Edit tour

macOS Analysis Report
18037.doc

Overview

General Information

Sample name:	18037.doc
Analysis ID:	1574962
MD5:	592b5d0b7e4153d92e0d9c4ff3e9116c
SHA1:	82838e835531cde974734288c05f375002073274
SHA256:	d7d77cba0c087f438e5bbc7bc2764df7aec0aa22d2832260797fb565160195bf
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Office spawns shell processes

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Executes commands using a shell command-line interpreter

Opens the Safari browser app

Reads hardware related sysctl values

Reads the systems OS release and/or type

Reads the systems hostname

Uses AppleScript framework/components containing Apple Script related functionalities

Uses AppleScript scripting additions containing additional functionalities for Apple Scripts

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574962
Start date and time:	2024-12-13 21:19:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Sample name:	18037.doc
Detection:	MAL
Classification:	mal56.expl.macDOC@0/74@7/0

Warnings

Excluded IPs from analysis (whitelisted): 17.253.7.132, 52.111.227.13, 13.107.42.16, 52.109.8.89, 52.109.8.36, 13.107.5.88, 52.111.227.28, 17.253.7.146, 17.253.7.140, 52.111.229.11, 17.253.7.137, 17.253.7.138, 17.36.200.79, 17.253.7.135, 17.253.7.143, 23.216.68.23, 23.208.128.100, 3.229.240.232, 142.250.105.95, 52.111.229.48
Excluded domains from analysis (whitelisted): updates.cdn-apple.com.akadns.net, odc.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, crl.apple.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, itunes.apple.com.edgekey.net, officeclient.microsoft.com, init.itunes.apple.com, l-0007.l-msedge.net, lcdn-locator-usuqo.apple.com.akadns.net, afdo-tas-offload.trafficmanager.net, fs.microsoft.com, prod.roaming1.live.com.akadns.net, cus-azsc-000.odc.officeapps.live.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, api.smoot.apple.com, us1.roaming1.live.com.akadns.net, lcdn-locator.apple.com.akadns.net, us.configsvc1.live.com.akadns.net, mesu.g.aaplimg.com, updates.g.aaplimg.com, configuration.apple.com.akadns.net, configuration.apple.com.edgekey.net, mesu.apple.com, nexusrules.officeapps.live.com, api2.smoot.apple.com, smoot-searchv2.v.aaplimg.com, client-office365-tas.msedge.net, us1.odcsm1.live.com.akadns.net, prod-w.nexus.live.com.akadns.net, config.edge.skype.com.trafficmanager.net, cus-c
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 18037.doc

Runtime Messages

Command:	open "/Users/bernard/Desktop/18037.doc"
PID:	623
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 623, Parent: 537)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open /Users/bernard/Desktop/18037.doc

xpcproxy New Fork (PID: 624, Parent: 1)

Microsoft Word (MD5: 46aef48e4a9c8c37f6e0cd307d120622) Arguments: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word

Microsoft Word New Fork (PID: 644, Parent: 624)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: sh -c open -a Safari https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: open -a Safari https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450

xpcproxy New Fork (PID: 645, Parent: 1)

Safari (MD5: 2dde28c2f8a38ed2701ba17a0893cbc1) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

xpcproxy New Fork (PID: 660, Parent: 1)

silhouette (MD5: 485ec1bd3cd09293e26d05f6fe464bfd) Arguments: /usr/libexec/silhouette

xpcproxy New Fork (PID: 671, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 18037.doc

Avira: detected

Machine Learning detection for sample

Source: 18037.doc

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 3.97.136.92:443 -> 192.168.11.12:49480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.97.136.92:443 -> 192.168.11.12:49528 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.222.187.200:443 -> 192.168.11.12:49531 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.78.13:443 -> 192.168.11.12:49535 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.246.203:443 -> 192.168.11.12:49536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.144.19:443 -> 192.168.11.12:49534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.98.99.217:443 -> 192.168.11.12:49541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49558 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.217.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.217.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.208.128.109
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /XRmhzQXIzMFhnQ1lRMy9VSXh1YllvR0VGcWJmZ2lqbDVDcDUxZzZjRlZLSlBRblN3N3Btbm5CMXBCRGdUMUdRSGRQQmdFTWI3emxMMExiNEdQVW9CZGRnWk5HVWRKY0R2bHR2RlVaSlVXb1pHYmEzRWRVNGNnZz09LS1nZWN0WmRoeVNCdkNRTjE2LS1VZ1pyeldhOGd6RlJ1R1NuSFdpZTRnPT0=?cid=23510450 HTTP/1.1Host: montreal.banking-secure.netConnection: keep-aliveUser-Agent: Word/16.16.20101200 CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450 HTTP/1.1Host: montreal.banking-secure.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 HTTP/1.1Host: secure.webmail-net.comConnection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /assets/application-b8fb25919f68be551e6730684a8ed34bc7dd2dac142e7cc51ebf7b09c48546d5.js HTTP/1.1Host: training.knowbe4.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /petite-vue HTTP/1.1Host: unpkg.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /landing_pages/oops/styles.css HTTP/1.1Host: helpimg.s3.amazonaws.comConnection: keep-aliveAccept: text/css,/;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secure.webmail-net.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secure.webmail-net.comConnection: keep-aliveAccept: text/css,/;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /packs/js/vendor-954761ad0dceb106b971.js HTTP/1.1Host: training.knowbe4.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js HTTP/1.1Host: training.knowbe4.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /petite-vue@0.4.1 HTTP/1.1Host: unpkg.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /petite-vue@0.4.1/dist/petite-vue.iife.js HTTP/1.1Host: unpkg.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secure.webmail-net.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09Accept-Encoding: br, gzip, deflate

Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)

Source: global traffic	DNS traffic detected: DNS query: montreal.banking-secure.net
Source: global traffic	DNS traffic detected: DNS query: secure.webmail-net.com
Source: global traffic	DNS traffic detected: DNS query: helpimg.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: training.knowbe4.com
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)

Reads from socket in process: data

Jump to behavior

Source: ~WRF{35270E85-32B4-1341-A07A-E8F06B2445DB}.254.dr	String found in binary or memory: http://Motobit.cz
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: CloudHistoryRemoteConfiguration.plist.297.dr, MeContact.plist.254.dr, login.keychain-db.sb-07d82885-TI0FON.254.dr, com.microsoft.Word.securebookmarks.plist.254.dr, ProofingPrefs.plist.254.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://account.churchofjesuschrist.org/changePassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://account.docusign.com/me/changepassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://account.idm.telekom.com/account-manager/password/index.xhtml_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://account.proton.me/u/0/vpn/account-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://accounts.adafruit.com/settings/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://accounts.autodesk.com/Profile/Security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://accounts.craigslist.org/pass_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://accounts.pch.com/forgotpass_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://accounts.shopify.com/accounts/186490458/security_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://adultfriendfinder.com/p/update.cgi?p=my_account_update_account_password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.aadrm.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.aadrm.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.cortana.ai
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.microsoftstream.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.office.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.onedrive.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://api.scheduler.
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://app.acorns.com/settings/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://app.plex.tv/desktop#
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://app.powerbi.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://app.sipgatebasic.de/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://appleid.apple.com/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://apps.jw.org/E_PASSCHG1_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://augloop.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://augloop.office.com/v2
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://auth.fandom.com/auth/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://auth.opera.com/account/edit-profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://auth.readymag.com/password/forgot_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://auth.redgifs.com/lo/reset?ticket=_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://benefitslogin.discoverybenefits.com/Profile/UpdatePassword.aspx_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://blackwells.co.uk/bookshop/account/personal-details_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://blend.io/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://bugzilla.kernel.org/userprefs.cgi?tab=account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://canary.designerapp.
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://card.discover.com/cardmembersvcs/personalprofile/pp/UpdateDetails?ICMPGN=MYPROFILE_USERID_PA
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/create-module
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.entity.
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cortana.ai
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cortana.ai/api
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://cr.office.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://customercenter.wsj.com/account#password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://d.docs.live.net
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://dashboard.branch.io/account-settings/user_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://dashboard.heroku.com/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://dashboard.messagebird.com/account/security_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dev.cortana.ai
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://devnull.onenote.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://directory.services.
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://duolingo.com/settings/profile_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ecs.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://edge.skype.com/rps
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://elpais.com/subscriptions/#/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://employeewe.bamboohr.com/dashboard/password.php_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://experience.gm.com/myaccount/security/passwordChange_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://foursquare.com/change_password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://github.com/settings/security_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://go.com/profile/account-settings/edit_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://graph.windows.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://graph.windows.net/
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpChangePassword?redir=store/account/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpWithLoginInfoReset/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://hibrain.net/mybrain/users/password/edit_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://home.thesun.co.uk/edit/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://honeywell.csod.com/resetPasswrd.aspx?_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://hq1.appsflyer.com/account/change-password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ic3.teams.office.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://id.nfl.com/account/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://identity.surveymonkey.com/us/manage?locale=en_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://imgur.com/account/settings/password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://invites.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://leetcode.com/accounts/password/set/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://legacy.memoriams.com/Network/Account/ChangePassword_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://lifecycle.office.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://linktr.ee/admin/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://login.aliexpress.com/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://login.blockchain.com/en/#/security-center/advanced_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.microsoftonline.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://login.ti.com/ext/pwdchange/Identify_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.windows.local
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://make.powerautomate.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://management.azure.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://management.azure.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://management.core.windows.net/
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://mathworks.com/mwaccount/profiles/password/change_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://member.daum.net/change/password.daum_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://member.webmd.com/password-reset_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://memberssl.auction.co.kr/membership/MyInfo/MyInfo.aspx_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.action.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://messaging.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://minhanet.net.com.br/webcenter/portal/MinhaNet/pages_alterarsenha_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://moncompte.lemonde.fr/gcustomer/account/password_
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XMXZMMVhYNDhnZjhEQlloM2x3S3pvUUorUzdocG5UNWxNZDM1M1B6eUdWWThwMlh
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XOHBmdHFidHd0NU82NzZKb2QxYm10VSszNHQzbCtPdUJBbW9acjMweXVpbWFMS2o
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVF
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XQkFSczk2eVNkVUo1Vy8wbENJSHhzbUdXK1pYSklRbFY4clZseWlNQ1FFY2kxWEh
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XR2xaS2tkSUxrL016RStWaS9rSkdLdi83QTBKVmxxRFVLTUEwQlR1eHJ6Q1lscjN
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XRmhzQXIzMFhnQ1lRMy9VSXh1YllvR0VGcWJmZ2lqbDVDcDUxZzZjRlZLSlBRblN
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XSEc2VTNNVC9ZdkZnKzluTzhjdjFKVVRVQ0c2bmxValRiOG5CZGwwZEZaUm40RGp
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XdFp4SFI4QytVbjFLSmV6NkZqbEVBdVNXVFVMdmFLdXI0NnVoa2tXSklBVUt4SEc
Source: ~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	String found in binary or memory: https://montreal.banking-secure.net/XeUpUalduMVMzL3lGUXY2RTFvZDBwS3hZTGZEWUNXUHpIMysxZ3g1eTZWQmxxVUV
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://mss.office.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://my.foxnews.com/?pieces=reset_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://my.norton.com/extspa/account/personalinfo_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://my.okta.com/signin/password-reset_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://my.state.nj.us/edituser/EditUserProfile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myaccount.ea.com/cp-ui/security/index_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myaccount.uscis.gov/users/registration/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myaccounts.capitalone.com/Security/changePassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://mychart.clevelandclinic.org/inside.asp?mode=passwd_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://mypay.dfas.mil/#/settings/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myspace.com/settings/profile/email_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://myvpostpay.verizon.com/ui/bill/secure/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://na224.lightning.force.com/lightning/settings/personal/ChangePassword/home_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ncus.contentsync.
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://nid.naver.com/user2/help/myInfo.nhn?m=viewChangePasswd_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://njal.la/settings_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officeapps.live.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officepyservice.office.net/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://onedrive.live.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://onlyfans.com/my/settings/account/password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office365.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office365.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://password.umsystem.edu/reset/_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://planner.cloud.microsoft
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://play.hbomax.com/setting/account/edit/password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://portal.pilotflyingj.com/myrewards/forgot-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://portlandgeneral.com/secure/profile/change-password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://poshmark.com/user/account-info_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://powerlift.acompli.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://profile.theguardian.com/reset_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://pwrecovery.ruc.dk_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://res.cdn.office.net
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://saude.sulamericaseguros.com.br/segurado/gerenciar-cadastro/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure-www.gap.com/my-account/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.aarp.org/account/editaccount?request_locale=en&nu=t_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.indeed.com/account/changepassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.maxpreps.com/utility/member/forgotpassword.aspx_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.npr.org/oauth2/login_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.orclinic.com/portal/editprofile.aspx_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://secure.tagged.com/account_info.html?dataSource=Settings&ll=nav_
Source: LastSession.plist.297.dr	String found in binary or memory: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNH
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://selvbetjening.rejsekort.dk/CWS/CustomerManagement/ChangePassword_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://service.powerapps.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://settings.outlook.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://shein.com/user/security_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://shop.tmz.com/user?show=account-tab_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://slickdeals.net/forums/login.php?do=lostpw_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://solitaired.com/user/reset-password?_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://soundcloud.com/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://spankbang.com/users/account_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://stackoverflow.com/users/account-recovery_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://stacksocial.com/user?show=account-tab_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://staging.cortana.ai
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://storage.azure.com/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://store.cpanel.net/my/password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://substrate.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://syncservice.o365syncservice.com/"
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://thejigsawpuzzles.com/profile/?changepassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://time.com/manage-account/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://trakt.tv/settings#password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://tripit.com/account/edit/section/change_password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://usa.experian.com/member/ngx-profile/account-info_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://webshell.suite.office.com
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://worldstarhiphop.com/videos/reset.php_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://wus2.contentsync.
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.aa.com/loyalty/profile/information_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.acehardware.com/myaccount#settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.aeon.co.jp/app/settings/profile/password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.aerlingus.com/html/user-profile.html_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.alternate.de/html/myAccount/account/basicData.html_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.ca/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.co.uk/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.com.tr/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.com/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.es/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.fr/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.in/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.it/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.amazon.pl/ax/account/manage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ancestry.com/account/security/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.apartments.com/my-account/#_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.auctionzip.com/cgi-bin/userpanel.cgi?mode=3_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.bathandbodyworks.com/my-account/edit-profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.bbq-grill-world.de/customer/account/edit/changepass/1/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.bedbathandbeyond.com/store/account/personalinfo_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.berlet.de/mein-konto.htm#my-account--edit-pass_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.bestbuy.com/identity/accountSettings/page/password_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.birkenstock.com/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.browserstack.com/accounts/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.businessinsider.com/#_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.canva.com/login?redirect=%2Fsettings%2Flogin-and-security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.cargurus.com/Cars/myAccount#/accountSettings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.cars.com/reset_password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.cbssports.com/settings/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.change.org/account_settings/change_password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.chegg.com/my/account-next_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.chess.com/settings/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.chewy.com/app/resetpassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.clien.net/service/mypage/myInfoComfrim_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.cnbc.com/account/#profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.columbia.com/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.costco.com/AccountInformationView?identifier=manage-membership_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.crackle.com/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.creditkarma.com/myprofile/security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.crunchyroll.com/resetpw_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.cvs.com/my-account/profile/sign-in-and-security/edit-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.darty.com/espace_client/donnees-personnelles/mot-de-passe/edition_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.dell.com/identity/global/editaccount?_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.dropbox.com/account/security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.dsw.com/en/us/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.dwr.com/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.epicgames.com/account/password?lang=en&productName=epicgames_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.espn.com/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.evite.com/reset_password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.fedex.com/en-us/create-account/how-to-reset-forgot-password.html_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.fitbit.com/settings/profile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.foodnetwork.com/user-profile-page_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.gamespot.com/change-details/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.glassdoor.com/member/profile/settings.htm_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.gocomics.com/profiles/create-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.gog.com/account/settings/security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.goodreads.com/ap/cnep_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.happycow.net/members/profile/update/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.homedepot.com/myaccount/security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.hsn.com/myaccount/update_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.insider.com/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.instacart.com/store/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.istockphoto.com/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.kohls.com/myaccount/accountsettings.jsp_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.kroger.com/account/update_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.livejasmin.com/en/girls/#
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.mlb.com/account/general_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.nba.com/account/nbaprofile_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.netflix.com/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.newsweek.com/contact_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.nordstrom.com/my-account/sign-in-info_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.officedepot.com/account/editLoginDisplay.do_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.overstock.com/myaccount/account/email-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.paramountplus.com/account/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.patreon.com/settings/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.paypal.com/myaccount/security/password/change_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.peacocktv.com/forgot_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.politico.com/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.pornhub.com/user/security_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ppomppu.co.kr/myinfo/profile.php_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.prowlapp.com/settings.php_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.quora.com/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.realtor.com/myaccount/profile/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.reddit.com/prefs/update/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.redfin.com/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.redtube.com/settings_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.reuters.com/account/forgot-password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.rottentomatoes.com/user/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.santahelenasaude.com.br/beneficiario/#/alterar-senha_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.saturn.de/webapp/wcs/stores/servlet/MultiChannelMAChangePassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.sephora.com/profile/MyAccount_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.shopback.co.kr/account/change-password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.shutterfly.com/account-settings/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.sonos.com/myaccount/user/profile/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.spotify.com/in-en/account/change-password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.tasteofhome.com/login/updatepassword_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.thetvdb.com/dashboard/account/changepass_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.tripadvisor.com/Settings-cp_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.tumblr.com/settings/account_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.turkishairlines.com/tr-int/miles-and-smiles/forgot-password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.uline.com/MyAccount/ContactPref_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ulta.com/myaccount/index.jsp_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ups.com/lasso/updatePass?loc=en_US_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ventrachicago.com/account/manage-account/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.vrbo.com/traveler/profile/edit_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.walgreens.com/account/user_and_password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.wayfair.com/v/account/personal_info/edit_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.worldwinner.com/cgi/finance/account.pl_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.xvideos.com/account/security_
Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	String found in binary or memory: https://www.yammer.com
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.yellowpages.com/settings/password_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.youporn.com/settings/change/password/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.zillow.com/myzillow/profile/_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.ziprecruiter.com/login/forgot-password?realm=candidates_
Source: AutoFillQuirks.plist.297.dr	String found in binary or memory: https://www.zulily.com/account/edit?rel=top_flyout_

