8a 0c e2 1c 27 21 e3 18 b3 7e ff 62 42 31 9e f1 18 ba d6 c5 93 44 c2 d9 44 6d b9 1d 22 d6 f3 9d a6 4e 0d d4 99 e6 f3 01 70 1b 99 1a 4b 50 64 3b 35 75 d6 d9 9e 8b b5 1a da f7 32 85 29 22 90 0c e6 17 6b 81 bc 75 df 60 8a 49 f7 ef 4e 2c c4 6b 7e 91 44 ab 49 38 a5 f1 ba 6c f3 f0 8c 6b 21 cd 3e 04 fd 56 27 41 20 75 d0 d7 6b 1e 72 e5 f6 5e 93 f4 12 fc 22 dd ad fd 2e e8 a3 95 19 9b 24 81 60 9d 79 0c 59 b3 63 11 d1 c6 22 fc f9 8c 18 f7 37 19 33 Data Ascii: Dql1N<"%$}5=F4f+n$cc:-Qi@$]I!,duS~'!~bB1DDm"NpKPd;5u2)"ku`IN,k~DI8lk!>V'A ukr^".$`yYc"73

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49186	199.232.196.193	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:04 UTC	916	OUT	GET /QRF01zv.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:04 UTC	725	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1666 Content-Type: image/png Last-Modified: Wed, 17 Jul 2019 19:34:43 GMT ETag: "29d583007fcd677aa31ca849478bc17a" X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: _hKeuoxVkYw2QVgTw3r9CekWpMNFy7-2eWH7Tb40OtTj_WUPnqXoZQ== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 30 Oct 2024 14:53:04 GMT Age: 2528110 X-Served-By: cache-iad-kiad7000070-IAD, cache-dfw-kdfw8210101-DFW X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 31794, 1 X-Timer: S1730299984.422235,VS0,VE2 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2024-10-30 14:53:04 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 06 49 49 44 41 54 68 81 e5 9b 7b 88 56 45 14 c0 7f fb ed aa 59 a2 45 b9 bd b4 a7 95 8f b4 55 76 15 42 c9 f2 91 d4 1a 3d a8 20 2a 7b a8 f5 a7 19 65 65 a4 a5 92 f9 47 12 25 84 9a 88 a6 48 2f 29 92 55 52 31 5b c9 47 99 94 99 64 c6 1a be 12 5f 6d 19 d5 da d6 1f e7 7e 3a f7 7c f7 31 33 f7 1a 7e f4 83 65 ef 99 3b 73 ee 9c ef de 3b 67 e6 cc b9 15 0b 17 2e 26 67 0a 40 05 f0 77 c4 b9 47 81 e7 81 4b 81 7f 80 ef 80 c9 c0 7b 11 75 2b 81 d6 a0 5e ae 9d cb 93 6b 80 c5 c0 c0 88 73 2b 81 b9 c0 65 c8 0f 52 00 7a 01 ef 02 8b 22 ea 8f 04 16 00 17 e4 d9 c1 bc 0c be 05 d8 04 6c 07 7a 00 9f aa f3 ef 03 43 12 da df 07 bc a9 ca 56 01 23 80 7d c8 8f 35 28 8f 8e 66 35 f8 4e 60 Data Ascii: PNGIHDR<<:rIIDATh{VEYEUvB= *{eeG%H/)UR1[Gd_m~:\|13~e;s;g.&g@wGK{u+^ks+eRz"lzCV#}5(f5N`
2024-10-30 14:53:04 UTC	295	IN	Data Raw: 65 c8 bb 93 94 4c 52 4f 78 cb 66 11 fe 81 05 90 dc 2f 33 f3 6e 10 c9 23 f4 7e e0 5a 2c 26 3e b6 8b 87 46 e4 5b 85 6f 13 ea 3c a4 e4 59 96 ba a3 78 55 c9 a3 13 ea ae 21 bd 6f 27 70 59 2d 1d 42 7e c5 39 31 e7 47 23 33 a1 22 6f 10 5e b8 db b2 81 70 b2 ea 25 c8 37 11 51 4c 41 e6 ee d6 e1 25 9f e5 e1 58 64 4f 59 af 88 3a 13 76 05 2d 44 24 86 59 a0 13 e3 9e a0 74 dd be 17 71 87 2f b8 2a f7 5d 0f 7f 88 84 4c c6 10 0e f5 4c 25 1c 6f 5a 80 7c ba 63 cb 8b 48 0a 70 91 de 84 3f fc d8 03 dc 8b ec 17 af 75 d0 7b 82 ac 01 80 b9 48 6e d7 38 64 0b f3 4c 60 a1 aa 33 06 f8 cc 42 d7 52 4a 13 42 df 0e fe 37 21 af 4c 17 82 65 9e 2f 79 45 3c 5e 43 ee ec 08 a0 1d a5 33 a2 7a 24 4d 3f 8e 46 4a 3f f5 a9 47 fc ea 40 24 9f e3 ad 3c 3a 9a 77 88 67 05 32 88 68 f7 d0 8c 2c 25 a7 23 91 Data Ascii: eLROxf/3n#~Z,&>F[o<YxU!o'pY-B~91G#3"o^p%7QLA%XdOY:v-D$Ytq/*]LL%oZ\|cHp?u{Hn8dL`3BRJB7!Le/yE<^C3z$M?FJ?G@$<:wg2h,%#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49192	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:04 UTC	750	OUT	GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:04 UTC	241	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:04 GMT Content-Type: image/png Content-Length: 3168 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:04 UTC	