Source: unknown	Network traffic detected: HTTP traffic on port 49540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49540
Source: unknown	Network traffic detected: HTTP traffic on port 49554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49533
Source: unknown	Network traffic detected: HTTP traffic on port 49541 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49531
Source: unknown	Network traffic detected: HTTP traffic on port 49480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49490
Source: unknown	Network traffic detected: HTTP traffic on port 49551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49480
Source: unknown	Network traffic detected: HTTP traffic on port 49489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49551
Source: unknown	Network traffic detected: HTTP traffic on port 49539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49550
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49549

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 3.97.136.92:443 -> 192.168.11.12:49480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.97.136.92:443 -> 192.168.11.12:49528 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.222.187.200:443 -> 192.168.11.12:49531 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.164.78.13:443 -> 192.168.11.12:49535 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.246.203:443 -> 192.168.11.12:49536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.144.19:443 -> 192.168.11.12:49534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.98.99.217:443 -> 192.168.11.12:49541 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49550 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49553 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49558 version: TLS 1.2

Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.254.dr	OLE indicator, VBA macros: true
Source: microsoft word_Rules.xml.254.dr	OLE indicator, VBA macros: true

Source: E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.254.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: microsoft word_Rules.xml.254.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal56.expl.macDOC@0/74@7/0

Persistence and Installation Behavior

Office spawns shell processes

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 644)

Office executable: /bin/sh

Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 644)

Shell command executed: sh -c open -a Safari https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450

Jump to behavior

Source: /usr/libexec/xpcproxy (PID: 645)

Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari

Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist			Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist			Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Random device file read: /dev/random	Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 671)	Random device file read: /dev/random

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)

Log file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20241213-1421.log

Jump to dropped file

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ci.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	XML plist file created: /Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/com.microsoft.Word.securebookmarks.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ProofingPrefs.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Binary plist file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist	Jump to dropped file

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Sysctl read request: hw.availcpu (6.25)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	Sysctl requested: kern.hostname (1.10)			Jump to behavior
Source: /bin/sh (PID: 644)	Sysctl requested: kern.hostname (1.10)			Jump to behavior

Source: /usr/bin/open (PID: 623)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 624)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /usr/bin/open (PID: 644)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 645)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	2 AppleScript	2 Scripting	1 Process Injection	1 Process Injection	OS Credential Dumping	31 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18037.doc	100%	Avira	W2000M/Phish.cjdur
18037.doc	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://store.office.cn/addinstemplate	0%	Avira URL Cloud	safe
https://moncompte.lemonde.fr/gcustomer/account/password_	0%	Avira URL Cloud	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	Avira URL Cloud	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	Avira URL Cloud	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	Avira URL Cloud	safe
https://blend.io/settings_	0%	Avira URL Cloud	safe
https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450	100%	Avira URL Cloud	malware
https://lookup.onenote.com/lookup/geolocation/v1	0%	Avira URL Cloud	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	Avira URL Cloud	safe
https://member.daum.net/change/password.daum_	0%	Avira URL Cloud	safe
http://weather.service.msn.com/data.aspx	0%	Avira URL Cloud	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	Avira URL Cloud	safe
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	0%	Avira URL Cloud	safe
https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNH	0%	Avira URL Cloud	safe
https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVF	100%	Avira URL Cloud	malware
https://legacy.memoriams.com/Network/Account/ChangePassword_	0%	Avira URL Cloud	safe
https://ncus.contentsync.	0%	Avira URL Cloud	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	Avira URL Cloud	safe
https://wus2.contentsync.	0%	Avira URL Cloud	safe
https://pwrecovery.ruc.dk_	0%	Avira URL Cloud	safe
https://pushchannel.1drv.ms	0%	Avira URL Cloud	safe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	0%	Avira URL Cloud	safe
https://devnull.onenote.com	0%	Avira URL Cloud	safe
https://visio.uservoice.com/forums/368202-visio-on-devices	0%	Avira URL Cloud	safe
https://service.powerapps.com	0%	Avira URL Cloud	safe
https://secure.webmail-net.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	0%	Avira URL Cloud	safe
https://employeewe.bamboohr.com/dashboard/password.php_	0%	Avira URL Cloud	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	Avira URL Cloud	safe
https://shop.tmz.com/user?show=account-tab_	0%	Avira URL Cloud	safe
https://wus2.pagecontentsync.	0%	Avira URL Cloud	safe
https://www.aeon.co.jp/app/settings/profile/password/_	0%	Avira URL Cloud	safe
https://officepyservice.office.net/	0%	Avira URL Cloud	safe
https://www.prowlapp.com/settings.php_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
secure.webmail-net.com	15.222.187.200	true	false	unknown
s3-w.us-east-1.amazonaws.com	52.216.144.19	true	false	high
training.knowbe4.com	18.164.78.13	true	false	high
unpkg.com	104.17.246.203	true	false	high
h3.apis.apple.map.fastly.net	151.101.3.6	true	false	high
montreal.banking-secure.net	3.97.136.92	true	false	unknown
helpimg.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450	false	Avira URL Cloud: malware	unknown
https://unpkg.com/petite-vue	false		high
https://helpimg.s3.amazonaws.com/landing_pages/oops/styles.css	false		high
https://secure.webmail-net.com/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.sephora.com/profile/MyAccount_	AutoFillQuirks.plist.297.dr	false		high
https://myaccount.uscis.gov/users/registration/password_	AutoFillQuirks.plist.297.dr	false		high
https://useraudit.o365auditrealtimeingestion.manage.office.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://myspace.com/settings/profile/email_	AutoFillQuirks.plist.297.dr	false		high
https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_	AutoFillQuirks.plist.297.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://rpsticket.partnerservices.getmicrosoftkey.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://moncompte.lemonde.fr/gcustomer/account/password_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://shein.com/user/security_	AutoFillQuirks.plist.297.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.amazon.com/ax/account/manage_	AutoFillQuirks.plist.297.dr	false		high
https://www.newsweek.com/contact_	AutoFillQuirks.plist.297.dr	false		high
https://www.birkenstock.com/profile_	AutoFillQuirks.plist.297.dr	false		high
https://www.nba.com/account/nbaprofile_	AutoFillQuirks.plist.297.dr	false		high
https://www.yammer.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://messagebroker.mobile.m365.svc.cloud.microsoft	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://edge.skype.com/registrar/prod	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.zulily.com/account/edit?rel=top_flyout_	AutoFillQuirks.plist.297.dr	false		high
https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_	AutoFillQuirks.plist.297.dr	false		high
https://www.creditkarma.com/myprofile/security_	AutoFillQuirks.plist.297.dr	false		high
https://my.microsoftpersonalcontent.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://store.office.cn/addinstemplate	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://edge.skype.com/rps	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://profile.theguardian.com/reset_	AutoFillQuirks.plist.297.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://go.com/profile/account-settings/edit_	AutoFillQuirks.plist.297.dr	false		high
https://www.odwebp.svc.ms	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef	AutoFillQuirks.plist.297.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.alternate.de/html/myAccount/account/basicData.html_	AutoFillQuirks.plist.297.dr	false		high
https://blend.io/settings_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://graph.windows.net	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://member.daum.net/change/password.daum_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNH	LastSession.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://worldstarhiphop.com/videos/reset.php_	AutoFillQuirks.plist.297.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://accounts.shopify.com/accounts/186490458/security_	AutoFillQuirks.plist.297.dr	false		high
https://d.docs.live.net	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://ncus.contentsync.	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://legacy.memoriams.com/Network/Account/ChangePassword_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVF	~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}.254.dr	false	Avira URL Cloud: malware	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
http://weather.service.msn.com/data.aspx	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://blackwells.co.uk/bookshop/account/personal-details_	AutoFillQuirks.plist.297.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://pushchannel.1drv.ms	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://pwrecovery.ruc.dk_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://wus2.contentsync.	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.ancestry.com/account/security/password_	AutoFillQuirks.plist.297.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.amazon.ca/ax/account/manage_	AutoFillQuirks.plist.297.dr	false		high
https://clients.config.office.net/user/v1.0/android/policies	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://thejigsawpuzzles.com/profile/?changepassword_	AutoFillQuirks.plist.297.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.patreon.com/settings/account_	AutoFillQuirks.plist.297.dr	false		high
https://login.microsoftonline.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.cars.com/reset_password_	AutoFillQuirks.plist.297.dr	false		high
https://www.amazon.es/ax/account/manage_	AutoFillQuirks.plist.297.dr	false		high
https://www.apartments.com/my-account/#_	AutoFillQuirks.plist.297.dr	false		high
https://www.aerlingus.com/html/user-profile.html_	AutoFillQuirks.plist.297.dr	false		high
https://service.powerapps.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://devnull.onenote.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://secure.indeed.com/account/changepassword_	AutoFillQuirks.plist.297.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://skyapi.live.net/Activity/	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://imgur.com/account/settings/password_	AutoFillQuirks.plist.297.dr	false		high
https://my.norton.com/extspa/account/personalinfo_	AutoFillQuirks.plist.297.dr	false		high
https://account.proton.me/u/0/vpn/account-password_	AutoFillQuirks.plist.297.dr	false		high
https://api.cortana.ai	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.espn.com/_	AutoFillQuirks.plist.297.dr	false		high
https://visio.uservoice.com/forums/368202-visio-on-devices	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/embed?	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://augloop.office.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://www.bathandbodyworks.com/my-account/edit-profile_	AutoFillQuirks.plist.297.dr	false		high
https://myvpostpay.verizon.com/ui/bill/secure/_	AutoFillQuirks.plist.297.dr	false		high
https://www.glassdoor.com/member/profile/settings.htm_	AutoFillQuirks.plist.297.dr	false		high
https://api.diagnosticssdf.office.com/v2/file	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://employeewe.bamboohr.com/dashboard/password.php_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://www.pornhub.com/user/security_	AutoFillQuirks.plist.297.dr	false		high
https://officepyservice.office.net/	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.cargurus.com/Cars/myAccount#/accountSettings_	AutoFillQuirks.plist.297.dr	false		high
https://wus2.pagecontentsync.	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false	Avira URL Cloud: safe	unknown
https://www.prowlapp.com/settings.php_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://www.aeon.co.jp/app/settings/profile/password/_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://cortana.ai/api	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high
https://shop.tmz.com/user?show=account-tab_	AutoFillQuirks.plist.297.dr	false	Avira URL Cloud: safe	unknown
https://www.xvideos.com/account/security_	AutoFillQuirks.plist.297.dr	false		high
https://api.diagnosticssdf.office.com	E374FC6B-36D8-3849-9109-39FD6A965902.254.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.219.217.195	unknown	United States	16625	AKAMAI-ASUS	false
3.97.136.92	montreal.banking-secure.net	United States	16509	AMAZON-02US	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
52.216.144.19	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
104.17.246.203	unpkg.com	United States	13335	CLOUDFLARENETUS	false
3.98.99.217	unknown	United States	16509	AMAZON-02US	false
23.208.128.109	unknown	United States	16625	AKAMAI-ASUS	false
15.222.187.200	secure.webmail-net.com	United States	16509	AMAZON-02US	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false
18.164.78.13	training.knowbe4.com	United States	3	MIT-GATEWAYSUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.17.246.203	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse
	http://abercombie.com	Get hash	malicious	Unknown	Browse
	https://su.onamoc.comano.us/XcEhOOWF1eS9pVi9RYkVJUURCV1RYR0RGd2dHRjNGcUhDdkhxWFpsdUp1UWlVZk83UmwwZjIrYmdvdzh3aFZ3V1NpdnFZTG4zSE16TDBDYU5yc2hZVWQ3UU1GNHRON29GNEpZZkN6SGY0Nk8rdVp2U2tOWmNQbDNnZ0lyalR3OXBmeDlrU0FLKzlVeHI4YXk2YUFmaTRMUUR5TkhWNlhtSzMwQ2IrcU16UzRXUWROZDFlc3k0aldiNy0td25BVUltZUhhSGpCZG5tRS0tN1VocVZyWm1JT2tITW5yVjN4YWNxdz09?cid=2310889346	Get hash	malicious	KnowBe4	Browse
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse
	https://policy-business-page-service.com/meta-community-standard-s31000650257803499	Get hash	malicious	Unknown	Browse
	Audit(s) & Inspection(s) Due and Overdue Notification for Baez Rossy, Jafeth.eml	Get hash	malicious	Unknown	Browse
	https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406	Get hash	malicious	KnowBe4	Browse
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse
	You have received a gift from Giftano.eml	Get hash	malicious	GiftCardfraud	Browse
	https://important-wholesale-dress.glitch.me#clerk@tkbtc.co.uk	Get hash	malicious	Unknown	Browse
151.101.3.6	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	Telegram	Get hash	malicious	Unknown	Browse
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse
	CalendlyApp	Get hash	malicious	Unknown	Browse
	Constate	Get hash	malicious	Unknown	Browse
	sakura	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-nz/itunes-gift-card-scams	Get hash	malicious	Unknown	Browse
151.101.67.6	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	Telegram	Get hash	malicious	Unknown	Browse
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
	CalendlyApp	Get hash	malicious	Unknown	Browse
	Constate	Get hash	malicious	Unknown	Browse
	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
18.164.78.13	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unpkg.com	financial_policy_December 10, 2024.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.245.203
	https://acg.citnow.com/dashboard	Get hash	malicious	Unknown	Browse	104.17.246.203
	http://abercombie.com	Get hash	malicious	Unknown	Browse	104.17.249.203
	https://businessnotice.org/dhl/22450156620/tracking?u=84775-c0bf6be57168918ea5fe039631be6c3a772f4fac11292328fca4a210ba0e8890	Get hash	malicious	Unknown	Browse	104.17.245.203
	W-2Updated.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.249.203
	Fw Your flight has been cancelled.eml	Get hash	malicious	Unknown	Browse	104.17.247.203
	https://su.onamoc.comano.us/XcEhOOWF1eS9pVi9RYkVJUURCV1RYR0RGd2dHRjNGcUhDdkhxWFpsdUp1UWlVZk83UmwwZjIrYmdvdzh3aFZ3V1NpdnFZTG4zSE16TDBDYU5yc2hZVWQ3UU1GNHRON29GNEpZZkN6SGY0Nk8rdVp2U2tOWmNQbDNnZ0lyalR3OXBmeDlrU0FLKzlVeHI4YXk2YUFmaTRMUUR5TkhWNlhtSzMwQ2IrcU16UzRXUWROZDFlc3k0aldiNy0td25BVUltZUhhSGpCZG5tRS0tN1VocVZyWm1JT2tITW5yVjN4YWNxdz09?cid=2310889346	Get hash	malicious	KnowBe4	Browse	104.17.248.203
	https://addto.password.land/XTi9aSHpxMU9CSkxBVXRhNGJhTWRLelpoTjl5MHNEUndKbFN6WU9rV1E1QnF0azRVN1Z3OEFWTE0rd0NldXVBQ3QyUGw3NXpZcDNMMHZ3QklHeU5CYzJBSmowVWUzYlJtS1FOZlBKQzNHRkV5dDRZckdUSHVVZ1h3VGRxL2VNZkw3RDBlOS9rSTYvK3FOU2UwdUd2OFA0KzZWaWc4ZmMrMzhaTnBpSzc3aU55UVlxUnlKZXRwdm9nPS0td0ZVSjRCSTRJclFTRVBuVS0tc2h0a3RIa3J5VGJRUUt5NUZCdmxvdz09?cid=2310145655	Get hash	malicious	KnowBe4	Browse	104.17.247.203
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	https://policy-business-page-service.com/meta-community-standard-s31000650257803499	Get hash	malicious	Unknown	Browse	104.17.245.203
s3-w.us-east-1.amazonaws.com	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	3.5.24.44
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	52.217.129.233
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	54.231.203.105
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	52.217.118.249
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	54.231.193.17
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	3.5.25.23
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	3.5.29.178
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse	3.5.28.146
	financial_policy_December 10, 2024.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	54.231.205.1
	https://login.hr-internal.co/27553be9ed867726?l=50	Get hash	malicious	Unknown	Browse	3.5.28.204
h3.apis.apple.map.fastly.net	Telegram	Get hash	malicious	Unknown	Browse	151.101.3.6
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse	151.101.3.6
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://henrybodmerabeggco.wordpress.com/abegg-co-ag-proposal/	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	151.101.3.6
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	151.101.131.6
	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.131.6
	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.195.6
	Constate	Get hash	malicious	Unknown	Browse	151.101.67.6
secure.webmail-net.com	https://fraserheaith.it-helpservices.com/XZUVOMWIwNTNXSHBYTVdZNFlVSjZZVEJZWldadmIxaFZRbTEzTVZZd2VWVndWR0YxYVZaUmJrczJWeXRUWkdWaVVWUTRVRTVKWTNWVldUTkliMDFzSzBaaFozRmxjRWhGTnpKRGJuTnlUbE52WTBFM0wwWlZlamxPTHpOSFluTlVLMW9yUTIxWFVTOUlaekZrYVVWd1kxZFhhM2h4YUVFeVRtcDZNRWROWlVkUWVrVlNLMDlJTXpOMVNHVkdLek53YjI0M04wdEthM2QyT0dodmFVVlRha1JMUkUxcVlsZDZNbU5hZFV0MGJrWkRWRTFrVEU1VmJraEZlV2swYWtGQkxTMTBRMUZvYUVoa2NIQTVRVlI2YVRSWFRGWlZObWhCUFQwPS0tMzcxNzBkYzI4ZjY4MmZkNDYzZWJiNjQxM2E0YzFkY2U0ZThjZDBkMw==?cid=17348772	Get hash	malicious	Unknown	Browse	15.156.111.45
training.knowbe4.com	https://welsfargo.com-onlinebanking.com/XTFlySnlzYzQ1UXhqajFTVmtsYW50WkJBemRTamR4ME9mMGtnVWViL3dEU3g5cFRIUkFHOWdJQkxybzhJL1ZUSmJ4cExVZnk0UjVRcnFEc21wK2tXeGYyeG42TzJjREZmN05JQkhyZHViMldUakRRM3REKzU5ZS9HektFNXF4bEx3bXR2dzBnSytmRzIyOG4xU3NyNFc5RVlOY0h5Q2xMTFlLRVhEWnUwTVVQb2o2cUU3QURVMUhjbnJ3ST0tLU50cDlIc1hXNURmNmFNV0ctLXdjQnpKeTJDTUVxeHg3KzJKWVVIOVE9PQ==?cid=2324924114	Get hash	malicious	KnowBe4	Browse	3.82.118.141
	financial_policy_December 10, 2024.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	13.227.8.37
	https://employeeportal.net-login.com/XVlhRL0FtSW5Hdm1iVm1lTTcvSVJGWFVNWjlDRXk3TUZsamJYQmQwMVN6RDNJbWliUE5qdUxIQUthWFduWXIvLzN6dXVZWGs2enhXRUVaZjFnSnZ3RmtOVDhBWmt4VVRKMndIVnMreW1RLzVZVHJXOHhjYk9uWXEyRVB6K1gxNDIyL0JHOC9BRkZ4Q0prazZPVSs5MDlqcm54TFlWYWEvUEsvRXhjUVZhbGh0R0U1UmorbS9rN0VpS2pnPT0tLWxsYTh0UzNVZDNTRlpXNGgtLXUwZFdYbUZuamttcHlxa1hsaWlRRkE9PQ==?cid=2321060051	Get hash	malicious	KnowBe4	Browse	3.82.118.141
	https://token.onelogin.com-token-auth.com/XaG85eisvN2J6eWdNYXJ3OHhob2wwZFRQU0t4UUM5WHRUU0dNZ1dqV2crZ1dhV08xQTdUMW1hVmJaZURncldCRkRMZnJpMEpOWDR0djZiNXNLTGhTTUZBMWVFVDZIMFFXeU5qREJ1TUU2ZGQrVFhKQm8vYVVRMzF4Z0JQWkpibWJ0L3Bxc3NtS3h0dVdUcFBMYjlyTkJPbE5WSHdJcDRzQjJnaDNvLzc0SE52dU84MHQwcms1ZityVDBtYmlXdnB2K2c9PS0tZ2ltaTJwNGIyZ1VQeXpySC0tWTd5ejJuYnVpcFF3MkFkcXhOdUo4Zz09?cid=2323041528	Get hash	malicious	KnowBe4	Browse	3.82.118.141
	W-2Updated.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	3.82.118.141
	https://ftp.phishing.guru/XZTVLTzdsZUYrUVQvc2UxelY4RXAyY1lsWllpOGZuODg5eElvOG81SlRoMHJnZ1MwbTRTYVVxVzZlMm5NZTN3Z1Z4K3NxMmZFRUUwc09aYVN3TnJFWE5KRVNJd3RESWEzaGVVRUJOTXFUS1oyaTFpbnhWYmNZMEpzc1FsRmJRTWp4OSt1QWd2djVBa050cXBJTWtQaVo1bG95emZjbHdMNDJTN1ExSkVJV3F2VEZOWnByVFp1eTB0U2h3PT0tLWdwOUd3TlJKYU9yai92dFAtLW1zSmtEb2l5OG5rdkdhS3p4QUkwOXc9PQ==?cid=2305350685&c=E,1,2hwsfxJSqavaDh1yKkXV3W2-TyhvGdShzpZs_xrCQV32rd5rxIItzkHynov7i6KPhRMjTOfzpbOL_1ijK1wBxrPztz6i3OeFYMVWHhBAPg	Get hash	malicious	KnowBe4	Browse	34.196.207.207
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	34.196.207.207
	Platinum Hall County, Georgia Proposal (16.6 KB).docx	Get hash	malicious	KnowBe4	Browse	54.85.18.81
	https://us-api.mimecast.com.kb4.io/XWko4Q0hGOG85d2pSNGFBUW1UaEJSL09QUThzR2hrYWl3UGh4aEFVNkQ0dW1jU0FrdnhwRFB2clh1VmRINlRhSTJXNkM0N2NiS0J6WWlVRENjUVlPSWZYbk9xUkNaRDNGSjR3OU1Jd2RSdlJKL0k2cjZWV0ozK1BLRWRrZWJucElFUGVXcFpkM2hlOXluYlErY01WYkRnNmtzUldXNlJEcmIvN0Z0WVNMOHNobW5lMjVGcEdENDA0TWZNblZTWFVuRUp3PS0taC91cHJQRm5XdmFVejBTdC0tWVNTU2ZrYnF5clZ0ZndVU0tiNHIzUT09?cid=2313358952	Get hash	malicious	KnowBe4	Browse	52.200.18.75
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	52.200.18.75