3168	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 f0 08 06 00 00 00 3e 55 e9 92 00 00 0c 27 49 44 41 54 78 da ed 9d 5d 88 5c e5 19 80 65 09 21 88 48 90 10 42 2f 4a 08 22 22 22 52 8a 84 52 a4 88 14 e9 45 29 22 d2 0b 2f 8a 17 22 e2 85 48 10 11 33 73 e6 cc 99 99 9d cc fe 26 ec 4f c2 0e 9b dd 64 0d 51 4a 13 4c 8c 89 11 11 1b ac 50 ed 85 6d a5 55 bb 8d 75 b3 51 b3 99 24 9b ec ee fc ad 7d bf 35 17 a9 4d 9c dd ec ec bc df 7b f6 79 e0 21 41 e2 ce 9c ef 7c cf 7c df d9 d9 33 7b cb 2d 4d e6 db ed db bf 6d a6 cd 7e 7e 00 f0 03 10 30 80 61 08 18 c0 30 04 0c 60 18 02 06 30 0c 01 03 18 86 80 01 0c 43 c0 00 86 21 60 00 c3 10 30 80 61 08 18 c0 30 04 bc 3c fe 7a fc f8 ba 0b 03 03 77 cd 74 74 3c 58 ce 66 1f ab 66 b3 4f cd 66 b3 2f d6 a2 28 51 4b 26 73 e5 Data Ascii: PNGIHDR>U'IDATx]\e!HB/J"""RRE)"/"H3s&OdQJLPmUuQ$}5M{y!A\|\|3{-Mm~~0a0`0C!`0a0<zwtt<XffOf/(QK&s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49193	199.232.192.193	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:05 UTC	346	OUT	GET /QRF01zv.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:05 UTC	725	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1666 Content-Type: image/png Last-Modified: Wed, 17 Jul 2019 19:34:43 GMT ETag: "29d583007fcd677aa31ca849478bc17a" X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: _hKeuoxVkYw2QVgTw3r9CekWpMNFy7-2eWH7Tb40OtTj_WUPnqXoZQ== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 30 Oct 2024 14:53:05 GMT Age: 2528111 X-Served-By: cache-iad-kiad7000070-IAD, cache-dfw-kdal2120104-DFW X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 31794, 2 X-Timer: S1730299985.295608,VS0,VE0 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2024-10-30 14:53:05 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3c 00 00 00 3c 08 06 00 00 00 3a fc d9 72 00 00 06 49 49 44 41 54 68 81 e5 9b 7b 88 56 45 14 c0 7f fb ed aa 59 a2 45 b9 bd b4 a7 95 8f b4 55 76 15 42 c9 f2 91 d4 1a 3d a8 20 2a 7b a8 f5 a7 19 65 65 a4 a5 92 f9 47 12 25 84 9a 88 a6 48 2f 29 92 55 52 31 5b c9 47 99 94 99 64 c6 1a be 12 5f 6d 19 d5 da d6 1f e7 7e 3a f7 7c f7 31 33 f7 1a 7e f4 83 65 ef 99 3b 73 ee 9c ef de 3b 67 e6 cc b9 15 0b 17 2e 26 67 0a 40 05 f0 77 c4 b9 47 81 e7 81 4b 81 7f 80 ef 80 c9 c0 7b 11 75 2b 81 d6 a0 5e ae 9d cb 93 6b 80 c5 c0 c0 88 73 2b 81 b9 c0 65 c8 0f 52 00 7a 01 ef 02 8b 22 ea 8f 04 16 00 17 e4 d9 c1 bc 0c be 05 d8 04 6c 07 7a 00 9f aa f3 ef 03 43 12 da df 07 bc a9 ca 56 01 23 80 7d c8 8f 35 28 8f 8e 66 35 f8 4e 60 Data Ascii: PNGIHDR<<:rIIDATh{VEYEUvB= *{eeG%H/)UR1[Gd_m~:\|13~e;s;g.&g@wGK{u+^ks+eRz"lzCV#}5(f5N`
2024-10-30 14:53:05 UTC	295	IN	Data Raw: 65 c8 bb 93 94 4c 52 4f 78 cb 66 11 fe 81 05 90 dc 2f 33 f3 6e 10 c9 23 f4 7e e0 5a 2c 26 3e b6 8b 87 46 e4 5b 85 6f 13 ea 3c a4 e4 59 96 ba a3 78 55 c9 a3 13 ea ae 21 bd 6f 27 70 59 2d 1d 42 7e c5 39 31 e7 47 23 33 a1 22 6f 10 5e b8 db b2 81 70 b2 ea 25 c8 37 11 51 4c 41 e6 ee d6 e1 25 9f e5 e1 58 64 4f 59 af 88 3a 13 76 05 2d 44 24 86 59 a0 13 e3 9e a0 74 dd be 17 71 87 2f b8 2a f7 5d 0f 7f 88 84 4c c6 10 0e f5 4c 25 1c 6f 5a 80 7c ba 63 cb 8b 48 0a 70 91 de 84 3f fc d8 03 dc 8b ec 17 af 75 d0 7b 82 ac 01 80 b9 48 6e d7 38 64 0b f3 4c 60 a1 aa 33 06 f8 cc 42 d7 52 4a 13 42 df 0e fe 37 21 af 4c 17 82 65 9e 2f 79 45 3c 5e 43 ee ec 08 a0 1d a5 33 a2 7a 24 4d 3f 8e 46 4a 3f f5 a9 47 fc ea 40 24 9f e3 ad 3c 3a 9a 77 88 67 05 32 88 68 f7 d0 8c 2c 25 a7 23 91 Data Ascii: eLROxf/3n#~Z,&>F[o<YxU!o'pY-B~91G#3"o^p%7QLA%XdOY:v-D$Ytq/*]LL%oZ\|cHp?u{Hn8dL`3BRJB7!Le/yE<^C3z$M?FJ?G@$<:wg2h,%#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49195	