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	FW_ TBI Construction Company.eml	Get hash	malicious	Unknown	Browse	2.19.198.209
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	104.86.46.42
	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	23.44.104.237
	naukri-launcher 10.exe	Get hash	malicious	Unknown	Browse	104.77.222.99
	naukri-launcher 10.exe	Get hash	malicious	Unknown	Browse	104.77.222.99
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.15.56.98
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.44.156.92
	arm7.nn-20241213-0355.elf	Get hash	malicious	Mirai, Okiru	Browse	104.117.127.190
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.206.139.191
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.120.75.121
AMAZON-02US	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	34.253.40.242
	https://us-west-2.protection.sophos.com/?d=microsoft.com&u=aHR0cHM6Ly9jdXN0b21lcnZvaWNlLm1pY3Jvc29mdC5jb20vUGFnZXMvUmVzcG9uc2VQYWdlLmFzcHg_aWQ9R1V1LXNGcV9vVWVfanViX1RzNWNzTjJ3cmI2cGNXbEJ2Vm9kQTg3OVBVbFVNRGMyUXpNd00wdENVVFJWT1ZGUFRWYzNPRWM1V0ZsRE1DNHU=&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmNh&t=YzVvY0ZoOHFRSGdCNnRncDc0ajJVNDZ2OTFMQXU1d0o3eU5tbk9LTnRwdz0=&h=fb80ac6ee6b9415ab2e67948974a6ac6&s=AVNPUEhUT0NFTkNSWVBUSVYEA8vQ82X9oDKen41DcCmWhkUnMNiRIUMWwszf4nzAf5AOW4BqwHD-tdThtGIGLos	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.227.8.101
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	54.246.144.89
	x-8.6-.Logicnet.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	v.bat	Get hash	malicious	Unknown	Browse	52.58.42.230
	https://artsofbristy.com/?data=ZGdyaW5zdGVhZEBjaXR5b2Zyb3hib3JvLmNvbQ==	Get hash	malicious	Unknown	Browse	13.227.8.64
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	13.244.63.179
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	52.38.155.9
AMAZON-02US	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	34.253.40.242
	https://us-west-2.protection.sophos.com/?d=microsoft.com&u=aHR0cHM6Ly9jdXN0b21lcnZvaWNlLm1pY3Jvc29mdC5jb20vUGFnZXMvUmVzcG9uc2VQYWdlLmFzcHg_aWQ9R1V1LXNGcV9vVWVfanViX1RzNWNzTjJ3cmI2cGNXbEJ2Vm9kQTg3OVBVbFVNRGMyUXpNd00wdENVVFJWT1ZGUFRWYzNPRWM1V0ZsRE1DNHU=&i=NThlN2NjYzYyOTljZjkxNGY4YmM0YmNh&t=YzVvY0ZoOHFRSGdCNnRncDc0ajJVNDZ2OTFMQXU1d0o3eU5tbk9LTnRwdz0=&h=fb80ac6ee6b9415ab2e67948974a6ac6&s=AVNPUEhUT0NFTkNSWVBUSVYEA8vQ82X9oDKen41DcCmWhkUnMNiRIUMWwszf4nzAf5AOW4BqwHD-tdThtGIGLos	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.227.8.101
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	54.246.144.89
	x-8.6-.Logicnet.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	v.bat	Get hash	malicious	Unknown	Browse	52.58.42.230
	https://artsofbristy.com/?data=ZGdyaW5zdGVhZEBjaXR5b2Zyb3hib3JvLmNvbQ==	Get hash	malicious	Unknown	Browse	13.227.8.64
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	13.244.63.179
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	52.38.155.9
FASTLYUS	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://unicoengineering.microsoftfederalcloud.com/TvL1x?e=acis.teamangie@amwins.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://docs.google.com/presentation/d/e/2PACX-1vSwojdyiXkpmoOGroSpmyU1bXlyQ1pGq6J4xqXeFbLhc-orzr_d9gd79t3Kfc7MNOR4W_H4cofhR0E4/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://docs.google.com/presentation/d/e/2PACX-1vSwojdyiXkpmoOGroSpmyU1bXlyQ1pGq6J4xqXeFbLhc-orzr_d9gd79t3Kfc7MNOR4W_H4cofhR0E4/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	185.199.110.133
	svhost.vbs	Get hash	malicious	Unknown	Browse	185.199.111.133
	NB PO-104105107108.xls	Get hash	malicious	Unknown	Browse	151.101.193.137
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.111.133
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly95NE81LnN0YXJ5bm91c2UucnUvdDV2My8=	Get hash	malicious	Unknown	Browse	151.101.2.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e4d448cdfe06dc1243c1eb026c74ac9a	http://tracksorders.com	Get hash	malicious	Unknown	Browse	3.97.136.92
	https://58.email.stripe.com/CL0/https:%2F%2Fwww.britainairporttransfers.co.uk/4/01000188b98fc0c8-4dbcc283-4daf-4b36-8cc5-4625b1743aa7-000000/l_ORHcLOPgYOtJrUDMsqj3Ftby51H0Ygl8nP4EjCrK4=305	Get hash	malicious	Unknown	Browse	3.97.136.92
	https://r.clickwise.net/pap?k=1608104259.622&b=&a=59c203522ac2d&u=https://i3DTEi4eGG2K5Kwi3DTEi4eGG2K5Kw.ecovest-investment.com/adobe/#c3RlcGhhbmllLmNsYXJrZUBjaHV2LmNo	Get hash	malicious	Unknown	Browse	3.97.136.92
	SecuriteInfo.com.Other.Malware-gen.27642.xls	Get hash	malicious	Unknown	Browse	3.97.136.92
	triper_Meeting_schedule_template.xlsm	Get hash	malicious	Unknown	Browse	3.97.136.92
	WormholeInstaller.dmg	Get hash	malicious	Unknown	Browse	3.97.136.92
	WormholeInstaller.dmg	Get hash	malicious	Unknown	Browse	3.97.136.92
	WormholeInstaller.dmg	Get hash	malicious	Unknown	Browse	3.97.136.92
	WormholeInstaller.dmg	Get hash	malicious	Unknown	Browse	3.97.136.92
	WormholeInstaller.dmg	Get hash	malicious	Unknown	Browse	3.97.136.92
5c118da645babe52f060d0754256a73c	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	Telegram	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	aJU0obOiEe	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	CalendlyApp	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13
	CalendlyApp	Get hash	malicious	Unknown	Browse	104.17.246.203 52.216.144.19 3.98.99.217 151.101.3.6 3.97.136.92 15.222.187.200 151.101.67.6 18.164.78.13

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.0484732700588695
Encrypted:	false
SSDEEP:	3:OGXKRjqDoA1lll/0lGNylRflqb5McaN5sbPUlyeliPn:paRS1/l8lGDb5McasZ6iP
MD5:	C355886BDDF7FD3B85B3AFC9B67BE302
SHA1:	1276AD7F47A439E5BA141699DFC81FFC6D4C8FE6
SHA-256:	657603788D526C68E7D11091FC20BFC45D1E1642921CEC39D6DF6C62658C49F0
SHA-512:	E936B4116F9F62FF7B08A47946C39341055A29754125E64DCC385FB1D6C9918739A013A2BE44AFAA18FDC0F61DCC9766B197D89335B8E0F325246FB034682C04
Malicious:	true
Reputation:	low
Preview:	.Microsoft Office User..................................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .U.s.e.r...~.$.1.8.0.3.7...d.o.c.......).............`.0.............X.0.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontCache/systemfontmetadata.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	396763
Entropy (8bit):	5.0951936873187185
Encrypted:	false
SSDEEP:	12288:UBRpxLzIE4BCuBozRIsjIYCBzzBQu71Q17OB4IiVX6Uu010Q0VSlcB2itvrmlwWB:UBRpxL0BCuBoeBzMX6Uu010Q0VSlcB23
MD5:	ACAF059AFEBFC46E06ADE831A514F256
SHA1:	5530CD79F99C4270088EFE83415D9B6355702B7D
SHA-256:	BD9F09902F4E129B87A6A99CDBCBEDE57836813AC6AA89E52F2A11033C23D8CD
SHA-512:	55A38CCFA5D33B25695BE8F95A72802AB0E2D7803B0D25070ED9DAC691F7BD798881D574834239E374A04D8F3312B2908050633D998E89264A5E0E1A55D0DB1D
Malicious:	false
Reputation:	low
Preview:	{"vm":1,"vi":7,"fc":999,"fl":[{"i":"AlBayan.ttc","p":"/Library/Fonts/AlBayan.ttc","s":188132,"l":1,"ft":[{"fi":0,"fa":["en-us","Al Bayan Plain"],"pf":["ar-eg","\u0627\u0644\u0628\u064A\u0627\u0646","en-us","Al Bayan"],"f":["en-us","Regular"],"pa":["ar-eg","\u0628\u0633\u064A\u0637","da-dk","Almindelig","de-de","Standard","en-us","Plain","es-es","Simple","fi-fi","Normaali","fr-fr","Simple","it-it","Piano","ja-jp","\u30D7\u30EC\u30FC\u30F3","ko-kr","\uBCF4\uD1B5\uCCB4","nb-no","Vanlig","nl-nl","Normaal","pt-br","Plano","ru-ru","\u041F\u0440\u044F\u043C\u043E\u0439","sv-se","Normal","zh-cn","\u666E\u901A\u4F53","zh-tw","\u5E73\u9AD4"],"fu":["ar-eg","\u0627\u0644\u0628\u064A\u0627\u0646 \u0628\u0633\u064A\u0637","en-us","Al Bayan Plain"],"g":["ar-eg","\u0627\u0644\u0628\u064A\u0627\u0646","en-us","Al Bayan"],"ps":["en-us","AlBayan"],"t":["ar-eg","\u0628\u0633\u064A\u0637","da-dk","Almindelig","de-de","Standard","en-us","Plain","es-es","Simple","fi-fi","Normaali","fr-fr","Simple","it-it","P

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CatalogCacheMetaData.xml

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text, with very long lines (13144), with no line terminators
Category:	dropped
Size (bytes):	13144
Entropy (8bit):	5.047437623999173
Encrypted:	false
SSDEEP:	384:B2trtrAr3Ar3vr3Xvr3XKr3XfKr3XfRr3XffRr3XffUr3XffTUr3XffTjr3XffTK:B2trtrAr3Ar3vr3Xvr3XKr3XfKr3XfRE
MD5:	7C6999D7FB25514F433B9ABC9714FF7F
SHA1:	2DA01C8FC01C34D17E0E0178BBEC0DA8A6F5AF6B
SHA-256:	4DC58DFD3C31635AE7A0AFF21DC26D3A1DB0295C62BB44AE7BF0AE893934E84A
SHA-512:	5D6B04803F87F0FDD45C7CCD091F49C2594190FF1DC442BA30FE37E6EBD4B21724940514E3660A049514AB05130F29800195C8B28E038388750A97F126B8B9B8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>1</Count><Resource><Id>inkeffectocean_apple_0</Id><LAT>2024-12-13T20:21:33Z</LAT><key>inkeffectocean_apple.jpg</key><folder>Graphics</folder><type>10</type></Resource></root><?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>1</Count><Resource><Id>inkeffectocean_apple_0</Id><LAT>2024-12-13T20:21:33Z</LAT><key>inkeffectocean_apple.jpg</key><folder>Graphics</folder><type>10</type></Resource></root><?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>2</Count><Resource><Id>inkeffectocean_apple_0</Id><LAT>2024-12-13T20:21:33Z</LAT><key>inkeffectocean_apple.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectsilver_apple_0</Id><LAT>2024-12-13T20:21:33Z</LAT><key>inkeffectsilver_apple.jpg</key><folder>Graphics</folder><type>10</type></Resource></root><?xml version="1.0" encoding="UTF-8" standalone="yes"?

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectbronze_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	84396
Entropy (8bit):	7.9913099496507325
Encrypted:	true
SSDEEP:	1536:cIGM7F6nLjkUw5RRbYL/w1SqWyQawEPlmfXBQeIqv:F4nZ7GScQawE4XmeIW
MD5:	D8570FC799DD7D35BFED4D3098AB3E9D
SHA1:	7A1F0C7021BA61AEBD29E241AADCEDFB85C3642A
SHA-256:	881266FF8DF6E91E4101F9C6F8E01B2241FFCAA680A1B26292165AFD0F14E5FC
SHA-512:	A9D3DBEB069BAC50BADD0C7A23A00F142B3C5AF72E430D34FE4F746224BA37A5DC8AD9047259659C73E943F6421A2225F0F14C6ACB0B0DAAE85B6CC52D8DD62E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$.............................................................................................q3V.....e++z.A...<..8..9+.........%,...6._i.D......C`.......YY3s.....)._Y..6+,3.H......L.<..}..r......s.18.f..#.........jD...g..l......&q..R.OEc.8.`...WB..0uf..v..7M...vg......4..tE..zG........4.A[.0yV.Z./...Dk'.8R>.m6......"......G..n..hVq7C.....;....eEi.K.c.l..rN.L4..H...n.t.....K...Y.<...,(...Q...[.S9....$...X..\.a..z...5.7.B..yd..}...BL.V.F.`.L.a.#".~=:Pj;.....l...^+.zY.<..h.(....pT....jS.5]....40..,.u..h..&.$../...3X....V.N.G9.:..-8U..8..._U.(...=V`.iy!....x...........H7a.....r...I...d.K.j.k....s.{.~...a.Yh....#..X....B....o..........mE.....sD.ST.)h25C9MXOe.RI...4rL-..4....].u.N.O.{<&A....i.BO .\|..O/..?..g.Yxu.M#..FUNnW.0...IB.Y..L..3..j..,"`5..@.l.c....$...p....?fI..D.e.g+....=..;+,.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgalaxy_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	74219
Entropy (8bit):	7.988386472621452
Encrypted:	false
SSDEEP:	1536:7PZHrZIaLOpmhGPSExldCUGFkFEh1xJDO5G8dpsV3wuw/PPBgzaQFkewIRObD:rZHtIUOEhG6mldyqehXJ0G8dK11wPBgy
MD5:	F2D3F4899AA489D5EC478DC7C3CBB5FB
SHA1:	6E3DAE737EBE40F38917D7C07B28CAFCF5555CD9
SHA-256:	269197FEC12A677913CF6C9BB2F9B2A8B74EA4F5C52E578E89E1D9D2732229C5
SHA-512:	F8649A3F5D19C2F06E1F7AD0C36787F5AB038D37BD3C78603899835378E041B4A3C5F08BD848A5CC10B170566613CB5C2E92A9A7716D892A7E2DE684549D0908
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............C....................................................................C................................................................................................................................................................~.hJ..R..7...........X..d,....v.1...%...y.5.<...m!..5...gV.;Q.z7.......Dq..d6bW..od.nV.@..I.T.....o.[z.h.R.C.w..E.T=.....F..z.r....@..A,........<.C...............N../j...tX&......9-...'...Z%...6.M..h.zl...z..h._.h.f.L...t.:B..L....k4<....(.n.]\..>..g\..O?y"1.e.......cl.Gq...9...j5..*+.E.....+VgF\|....V....Y.....;\|...H._...5.m.,][8.f.....]z!8u....3NC0.]..g.\|....A%..@e9....!.%...v3.&.n2B.F.e.3..+Q.u..d..W.yY.II5g..K.......u...vE.^....IiY."6}.f.......u....2...t..H...`W<..B....>K.......4.7..\....zCy;5!..l.m.S.....n..}....O~A.........J.K.:.K%h.:.&..roX.T..;.....k..e>..D..w\|.:...I.z9.@.....1t.d:...@.3......Q.ig....j[<......k.vHEpY..uy.s9..W..R=.....c}.s..!6...^)..wr........R...$E<......(....HbiF..\|L;...&B.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgold_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	87622
Entropy (8bit):	7.991217118383026
Encrypted:	true
SSDEEP:	1536:se/4iF6/SfiQzvtwBONX1sszmE8plQtAx8xGoZ/7K9tJv:Sim8zVwB0zz9HaxqODJv
MD5:	0C4305204BE8030648DEEF0A6B772B85
SHA1:	00CFC8282A6DFCD01353A4A1636483B3FA59D850
SHA-256:	D5BDD3A022CB46E5810D32264052D038B9E3FE7FE6B4D1D5A315E1379D568399
SHA-512:	BA30CEA8CCF6EB5BA7DE4980A3D46A578235EB8395415DB22812C2F874520923F2684A4CA0C008F7DE0437A4A41185BC680E90B975CD9C8B9450DD80FC1A9896
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............C....................................................................C..............................................................................................................................................................._.%g..2..._J...B.K.K.J.h...%.HG.~..X..z.......C....$..Uq...0K..).....8u.f..K......._r.W:...H.8P.+i.7.-.g&...zr..P....6m.E...0...Uj.t&...jg...-...............!...N...nu.%..^....=.........k..J..2..{I.B..A.xt.3.....1..9....ID.D....T.......-vVt.6B.c....._M(r.$ez...:Y.....Jq.....y...9..E.C..\J.Kj.%..&q..j.-.\s...sM.O.'b......q;).U$...7....W..Q.-F^jJz.y......G.........Z@.2.@I.,..l{X.&R.#f..-....s...H..U.$...o.....I(XNY..........OP.)6T.%g...Y.E.w.*.%t....z.........g%..'^v.U...m.7Vs-^..Y..2.....e=.s..?y\|.5Z3>.t.?k.eQ9.c9..),.Mz#....5d......%V.S..uI..j...ds..T....W.7%..z......`..WZ.7]D..4+.-....j:.-.2..j.n..M.%..IG.yD.^..;.J2pNCR..N[tF.\|<...F..T.o..k.u..mI9....i.%....'.U..r1I.sRU..^..c..EH....Q..?.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectlava_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	68998
Entropy (8bit):	7.980985438092091
Encrypted:	false
SSDEEP:	1536:MvduYCH1rELwJ9AtMcQLTTIbhk3KuFoQsznE7hsoBF:OuprMwJ9AtyvItk6uynEVsoX
MD5:	C7115E54CE318F1A9F243008FE422AB1
SHA1:	D3BF56888DA8112AA15189ED66BEDAE83AE8433C
SHA-256:	F831E10750920FE6B3B05E3B0F91A31FF87F4C84DC4A3210AA47ECC9C75455C1
SHA-512:	7E662DA83F76AEA36BBE5476B43A53479245CF28BB28B981EC20822580BD1C9B333CF631635EF3FEDF80F7D90AEF2DCF9318C915AB8A613E4FF58DEF733C19FD
Malicious:	false
Preview:	......Exif..II*.................Ducky.......N......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3b56cf0d-9891-e64b-a346-98264b84a192" xmpMM:DocumentID="xmp.did:733F0DA5725811E7BBDDC82F50452972" xmpMM:InstanceID="xmp.iid:733F0DA4725811E7BBDDC82F50452972" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40baeee4-8d01-cb47-88ff-96368960fabb" stRef:documentID="xmp.did:3b56cf0d-9891-e64b-a346-98264b84a192"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectocean_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	67788
Entropy (8bit):	7.974716852912141
Encrypted:	false
SSDEEP:	1536:NiE9pfwZDig6oY74mZIMrT/0yV0GGgAD2kAST:Ni+gig/nut/7VMgS2s
MD5:	1291BC2D361ADFECECE17FC4BA39955B
SHA1:	A0D8349ECC1C87EA15E653E7DA0BB9D7F6A41888
SHA-256:	73B734D4F546848D1ABDC4D5B97AF096B8503A4BF3ADC476B7F87E123C87377F
SHA-512:	F1C421D06546D8949E3EA733B0AC80BA06E587B9675ABDE8F1E1DCB813728129E97CAA800C513C442F1B6AC86EB88A82FB6F0AF2959571A35F435632D3E611A3
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:3b56cf0d-9891-e64b-a346-98264b84a192" xmpMM:DocumentID="xmp.did:694DCF44725811E7BEDDC8232AF86E6B" xmpMM:InstanceID="xmp.iid:694DCF43725811E7BEDDC8232AF86E6B" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40baeee4-8d01-cb47-88ff-96368960fabb" stRef:documentID="xmp.did:3b56cf0d-9891-e64b-a346-98264b84a192"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrainbowglitter_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	153262
Entropy (8bit):	7.9827714103186995
Encrypted:	false
SSDEEP:	3072:KeWBTpHtifWR0XSnpqZWqJgCbxaCUiP6YCXr7D1vsPcsjVhTF0df:TWBfrncZWqJgCbwCUO8tAjV0J
MD5:	1D6620FEF62D8E0D2429F0875C3BD004
SHA1:	8A1B52DE18DBF5F401B6D2E9BFA195870F9AED1B
SHA-256:	38373A0F2AE2B95162802E45582602AA99CCF76595D1BC27DA32A95FB594F983
SHA-512:	1C9A57AAA80450B2625F2BCF604B727F933B15810F238EF9F20129122BCDFB4BBC3EDD624CABF2137E0CAC01DE4068176F1D590234496C9CFD38C4DA6EF751D8
Malicious:	false
Preview:	......JFIF.............C....................................................................C...............................................................................................................................................................?>....U.Vo9j8..No..v.....Ok.....req.."lr..?-/C.....k.......KwU.KF.G.Z..1M.....W..S.J.:9....,q...........>.n.e._k..B..U[...'.R....C.Tg}.T\|....S..5J.i.......9._M.....<....6y....o....B.M{..R\..?....DfV..Or.yNW}..R.&v.\|...N.H!.a.T{........F\|._V;.N.N6...z.m.<W.g.h#...=.!JDL`i.C...W...;.....Z.a.r.&.}.....]....-.PO..{...VMI..q...U4I.lh..4...+...^z...>.e.NQ.."d.^.]..?.(.q.T[)L.M~.B..K.. .ZU$.9..D....$(.=.8%Z....l.-!K...+&.7%K.U.ry..o.9^.e.&O..J.`.o...GD....a.kS.{..u..RX.".O...yA:%....?.U...3M.h.E...p.[-.4.P'=.....c.0.....iw.$..w.mz.z.#.)s..r...y..y..X.<.:s.R....PFT=C....G.F}oL.$..Q.........O.).Z....M...au.....X. ....4..#.R...4D../.....! 8.;......HI4....8.l...8.9l.6}>g...&.&U........5uj]{...V....(T....K..&.%>9

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrosegold_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	90345
Entropy (8bit):	7.992397164164287
Encrypted:	true
SSDEEP:	1536:R20GNBIZD9sGCktLlcmWZ5LQ87D/u5PoIdxEDMybeHiVYQN7ADGZ4nnN3GmI1+K0:RKkLCQgQCW5NdxsRbeHfQN7AdndW0
MD5:	FD87DBA2227C56D76B7BF324A34C271E
SHA1:	B1F283D5614B416802E132B9789FE9B983688D6E
SHA-256:	289FB85EC85BC9EBBC01F858F8E0ACA2A38BE697FF5217F96CBF0652CBC6AF1E
SHA-512:	7DD5201DF1AF91A4DA5435CC80881A685FB680B02A285119633133ADF3C13EA86545E89A0EDB32AED1C0FC56227EEF13B5006E70947C14F7B2BD833CBA0DA8DA
Malicious:	false
Preview:	......JFIF.............C....................................................................C................................................................................................................................................................Mhr.Eo...._.\.lo..#&..')..U.5....)4O.r.h.Z[.6K5.t..Z....Z....uvx........W>.....M .-....t.V...'..^3.h..MhvUR...M.^.s.l..O..h....d.9=...b.......h.CE..l.QJ-.A.i..[ss.l.S.....GMT[:..17..d...m.b.=.":..WC\.u(..\.?G...w...qIM!..g.C.s.D.e.z.....8:.Y(..).%.n.........Z..[<-[.jz.=...ko.t.fdU+....M'...14..Qo8.eKT..]w-....fOSA..q...!k.5.$)`.....f..B....=<p..r....Z.....Gd .D.L...az-.M\|.FH%..[l.~....!J..C..\t.?.......+.z....h..O..S/e`....O\|.(..u..?..?.B.:..'A..X.v........6G..%.==._-.e....!Z..>wFz'&....<.O....f.."4.J.#.h)..`q.L.N.WC.B../..m.!?C...;NZ..]...4..>qY+.Z..-m..v............j.....R9<......?*.\...i..m....Ku..J..l.J[..x.\..-...Y.m.=....Ui...R..[..3H..U.......\...........' ..9..14~....Ed.....

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectsilver_apple.jpg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3
Category:	dropped
Size (bytes):	70537
Entropy (8bit):	7.985060406112171
Encrypted:	false
SSDEEP:	1536:9i/wP5MGXOH6Moy1LA8TI6QoKU/0h9PeIpS5OeJLfEdC+ZinDrJeGaI6SZrK:94a5MGXOaMoyi8TI0KUUdZw5O8LfJii2
MD5:	72EDB703DA3FFA41A82650CC167CFA64
SHA1:	BD5357D5A8434DAC612038A1CA409C44B926E4A6
SHA-256:	E56DBDF74A0D097769378CDBD44E3C967BAE4B83E932784A909575149E64E24D
SHA-512:	B3A98AC03BA79F60A5D5083EBE5B0F50C57CC766FE4F52DCAFC9C80BE676C5A0A087D5D8A4BCACF1D38EB64B0B0CB2EE3796FBC4150991674717B62B5537A746
Malicious:	false
Preview:	......JFIF.............C........................................................ "..".......C...............................................................................................................................................................%..H..[..U...J.O...d.u...^i..H.T....q~dk#...F....Vf:....v..N.K..e#B..v.cM..)..tI.4.j9.&..#LU.z.....].s..........(..vJ..[........K>.J./..$....1thk4.K.G]T.......:..@..6....."......f.L....&T...zO.(..\|h..I:...9......S.U`U...$.L..UI[Y....{..%k3k...E.).&..h.ZaR.Ju......U...+..-.X...=d.\|C\...#.<..Y.D.NFrjs..rg..K.>6G.5..e...bze....j.....t`'..3V....IL@5...i.^hM.j3.lR..G..8,...%.%..e......[M....[:,.U_..eM..4H.p.2......jhJ^h6Z4:lr...w".$v...\|..oCp.W.\7.6...Z....f$.Cj.lcE@S..Oyz..y~.2.._%%.....&"Y...........`h....St}N.u..K..YZ.I"..U.a..2.h...59(5..Vq".@.....}RtV.O:Z..z...4..k..meSO.M.^....kg..2.Tj.]5...%..!A5...J.~l.W....9..'.$tt.}$4H.R...6GY......I2.GsB....-\|../E.l...n.Vq-U.{,.r.0.Z../V.. h.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/oart.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	8515
Entropy (8bit):	2.376758026536063
Encrypted:	false
SSDEEP:	192:OGEGGGBGcGSGwGdGKGjWqGjWUGjW3GjWiGjWAGjWUGjWTGjWwG/zhGzPhGjf4:zJbwx3F8f02FU+UJiUsk
MD5:	53D49444EAF92E0CF5D2985CCAEDE42B
SHA1:	DA2D6C55752243AA5E638750F038DADF3C9FE6CC
SHA-256:	722A39658D2F3D5E333874F23485CEA9DA2B79EDA454FA7F5A9FEFBFDB9B2AD8
SHA-512:	B59D16AE8DCB2D9F02BF7CD594A94D140C9CB308DECFEEDF89B9C166657D8B6BD97FA7CFCF97F0D45E184A470B209F28F1ECC420C5CBF8D88D6E0E1C3AB48064
Malicious:	false
Preview:	{.. "MajorVersion": 1,.. "MinorVersion": 5,.. "ResFamily": [.. {.. "Family": "InkEffect",.. "Res": [.. {.. "n": "inkeffectrainbowglitter",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgalaxy",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgold",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectsilver",.. "sub": [.. {.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/SurveyEventActivityStats.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/SurveyHistoryStats.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.CampaignStates.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.9754180179138325
Encrypted:	false
SSDEEP:	3:YmEoEMCLFrEVEMCLFw:YmEoYLZEVYLW
MD5:	9BC405C56BE620FEF05F4FF91CDEA32D
SHA1:	F2D55CB04EB9944C2FEBE515A9739885B35038A1
SHA-256:	5D536C470AD79B2156FE7E5C89C40ACB37B17C484A3A6A4B8AD8250BA4FF6D56
SHA-512:	9D73371F7A4C19D17D61F026BBACB70326EB09FD28E896719CD5CAB3BDAE53F25A59FC9452A6B070A015C0ABB5473DB435B6AE1D92FC98C68AB697CBD7C3238E
Malicious:	false
Preview:	{"CampaignStates":[]}{"CampaignStates":[]}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.GovernedChannelStates.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.577005544697783
Encrypted:	false
SSDEEP:	3:YmNiLA4iRA0H6oA/kEJ9Ky7REsIEf0ZUI+tfVHJHoykP/A/kFXZ7REsIEf0ZUI+p:YmM01RA0A/kCnJIEf0szkPI/kFJJIEfj
MD5:	107B22E4A540DC497764D2CE2E4FF10D
SHA1:	E59310A03BFF911AE4F0C187DE827A50CD9BC6D9
SHA-256:	8CA795B92D0591EF3EB5CA6259603F08ED08FBB18EDA7E023B232B2B229421C9
SHA-512:	2EFAE37DFB0D50B9598EF89B81334E2447851AD183F4F6678F3F5D29252DC5C9D7F71A06F81CA3FEF40A0B51695D1382DA5EFC7E911D601DD3E1F9BBBD2AC4D5
Malicious:	false
Preview:	{"ChannelStates":[{"ChannelType":0,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":1209600},{"ChannelType":1,"CooldownStartTimeUtc":"1601-01-01T00:00:00Z","Cooldown":0}]}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.Settings.json

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JSON data
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.576828956814449
Encrypted:	false
SSDEEP:	3:Y2NKbNCOAqui32B0fkWbSpgLGwHY:Y2YZOUU0ffogaw4
MD5:	E4E83F8123E9740B8AA3C3DFA77C1C04
SHA1:	5281EAE96EFDE7B0E16A1D977F005F0D3BD7AAD0
SHA-256:	6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
SHA-512:	BD6B33FD2BBCE4A46991BC0D877695D16F7E60B1959A0DEFC79B627E569E5C6CAC7B4AD4E3E1D8389A08584602A51CF84D44CF247F03BEB95F7D307FBBA12BB9
Malicious:	false
Preview:	{"ShouldFloodgateTakePrecedenceOverRateAndReview":false,"AreRatingSurveysEnabled":true}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/WebServiceCache/AllUsers/officeclient.microsoft.com/E374FC6B-36D8-3849-9109-39FD6A965902