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:05 UTC	425	OUT	GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:05 UTC	241	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:05 GMT Content-Type: image/png Content-Length: 3168 Connection: close Last-Modified: Tue, 29 Oct 2024 18:23:42 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-10-30 14:53:05 UTC	3168	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 f0 08 06 00 00 00 3e 55 e9 92 00 00 0c 27 49 44 41 54 78 da ed 9d 5d 88 5c e5 19 80 65 09 21 88 48 90 10 42 2f 4a 08 22 22 22 52 8a 84 52 a4 88 14 e9 45 29 22 d2 0b 2f 8a 17 22 e2 85 48 10 11 33 73 e6 cc 99 99 9d cc fe 26 ec 4f c2 0e 9b dd 64 0d 51 4a 13 4c 8c 89 11 11 1b ac 50 ed 85 6d a5 55 bb 8d 75 b3 51 b3 99 24 9b ec ee fc ad 7d bf 35 17 a9 4d 9c dd ec ec bc df 7b f6 79 e0 21 41 e2 ce 9c ef 7c cf 7c df d9 d9 33 7b cb 2d 4d e6 db ed db bf 6d a6 cd 7e 7e 00 f0 03 10 30 80 61 08 18 c0 30 04 0c 60 18 02 06 30 0c 01 03 18 86 80 01 0c 43 c0 00 86 21 60 00 c3 10 30 80 61 08 18 c0 30 04 bc 3c fe 7a fc f8 ba 0b 03 03 77 cd 74 74 3c 58 ce 66 1f ab 66 b3 4f cd 66 b3 2f d6 a2 28 51 4b 26 73 e5 Data Ascii: PNGIHDR>U'IDATx]\e!HB/J"""RRE)"/"H3s&OdQJLPmUuQ$}5M{y!A\|\|3{-Mm~~0a0`0C!`0a0<zwtt<XffOf/(QK&s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49196	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:06 UTC	923	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/5b6e2d87961b/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:06 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:06 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Tue, 29 Oct 2024 18:24:44 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49198	3.93.255.10	443	3780	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 14:53:07 UTC	352	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 14:53:08 UTC	253	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 14:53:08 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Tue, 29 Oct 2024 18:24:44 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Target ID:	0
Start time:	10:52:23
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fc30000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:52:51
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x13f380000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:52:52
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1212,i,1849172356153250680,5987038015233001814,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x13f380000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:52:54
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://token.onelogin.com-token-auth.com/XSXlhcWVXNTNDeHhubXJLUTBweXFzVzVMWXcrMXFQM1JKVXZiVzNIVWUxR3BwVjFIUmxtak9HL3htK3F6TllCTVNlenAvNlFQcnR3aWplTlZlZ3MvQ3hWMjdrRG1BYU5NSmR6QWJiQXZJZ0tIem1jbjgwOG00KzVnZS9LQUsxOWt5LzhablRVeVdNYTJ4WjM4RFFXTVpoZGc0bkFjSjdUNHlQTE4xR0pNTG51QUQ1ekdvRUtldFhPazl3PT0tLVhreWZjSlpEVHVtaVpaOTItLVJQeDRBeGFkOGhrTmc4S0xIR3cwcmc9PQ==?cid=2262276963"
Imagebase:	0x13f380000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report weekly-finances-report.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9EB13272.jpg

C:\Users\user\Desktop\AA830000

C:\Users\user\Desktop\AA830000:Zone.Identifier

C:\Users\user\Desktop\weekly-finances-report.xlsx (copy)

C:\Users\user\Desktop\~$weekly-finances-report.xlsx

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Windows Analysis Report
weekly-finances-report.xlsx