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179759
Entropy (8bit):	5.297291440140082
Encrypted:	false
SSDEEP:	1536:JvhuPRAhqbz4wglEzLe7HWKQjj/hMOcAZl1p5ihs7RXXWE4jUEOBIY5YdGVF8S7B:Z+e7HWKQjj/TXT7LB
MD5:	97C859514C1FA55A10859984C513163F
SHA1:	1682690B6A748554D4B535AB742448D513A7DDE6
SHA-256:	6D69CBF001CE4FAFA0C8D05201A5BDBC17E3AB49A0A4A3A227EF0AE65E5123A9
SHA-512:	11DC7B9FA0C786B33D7B7C21E3F91C5E9C7F6D7B0808D6EA670A2169919EFC460132C43DF688FB3F75FE84C59C878E424891ABD138288BCF10D190644D5C57FF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-12-13T20:21:11">.. Build: 16.0.18406.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results?fullframe=yes</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	403526
Entropy (8bit):	5.096288425863684
Encrypted:	false
SSDEEP:	1536:H1KoGlQq1bbYgH8uefRCkYatAYD8gQadOVTdAzaEIQMkXKJehMY:OYgH8uefRLYp08uQVhAzay9
MD5:	4F872459B99F0A01EF03954E9267B8CA
SHA1:	A3573F993168CD5BE0B79B64AA51038FDF17EA58
SHA-256:	C8440980F83A8A1B3418E7D8419FE68F7A7CA42F4F73410A7489B272094C7CFB
SHA-512:	C6EACEEBDEC52BBC263D8004EF0627E483E9F026D408247B8E3645ACDBF172448017D0DF433D859257762DD3E2CC0F6871090B92373B7BD78D1E0490B9975F24
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?><Rules xmlns="urn:Rules"><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" xmlns=""><S><Etw T="1" E="159" G="{02fd33df-f746-4a10-93a0-2bc6273bc8e4}" /><F T="2"><O T="AND"><L><O T="NE"><L><S T="1" F="Warning" /></L><R><V V="37" T="U32" /></R></O></L><R><O T="NE"><L><S T="1" F="Warning" /></L><R><V V="29" T="U32" /></R></O></R></O></F><TI T="3" I="10min" /><A T="4" E="TelemetrySuspend" /><A T="5" E="TelemetryShutdown" /></S><G I="true" R="TriggerOldest"><S T="2"><F N="RuleID" /><F N="RuleVersion" /><F N="Warning" /><F N="Info" /></S></G><C T="U32" I="0" O="false" N="ErrorCount"><C><S T="2" /></C></C><C T="U32" I="1" O="false" N="ErrorRuleId"><S T="2" F="RuleID" /></C><C T="U16" I="2" O="false" N="ErrorRuleVersion"><S T="2" F="RuleVersion" /></C><C T="U8" I="3" O="false" N="WarningInfo"><S T="2" F="Warning" /></C><C

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRF{35270E85-32B4-1341-A07A-E8F06B2445DB}

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	55789
Entropy (8bit):	4.978002979507498
Encrypted:	false
SSDEEP:	384:mt4yLLv6cJ/aw1R3u/GvANv9A2+n+Vx/WCK60Tej4S9t42LLv6cJ/aw1R3u/GvA1:vyLxaw1IvSwg2g2Lxaw1IvSwg2j
MD5:	34A25DD6338EE81BA34D09258571C7EF
SHA1:	AB1F41AED83EB2D94E94AF77EF48B5E79D01A305
SHA-256:	878AEA7419E75619CA6AACB3B6F4D5869BCE72AF6EE2C4EFFA0AD4F390C002FD
SHA-512:	543D5B4418ACC8BE5A1A0A814A1E075BC55811DED0214A9006DFB97F098F69D018FED1B5BD55D5315F76D6DBD40E3A9418F30D3996C73EFEA0B2769ABD375C21
Malicious:	false
Preview:	.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{0768DEE2-8C83-6A48-840D-449C2F450101}

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	1966
Entropy (8bit):	3.7905135711027502
Encrypted:	false
SSDEEP:	24:ePyRqaND2Wk2WuMWOgu96bdobfk4Ki+dMA3SrWuAaDUomHoXvt63O/6vO90BrWHl:sMJBRkRuy6bibfFKyqufj4at6eiv1WHl
MD5:	A96DAFCB6F86995613CB1B8540D4FBED
SHA1:	302FBD380695C0755A7176429BC6638894959E2B
SHA-256:	BE8B1753B65AA91D321562FBACE04670CDE9721111EE3B12D3366AA3C7649C5D
SHA-512:	E6947EF245B9AF84DC1FBB37EBF922FEBFCD6D3D93FF262A13B06CE72196F8A8A88051AEA07F0E465758F98426E67A8B0EA92088C881D606A03706E37B335E9F
Malicious:	false
Preview:	(.(.(.(.(.(.(.(.(.(.(.I.n. .r.e.g.a.r.d. .t.o.:.I.n. .r.e.p.l.y. .t.o.:.R.E.:.R.e.f.e.r.e.n.c.e.:.A.t.t.e.n.t.i.o.n.:.A.T.T.N.:.C.E.R.T.I.F.I.E.D. .M.A.I.L.C.O.N.F.I.D.E.N.T.I.A.L.P.E.R.S.O.N.A.L.R.E.G.I.S.T.E.R.E.D. .M.A.I.L.S.P.E.C.I.A.L. .D.E.L.I.V.E.R.Y.S.P.E.C.I.A.L. .H.A.N.D.L.I.N.G.V.I.A. .O.V.E.R.N.I.G.H.T. .M.A.I.L.V.I.A. .A.I.R.M.A.I.L.V.I.A. .F.A.C.S.I.M.I.L.E.S.u.b.j.e.c.t.:.D.e.a.r. .M.a.d.a.m. .o.r. .S.i.r.:.D.e.a.r. .M.a.d.a.m.:.D.e.a.r. .M.o.t.h.e.r. .a.n.d. .F.a.t.h.e.r.,..........................................................................."...&...L...P...~..............................."...&...6...:...R...V...d...h............................................................................................................................................................................................................................j.....h....OJ..QJ..U....h....OJ..QJ.....h.......j..J..h.......j..K..h.......j..L..h.......j.....h.......j.....h.......j.....h.......j.

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.856353775032188
Encrypted:	false
SSDEEP:	96:XBQgmkrC+RvewcD8v7lfSAv2CPlv7IKApsLvnkYVrvC4gqcvFgmxxvntei2FvDr:RMVslJJ2C9MTMn/51mbPYisv
MD5:	AE9A323786748588FDCD6F5AAE1DF497
SHA1:	F8A86C98BD87754503665CFA5C86ACFBD3563B2F
SHA-256:	BB2642EA467ED818F02CDEA8B0CE85F3D5AB90C1DA103FABD7D6ADCD2FB30EAD
SHA-512:	D5358D57F500A4C6EEB7004F57482DA4CAB74D98722FA606E91B6574B61FBE6742541F510BBB2B45D5613C49B68F60D931F60C835F838FC598450749268BDE21
Malicious:	false
Preview:	......D...D.d.....................T...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...J...L...................................................................z.................zt._QtKE>.................h"..CJ(.u....h.~..CJ(....hDD..CJ(....j.....h.W..U..mH..nH..u...).hJ<...h..x.B.CJ..OJ..QJ..^J..aJ..ph......h ...CJ(....j.....h.8g.CJ(.U..mH..nH..u.....h.W...h(.O.CJ.....j.....h.{..U..mH..nH..u.....h.{..CJ$.aJ$....h.{...h.{..CJ$.aJ$....hDD...hr\..B.CJ..aJ..ph......hDD...h.r..B.CJ..aJ..ph......hDD...hDD..B.CJ..aJ..ph......hDD...h....B.CJ..aJ..ph......j...

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20241213-1421.log

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	ASCII text, with very long lines (790), with CRLF line terminators
Category:	dropped
Size (bytes):	611939
Entropy (8bit):	5.428068580525188
Encrypted:	false
SSDEEP:	6144:McNyM+r4S4fz+m1mZ/brmQ4dHNK1IZUyrwj4dI1ETKZURrmP4dNObfcZNLrkb4wg:5NhY4JJJJJqqqqDq22vvvIIddddnR4
MD5:	003FE84135A613ACD57A06CC0046F5C0
SHA1:	2AA2B82C54F78FD4C36391A302932695419912AC
SHA-256:	A388ADD9FD959A495BC16353E20C2994321D2A529083DC836C6230C45C93C864
SHA-512:	76D72E25F684E8D988D65466D99CBC551FD4EB52B5AE5EE1F440F91EA8385D6076E1E999A29A1BCA46A50FBC2D8CD504131C7FB28C648E2B96888B63AFF41EDE
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/13/2024 20:21:08.715 .com.microsoft.Word.0x70000454d000. com.microsoft.Word.mbu.instrument.iangv.Information .Configuration {"FriendlyOSVersion":"Mac OS X 10.14.2 (18C54)","FriendlyAppVersion":"16.16.27 (201012)","NumScreens":1,"DATAID_SYS_VOL_SPACE":73389.3125,"Screens":[{"height":768,"Index":0,"deviceResolutionHeight":72,"width":1024,"deviceResolutionWidth":72,"originY":0,"originX":0,"deviceBitsPerSample":8,"deviceColorSpaceName":"NSCalibratedRGBColorSpace"}],"DATAID_OS_BUILD":"18C54","DATAID_SCREEN_DEPTH":24,"DATAID_RESOLUTION":1024,"DATAID_HOME_VOL_SIZE":102199.9609375,"DATAID_HOME_VOL_SPACE":73389.3125,"MainScreenIndex":0,"DATAID_SCREEN_DPI":72,"DATAID_SYS_VOL_SIZE":102199.9609375,"ProcessArchitecture":"x86_64"}.2207546C-E01E-4CDF-9010-7EC33713C893 ..12/13/2024 20:21:08.716 .com.microsoft.Word.0x70000454d000. com.microsoft.Word.mbu.instrument.iab2v.Information .C

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	22684
Entropy (8bit):	6.1396625226634045
Encrypted:	false
SSDEEP:	384:0dmLdCeur3+6jUg0UJI+ises5mnPNwNN1IWAcvj8pDVRTv2vPP:0dmZCeur3+6jz0KDes521w/tvApDVRTO
MD5:	4EEB72D0A3BE9DDFCEFD6F652F24FAAB
SHA1:	74935D6564DF2AE3F11A6726A61EB35438FDE9FE
SHA-256:	CD63BCE9B47359D63AD34668A8DCC3AFACA132B0A85B6EAEEA5EED8F55E301F6
SHA-512:	4DF96DA4F75A3927D1598E79413CFF2F371F2CAFBC5BE59CAD245449FB0C2D3EC705803AA6CA37651B78396C9F5D4A3591230843D6B4349D44A30454D8DAB408
Malicious:	false
Preview:	bplist00...\............................................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~................................................................................................................................................................................................................................................................................................................................... .!.".#.$.%.&.'.(.)..+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~................................................................................................................................................................................................................................

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Preferences/MSForms.exd

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	147080
Entropy (8bit):	4.318360537930116
Encrypted:	false
SSDEEP:	3072:W+uhVnCZ5za6iisI6iisSsaePGwceLiUSelWgTedWgpehis3edWgledWgledWgAG:W+uXCHzEV
MD5:	2B288B67C02074E6D5AF1C84CD489B6A
SHA1:	FD46A0FE5FE03FDDBCF4A177312D7490DB8AC583
SHA-256:	A83607CB4E8B063F38EB6FAAEC5D033CA147DF5F263B8D4456103794E6F7E57D
SHA-512:	1AA089C650C28FCFC5B752C7A57B192E66D0E42E4D379274462CE0865073AC39A5C3B70E615DEDE2DF21C19ACF0DBD227883A0675BDC67C0DABA9EE595A235A7
Malicious:	false
Preview:	MSFT................Q...........v...................7"......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-..........................x...........$................................................................................x..tF.......................................................... ...........................................................&!..................................................................................................&!..........................................0.......,...............................................f...

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/Custom Dictionary

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	533
Entropy (8bit):	5.2858782211935145
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXF3HuSE+TMHdgo+tJVEdQiCXFCuHuSE+n:2dfyiw1HuS0dfyiwUuHuSF
MD5:	20E2EE847F3F1DAE73A9025DA551A305
SHA1:	C0607E8701E244E97A4E7E48C25F447F146FBBC5
SHA-256:	54FBFECCE3A3B4512D5B41C8549691C953774530C6CC6B67DF5CE2BABE28C08A
SHA-512:	08C556B3B6E42F8292A48C1E9C66D9C9918E5A62FA1F58755CA007E081734DF63BB9DD5695785CDBAE13B41854DBC8A60F8F99F0B12D18D5E55D2C04018143CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>Name</key>..<string>Microsoft Office User</string>.</dict>.</plist>.<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>Initials</key>..<string>MOU</string>..<key>Name</key>..<string>Microsoft Office User</string>.</dict>.</plist>.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ar.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.682960070915016
Encrypted:	false
SSDEEP:	3:Qy2dfTHcjKRjgP7ChujTnEln:QyST8jKWChujwln
MD5:	4776CB70FE00BC6AEB696B410A3DCEEE
SHA1:	5AAB4C605B9B31312F317672DA960D4E1CADE04C
SHA-256:	2E7A61627DEE2B425849E0682E244E6E85F8E44C056FF3F6073DF86C189BCFA6
SHA-512:	4CB5A7C012BCAA8E5E3753BAC81D5295C416F2B0E5540E0C322A4899606BA94765735D669AFC6A0C2D80C8B83415B9D9B8777A6835B3F3FB7639765C8C2E311A
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".#./.H.'.. .'.D../.B.J.B.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/cs.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	3.229003086392269
Encrypted:	false
SSDEEP:	3:Qy2dfTHxlMwbRR1tlMkPlMMl26:QySTIs318kdMM5
MD5:	586346536BCA4E3DDD3C38A9C1F17DC0
SHA1:	093794E09D9B3BE6FB85FA9EE01BED3AEEDA7875
SHA-256:	65BAAA09B58FCE46EB14351A8393DF64EFC090F495D01F35B3FF0D13EB5D0169
SHA-512:	512E8B42CF751A3780B8A2201FF7BF90B154D1C452291E3BC7BA2C6CF8F7E2CDB5B0C8E5642EABB168EFBB6FE1D84608273B1DFD46248E9248E9F824F377C725
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".N...s.t.r.o.j.e. .k.o.n.t.r.o.l.y. .p.r.a.v.o.p.i.s.u.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/da.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.1684506109768003
Encrypted:	false
SSDEEP:	3:Qy2dfTH0l+xRKN8iOEAc:QySTUltKtpc
MD5:	CF843AE5C1B90B1B55283AF897B542D3
SHA1:	B3BF056D596C71B7748E54506095759939D9B4B4
SHA-256:	B6D0DAEB079285256C87445E5AAB178D4E62FED927344C08CC2CBEABF809E451
SHA-512:	F7242C9270943723D4CDFFD231F281A74D9AF514F5F9B589DB51AB72F5508191C03303378AB289229331BF08698D804080772870973ECC31F6115B6F853B2E96
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".K.o.r.r.e.k.t.u.r.r.e.d.s.k.a.b.e.r.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/de.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.1543182699584356
Encrypted:	false
SSDEEP:	3:Qy2dfTH0l+xRKNy0lHMn:QySTUltEcsn
MD5:	FAC73D0043DAC6F75608769E9F61ED19
SHA1:	2BC5131486F2D11C046C5F8F318EF0304BD9D83D
SHA-256:	ECD6E22F111F573A0DE236CAD9A47F03B40CFEE8487778E140CB2CE032E6509D
SHA-512:	8758C199F4C8181A5147F3A2DD7717A2E675575DA3312929B308D0F227C9C35FAD79222CC13890884609DFBE8934990D8595BE9B07247E72D4C3835AA613E7FD
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".K.o.r.r.e.k.t.u.r.h.i.l.f.e.n.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/el.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	3.9086117266317446
Encrypted:	false
SSDEEP:	3:Qy2dfTHqmatEUmFMpmgmc7tfQ1Ejs:QySTKsMpmat41D
MD5:	F4D2E086599074426AC6A837DB387511
SHA1:	6C45111E53BC020B1CB3C212F54B0FBB6D09DDE2
SHA-256:	D8FF17F32E934DAB1C8316027821AE5038E40930D6FBCFD742A5DF3B1C7DC056
SHA-512:	2CF1D11507355AE9E08630F9D32F808B23ED3019E44D6C239748D6F2BC60E63741015F93507171CF91AE15D4D06C1B46E1CA384E752FC115A6CBF6A8A121629A
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. ."................. ................... ...............".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/en.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	2.910570932494852
Encrypted:	false
SSDEEP:	3:Qy2dfTHvlXQ2dft:QySTySt
MD5:	33710D103D50C71EAF39988FB87D38E4
SHA1:	7D3CA7064D7B04833810468367B856B99FD800B3
SHA-256:	CA4EBED01FEDD706C103D024A3B07B387D970386FA06EDF69B80C138091FE04C
SHA-512:	C4245216A0E64C1B7239CCDDA4DA4B7F1E5FA5EA0A0FBE8063CBA0B22597B8A94C51F0318E090AC1F8E57EF42A125968B04DA3BA45044FA28A62200CD17F5215
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".P.r.o.o.f.i.n.g. .T.o.o.l.s.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/es.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	3.174181436315041
Encrypted:	false
SSDEEP:	3:Qy2dfTH3lA1OLalLlYMlcFcKfLln:QyST+1OLaluMquMLln
MD5:	7F7EB49E58EDD8EF1A733E81D9B3BF89
SHA1:	AE6E8541E61D7EEB80111F3CA865DDE5543E1E14
SHA-256:	045C0D75E98636B8BFEA50A73ACE6A1ABFB58AFAEF095CFA17FB3496E651E561
SHA-512:	8FC0C304F6EF4C4A4E5EE7F841D69D26751219D2D41F0DB4E96FE5A6676822D493633ECF3052AE3E4053FE8D428D245A350107EE16BAF8983DB5F115B2EF4211
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".H.e.r.r.a.m.i.e.n.t.a.s. .d.e. .c.o.r.r.e.c.c.i...n.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fi.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	3.1933319052994475
Encrypted:	false
SSDEEP:	3:Qy2dfTHrlAK2M3WlKMlyKYGrKEpwbl6n:QySTSg3iXthrfY6n
MD5:	EAAA665A7EC2260626D5A6F81FBFD2D5
SHA1:	318A5BC91DB8C5A1DF234AC230A6E189428C7CDA
SHA-256:	72C062C61C574212A40F01F192B4FB139A7BFE660EAE27F449EC4F3D316B6F57
SHA-512:	98AFA75F28EA404A8F80BD65F19DD875366AD28F2755E9E451280D8F7A2901E3EA00E48B2EBFD7DF64972073B56FB8D6B903948B0672043799BB6D77D6F88C0F
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".T.e.k.s.t.i.n.t.a.r.k.i.s.t.u.s.t.y...k.a.l.u.t.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fr.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	3.2135874002924356
Encrypted:	false
SSDEEP:	3:Qy2dfTHwlskJMCFJiXWZWdLveln:QySTQlZuGodreln
MD5:	94D951325E7CAD48A4EF7AFC1E8C84AB
SHA1:	B64D44502252F8489EF3A8AB5769B3B626768C1F
SHA-256:	D5193640F18E4B4C810E1260B1D7DAD83865A4747C24B6052604D67968AB4936
SHA-512:	998CD7C1D2BCD4C42245EE0795509F39A7DFAF34A7B99214043E4B7157FB3F4328F9D1D905BBB3B24CDA79AE3A9DA5DB28A5C1EF735CAC89721FAAE851D5DF5D
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".O.u.t.i.l.s. .d.e. .v...r.i.f.i.c.a.t.i.o.n.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/he.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	3.4953528112598122
Encrypted:	false
SSDEEP:	3:Qy2dfTHkg5g8go0gmHMn:QySTE85gsmHMn
MD5:	DABCD4CC05E8583AD885AB3AF975C56F
SHA1:	F2ACFABCC2604B25B4970BA0803A27EDDA8D1E9B
SHA-256:	50188525648F74467732C32701BBBF3A5CFB9BA8F57872C550B3F95768C335F1
SHA-512:	3DB0CB1EB7C9D7B42F42C2D6F6C924BC223A09874D03ECDC87017A01BB34A0507ABCEC5D43A092BC88D41357C9A6FD1AD932984E2A5E68B512A2D4680A3215F3
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. ."....... .........".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/hu.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.3218078519938987
Encrypted:	false
SSDEEP:	3:Qy2dfTH6lralVvalWfI6Mn:QySTalruVvw
MD5:	2133A797E4A7634E9EC97C7428AF3C22
SHA1:	7695F54E21462CAE42E5DE87121C3BD7CC604FEF
SHA-256:	BCB4A4868E6E463F0D96BF2833432C615EDE7A5EE9BFD25CAA3AEA671F2B0255
SHA-512:	8878CD676837FC678AF64742A2DDFB658ECE2A76B84BFD397E2BD7C665B9D171F515BE3AD104DF218018F9666E98DC5D9EB6944834FB28052F96B9FE88C8F5F7
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".E.l.l.e.n.Q.r.z.Q. .e.s.z.k...z...k.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/id.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	3.1946185174642605
Encrypted:	false
SSDEEP:	3:Qy2dfTH+lJeidkMe9lNl:QySTelQidkM03l
MD5:	41FF3F9EE6BA77DFA346D568AAFF38D0
SHA1:	81CEEF719DCC9E32D3E0A879C4E8629DE02F32E5
SHA-256:	4B5096C36C4500677C01D2F23AB9429DF9F51F8BF1DCA8039283ABC939281C15
SHA-512:	A8F7E843BBB10D7EA64821D94234EBAF2A4489A4E1D207DF5D4A6AD4B2282F22E36A2274CA34DC52ED443AB073CC159C332AFC9A5B177AB0C3CD243D5B258F6E
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".A.l.a.t. .P.e.m.e.r.i.k.s.a. .B.a.h.a.s.a.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/it.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	92
Entropy (8bit):	3.1565773928186873
Encrypted:	false
SSDEEP:	3:Qy2dfTHslRgxqpkfyKwMRkln:QySTMl2cpkfZwMyl
MD5:	5BDBDA0D0D7B502F463363BAE5D3ECEE
SHA1:	01A8FF8F4437820AB135A252AF486D5F865866C1
SHA-256:	A337EAA4E641DA88B9A089AC343D0B5F545AF2F847A419747FA0253D91F256BA
SHA-512:	6F9584BFAC15E9EBF39828DF294211194E056E6DE80C637A110F1BAFCC48CFC9BB766EA5C84F61AF3C92A9D56AF596F86B463EBAD70C99101044B487893E922C
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".S.t.r.u.m.e.n.t.i. .d.i. .c.o.r.r.e.z.i.o.n.e.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ja.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	3.599903661087115
Encrypted:	false
SSDEEP:	3:Qy2dfTHex5E6:QyST+x5E6
MD5:	DF7C9EEBC6BB4E445EC58AD78D2936E3
SHA1:	6400EF54A15F72B324A380F8568F78F2C77C2D27
SHA-256:	2DBD602F439E649DFFAADFF9E60FFF16220B5C706EC2DC4E7053B1DACDAE03BC
SHA-512:	152BEB94C317C82B73CED919DC0A20EF20DE92F7023455423A0FC667681A7F8178977E5950108936FD92CF0E8B7BFF2D63E3F9C4D0BB250E4BE1585AB4DBB96C
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".!hck.0.0.0".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ko.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	3.605023076649061
Encrypted:	false
SSDEEP:	3:Qy2dfTHHgRdw3Il:QySTgRdw3Il
MD5:	8D088E90F5572158094887333B425415
SHA1:	0107D6C2460C36AC8EFD587797709AF3ADFF4101
SHA-256:	AD7461D4337C3DA696615DB1E4DFB5D675BAD15C861B003EB1FE2AA1C347618E
SHA-512:	D166239E530B5D6A73CF28DB9C2B34EAAF5CF271A79CE50D9BB3B4835A09AF9D199FEF0104700710227374260A0EA3B678E49ACD43119696EA96CA2D06613E30
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".... .P... ..l.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/nl.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.0917539607194424
Encrypted:	false
SSDEEP:	3:Qy2dfTHrlME7lAlC0llils:QySTGEhAlC0Pils
MD5:	F970AB662E0D5EDB33B8041F23EE9A58
SHA1:	31959CE6AF90382C2B3881F439B0D3D890CC5A78
SHA-256:	A288EFF6B89359C87D609195A1B47D2F2C42A83A24B104DB1463CF2B129196ED
SHA-512:	4A93CB0A1D7993239B26EFB5C87C56B9E485F48520324BBD7ED9523AEDA315272AF3722CC85CC071231BEF1D01764FAD2F0A802CC2C8529A1CBA9975BE9F295A
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".T.a.a.l.p.r.o.g.r.a.m.m.a.'.s.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/no.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	3.190589219350794
Encrypted:	false
SSDEEP:	3:Qy2dfTH0l+xRKNU+Rdd:QySTUlt++Rv
MD5:	24688CC64A3232577FB669D5847627B1
SHA1:	C808CBD9D557ECE65F1564B49E679CEBC4DEB274
SHA-256:	6F238BBE013D855C7C834D32D1C7D108137FBB2835234F68CAEE0BCCA37ECA9A
SHA-512:	0B4DDDCD174EB38727F919A9257F592CD997EA9C718A49E146D163A3A4D9E5155D138D07174AEE687DDEFDB7F5421A2C05490E0BE994993AB6E5CAF317E69A20
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".K.o.r.r.e.k.t.u.r.v.e.r.k.t...y.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pl.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	3.42532968787373
Encrypted:	false
SSDEEP:	3:Qy2dfTHxlMXf8kilXPlKMlEP1dEln:QySTIP8xXdKkEPfEl
MD5:	B439AD1AEDEAA9BD4296C772FD48E3B4
SHA1:	61731198375551623B254122B402F70ABEDD24F3
SHA-256:	D6A65D7D6EAB2B75204E4474A5A75EC012317AB828D42C36F1E998D26F75BCB0
SHA-512:	77E0F53612CDD5FB43FE7390809894BDFE2BDA072EF4BE02AEB7DEE79C61EF7F7F8065FB82B61CBC342E888C9B5F5C1F8F7E2F5E05408BF4C614590C1CEAAC87
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".N.a.r.z...d.z.i.a. .s.p.r.a.w.d.z.a.j...c.e.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.1044858244178184
Encrypted:	false
SSDEEP:	3:Qy2dfTHtl2iiK3AMlfkFrWikl:QySTLwMq0ikl
MD5:	27009EE68674F9397E53699A4D251B0E
SHA1:	8E7A79D6B5470E63095B636FB17457F56905EA0F
SHA-256:	7DAB4E34E50E7A7CF0ED44E7D82829825AE954AD57E615A7FB43EF3E7A096DBE
SHA-512:	B696919154863C108BFECE3324FD2490C81AF7F7A713E5D45CD528CDCBB7698AE081F324EBD29EFC42FD8EB74BC957795C04B4015C50EFA9BC9D69060A252BE7
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".R.e.v.i.s.o.r.e.s. .d.e. .T.e.x.t.o.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt_PT.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	122
Entropy (8bit):	3.302440069578964
Encrypted:	false
SSDEEP:	3:Qy2dfTH5lyNeH0MlcFpa6WdYclKhMlRmwIlWLWHM:QySTVH0Mq2jdYclKhMlRSlWqs
MD5:	EB7E26313860F756306FAE9447235174
SHA1:	39CDC7571936BCF089976F83EEA7B6594B2BACCF
SHA-256:	D43C25DCE728723725B552D331DC4166C88594E27B285864FBCC7F9609475ED9
SHA-512:	8BFDC43C5D7AC8B795327884ADFB187A412CF1546DE9E5CB5C8FFBB4415753DCC542B5FC80064B425222FB4FE6958447E091EC7A4C6F734D7DD3286537740EA6
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".F.e.r.r.a.m.e.n.t.a.s. .d.e. .V.e.r.i.f.i.c.a.....o. .L.i.n.g.u...s.t.i.c.a.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ru.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.8291069798649797
Encrypted:	false
SSDEEP:	3:Qy2dfTHehcFuh7fLh0GY9YuM:QyST+h2uh7BY9Y/
MD5:	9FD7D227240F44B123D930CF82A28ECA
SHA1:	46B89E11FFE358B7229F8E3211119E4F2C234714
SHA-256:	75F4B16099AA3CD1CE766AF2E169D7E37CE3F4C66796258F7CBA5163EECA7987
SHA-512:	D39B49FF66E2AFC41BE0646D8905D0E0A5BBD6327CBB03615C571EBAF011CD941935902F577EB8944B064649CB6CD6EB86D8E865492EC3BDD5C443BDD02137F6
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".!.@.5.4.A.B.2.0. .?.@.>.2.5.@.:.8. .?.@.0.2.>.?.8.A.0.=.8.O.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sk.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	3.1821020192544074
Encrypted:	false
SSDEEP:	3:Qy2dfTHxlMwbNBlRF3eEl:QySTIsbbl
MD5:	C554AF8796DEC9C0FB07B171AF92587E
SHA1:	7FCDEE38E1C526E1CDD9FD872AADDB1B356EE86E
SHA-256:	FBD30B5C7508E7C053A0325E93E08CAC03EEADB62242BDDE31115EAD8B3F94B9
SHA-512:	9865CF6CD6292819412674CE0646290F17A71322858CEB39B300108946B997216D03DABF363C9E24868A33271AFB57C098D7A7C6AC69B0BE6D85B0B05B6B8704
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".N...s.t.r.o.j.e. .k.o.r.e.k.t...r.y.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sv.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	3.236661422561559
Encrypted:	false
SSDEEP:	3:Qy2dfTHslV3AtlXURcIs:QySTMl9At+Rcj
MD5:	202A6016EBEDA4C0F007446F1D74740D
SHA1:	FC3BB0DCE97AEDC946D7CD000D297DA0E7360B5F
SHA-256:	8A073E4FF39595EE3409FD59375B20D838C00E1B477BC7147B54D54126D84409
SHA-512:	C86321E781CC88103ED91F33ECC099E55DB091869C652A801B11B74304887A34D1EF2D6C281200D08D86E043390CAEAE53D7A1A475FCBE909F024D012E080774
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".S.p.r...k.v.e.r.k.t.y.g.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/th.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	3.983800138281137
Encrypted:	false
SSDEEP:	3:Qy2dfTH/r9dFN6RbWt2yri:QySTrl7W
MD5:	07F749180EDD607107E7FE5BEFCD2B80
SHA1:	D5E16FF9085F3A2B948FAA3ACE755ABFC1750414
SHA-256:	C8B9EE7470AF0699A66E7C3266327D175F479343447F646EC72EA4F042EE009E
SHA-512:	C5C2025CCED685E722C02B5B1CF12BC9D9926ED36A300FBD842547A9479B9E73BB2FDCC2CA95BC58F13ABC2819C4B79B569FD0B5604F3263674AC4E25BAE24AB
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".@...#.7.H.-...!.7.-...4.*.9.....L.-.1...).#.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/tr.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	3.3834261474120177
Encrypted:	false
SSDEEP:	3:Qy2dfTHmlEfulHJAleecMekkl:QySTGlEGlulvWks
MD5:	5BF4A82EAF85BA5AAB07403969D1E379
SHA1:	7DC8A1241C5230A03C009FC5A02FFBD5832685C8
SHA-256:	D8BEB30B0B00B7988294091A34E6971FE279F54364AC0BD568A92885952B0A23
SHA-512:	F6DBBF0F579F3EB4D27E20E889303259111E1A7DD3C39352E49557996151CB799FE7D48503E37E1F6F9E04E69CDEB97C122B748C7E8D7EC532CD5AEAA4148EF3
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".Y.a.z.1.m. .D.e.n.e.t.l.e.m.e. .A.r.a...l.a.r.1.".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_CN.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	3.553732259345248
Encrypted:	false
SSDEEP:	3:Qy2dfTHePFel:QyST+sl
MD5:	7C5F09EEF6C3BA4DE766EE9543698C1F
SHA1:	54BBE49811B5BD941CC926BAC101E8B03BBE3EAB
SHA-256:	771161AF6389886C05A9C5B64878A9B9348A83FFDBF84DA23E2ACED033E2CB80
SHA-512:	EB6CF65FE7BEDAF6F3E73BBD693A81714DCF1C34882FACF81DECD5462087B32DCAC757516D5C9E22A58108B7D9CAAF9C280DBF1D0E1C702E6D7C871B2DF9BF46
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".!h.[.]wQ".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_TW.strings

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	3.553732259345248
Encrypted:	false
SSDEEP:	3:Qy2dfTHe+Vl:QyST+Ql
MD5:	7B02B52E6E18AE4A18CAE3CA7B42D2C0
SHA1:	87C06B55A63E2C3216E58ECE9DBED2CB9339BC50
SHA-256:	25228F342B3C20D7C1E017704538A68B3B55F937D5A9C91D80BAAE339D029AAC
SHA-512:	32E8674A6AC4478B4649067454101CD5A387F69F9EF48968364196659B2A9E39CEF72E743858542714C93F24CB55E4BDBD7D2AA973DE088105EE6FF3DF7C146A
Malicious:	false
Preview:	..".P.r.o.o.f.i.n.g. .T.o.o.l.s.". .=. .".!h...]wQ".;.

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/~$stom Dictionary

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	data
Category:	dropped
Size (bytes):	324
Entropy (8bit):	3.066647172318385
Encrypted:	false
SSDEEP:	6:paRS1/l8lGDb5Mca53EuNcAq6ltlwgaRS1/l8lGDb5Mca53EuNcAq6ltln:URSclGDWZ9NcAqOggaRSclGDWZ9NcAq2
MD5:	A03DFBB091088A47322124DB004064C1
SHA1:	D4E6D5BF39BB601CA87746A8646E78456BFB4D6F
SHA-256:	B8423742DB04F3D64520A226087A2F679DEC3689FCE0A24D7B4E2E024378BF50
SHA-512:	FFE6FE15AB32215041961F93B4B578F03A4EA967BC8FBE7E98291B0399D81DA59D4C1F2DC1B9DBA3B0CE4EE1FF7ABF08915F0929A3B6B0B771CA3AC5A367CD62
Malicious:	false
Preview:	.Microsoft Office User..................................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .U.s.e.r...G.r.o.u.p. .C.o.n.t.a.i.n.e.r.s./.U.B.F.8.T.3.4.6.G.9...O.f.f..Microsoft Office User..................................M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .U.s.e.r...G.r.o.u.p. .C.o.n.t.a.i.n.e.r.s./.U.B.F.8.T.3.4.6.G.9...O.f.f.

/Users/bernard/Library/Keychains/login.keychain-db.sb-07d82885-TI0FON

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 963362762505407623593984.000000, slope 303834226087943251262072422400.000000
Category:	dropped
Size (bytes):	74372
Entropy (8bit):	5.041715422171676
Encrypted:	false
SSDEEP:	1536:kZoxchjXEq6+LClEXWtwE3oIeWAm1AWAmqmBd2mqAUUFEWbTz:kZoxchjXEq6+LCl8E3oIeWAKA1mn2DK
MD5:	0155844B714F3B5A389FEB8C0B6961CA
SHA1:	9CFE67BC73D6EF6CACD198F8EF8ACC039D485A20
SHA-256:	A2015A168E39B7E3A4FF3458BF647DD2CAA8533324918B642AF8BED31ABDCD80
SHA-512:	C4ED880D05E1232DCCA2620DF655C7951D024FD3D5ED2129028944A10F4F98CB00B9C4DE3A1123BE8DE1462789824DEB27B84E08AB3F4BEC0521F94A73BA167A
Malicious:	false
Preview:	...................H...............H...............X...................D.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...(.......................!...%...........(.......................!...%...........(.......................!...%...........0.......................!...%........DBBlob.....D.......................!...%........CSSM_DL_DB_RECORD_PUBLIC_KEY...H.......................!...%........CSSM_DL_DB_RECORD_PRIVATE_KEY......H.......................!...%........CSSM_DL_DB_RECORD_SYMMETRIC_KEY............d.......P...\...\.......P...\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\........

/dev/null

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.727719665673474
Encrypted:	false
SSDEEP:	3:tR5/fXjnQQI2bj1WOv:l/f8QI4kA
MD5:	7B11300A246BDC839F8FF9FB671D2D98
SHA1:	D766801AF6AE927BBDB58F89ED67B6DBAE4D78F1
SHA-256:	FD6EC15B590FC4D945B2BF94924F7B0776A9B18A4C3974A29CDC91CB91BA6CC0
SHA-512:	68918F914076550CB8CAE42ECBF9371224A48A066A80493DDB8FCF202A4CC8E17435AF15A95641BB7EC8F7BA3926830C55CD70F7E759BD180D25B62F7E42218E
Malicious:	false
Preview:	2024-12-13 14:21:30.655 Safari[645:5230] ApplePersistence=NO.

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	data
Category:	dropped
Size (bytes):	19328
Entropy (8bit):	2.9753497322131066
Encrypted:	false
SSDEEP:	192:XVlGq37NZFFFF/QQQQgdFSGXFFFFnQQQQ:uq37HFFFF/QQQQg3SGXFFFFnQQQQ
MD5:	1D8E1388683DC96ED97907EFCCE83FDA
SHA1:	561FDF03A98032BAAEB7BC214FD6FC2712BA42B0
SHA-256:	A6BE2B32F120066646A50B537477F2D359D7013851F123146CB9B6A7A1371E8C
SHA-512:	70A1E99DAD32B200EB26AD78E6433B3E9E052355ADA3A3AD1CB6C644C1A0513E593CCD89EF8B9B305013B37F3F850F049D787677878F412D23FB517147C18C98
Malicious:	false
Preview:	.............J..dJ......clti....0.......mlti........0...blti....2.......blti....2...H...blti....2...\|...blti....2.......blti....2.......blti....2.......blti....2...L...blti~...2.......5lti.@..,.......5lti.B..,....$..5lti.p..,.......5lti.D..,...87..................(....................................... .....................~...f... ...!............... ...4...3.......>.......U.......F...E...G...C...J...K...I...H...L...M...N.......O...?...9...P.......!............. .......t............."...........................................................#...............................^.......X...Y...Z...[...\...].......Q...........S.......R...............$.......(...%.......................&...'........... ...*...+...,...-.......5......./...0...1...6...7...8...:...4...3...........2...<...........T...;...=...>.......)...U...V...W.......@...A...B...F...E...G...C...D...J...K...I...H...L...M...N.......O...?.......9...P.......!...............j...X.....R...........%...7...........\.........".........

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5:	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3
SHA1:	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C
SHA-256:	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
SHA-512:	1DC5282D27C49A4B6F921BA5DFC88B8C1D32289DF00DD866F9AC6669A5A8D99AFEDA614BFFC7CF61A44375AE73E09CD52606B443B63636977C9CD2EF4FA68A20
Malicious:	false
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	false
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Word/mds/mdsDirectory.db_

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	97816
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	1536:8MdGIApBouRwQQOnGqwc2U+v+hkMdGIApBouRwQQOnGqwc2U+v+h/:vKouRwQQOnGMKouRwQQOnGG
MD5:	A4C012BBB09B0B19F4A3234F4400E4A9
SHA1:	944771D35DB56488D63544C09418C4235B44E3B2
SHA-256:	EAC36EE71C5AE4B6D2024C333C2EB7B6C0415FBFCFC264A5B19C4F10BB0126B8
SHA-512:	7A0F6E0FB0276B769572ED32D0B0311EC84827F64436E4D0EB13DA5489277DD3705142F03F2C14C23E768FE7BD454A3E1C564BC275D3C1D740BB97CE0DE33759
Malicious:	false
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Word/mds/mdsObject.db_

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	8808
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	96:3X6LjLfe3qEn8kYuuSnX6LjLfe3qEn8kYuuSX:Ge3ZnG1SWe3ZnG1SX
MD5:	636C97726FA8460EAB35E0996589DB4C
SHA1:	D1BE760E43173671B670A20DED636CD93BCEE7C3
SHA-256:	1136941331967FDA088BB15807F23F25EF27E7BFEE1FCCFE1322965857CF23F7
SHA-512:	18AA47895D51DBFFBD8BA50A39F7BAFBD3FEAA825EEA03A004B9C0DFD27AC340626A21609FED79786A125521E5C2C9593571BEB14B5CCEC34461815C0ACEB218
Malicious:	false
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	70789
Entropy (8bit):	6.3739716471518975
Encrypted:	false
SSDEEP:	1536:RiEN19fJaM9tCm1vtMyMWzQPOhGnqtvjBfxW:Ri21ZJaMnCmxtPbbsqtvLW
MD5:	69D08C7EED04EB7C731052F1B8F4DBEC
SHA1:	AC1C3C50BCC4460B922DAFF04A7297E2ED9AC5BD
SHA-256:	D8860B7D73E6AD4484C666B4A8A117A1758CC70471DF4C54100716CAB08BF35B
SHA-512:	3D94529F171C4D44FB13C029FD8D11D11ED829BD5096947600562834148A095A20443CB502497E2BFB4BC58B390C445934DC11A1E65A15C7A9700512CC2A1456
Malicious:	false
Preview:	bplist00............................e...................._..PasswordGenerationRequirements_..AppIDsToDomainsAssociations_.;DomainsKnownToDoSameDocumentNavigationInTextEditingCallback_..ChangePasswordURLs_. DomainsWithAssociatedCredentials_..DomainsForPasskeyFallbackUI_.$DomainsIneligibleForStreamlinedLogin]SharedDomains_."DomainsIneligibleForAutomaticLogin_.BDomainsThatWhenEmbeddedAsThirdPartyAskForPasswordsForOtherServices_..DomainsIneligibleForPasskeys_..DomainsToConsiderIdentical...;..................................... .!.".#.$.%.&.'.(.).*.+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~...........................................................................................................................................................................................................................................................................................

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.37469842251369
Encrypted:	false
SSDEEP:	3:Nsm4nJNsGRbDJNsGM1aN7btoltm:NxeJ+gINaN3t4s
MD5:	7EBC7BAF0AB51EAF60EC8BC288C6B2FD
SHA1:	73E13AC19207D31E7B408C116B282EDACF66B2AD
SHA-256:	A2948EEBBF7982A18CF824CE6929D8003E93C52EBDF7EF6AEAF18E0F6B7F8CFF
SHA-512:	95F712B1A8B131EF083E8B479702A40130643E4784EB3F842732E4F40417B199D414675E607EE1B3D14D3B88E6A4BA4E0D5A130F0C78A6C2089D5F4179B10084
Malicious:	false
Preview:	bplist00....._..TemplateIconCacheVersion]TemplateIcons.....(68...............................9

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.286991847916908
Encrypted:	false
SSDEEP:	24:2dfyiwHuG5Ku3hu65juqVrTrmuGoTxR1F1xW:cfyP5Z/5PrUon1F1xW
MD5:	0C29425555C7FF0CA114B1FD0DC39C50
SHA1:	D7D808E8BE92462F4C3CEBA66734F0E9BB26ACDD
SHA-256:	52826AFEEC974BB7BACB85BDC01DC4F23BF917D65E04773D7CAD393F7866F3FD
SHA-512:	D9C8364A85F4B4A96CAAC1409F32F9D6B2F8AE19201E0ABD2D449A3EEDADD471E99E44BC92DEB5D8FB60287DA64A88E61B45F759E7B9A383A9BBE5F5FD242F95
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>SingleDeviceSaveChangesThrottlingPolicy</key>..<string>1:1440</string>..<key>MultipleDeviceSaveChangesThrottlingPolicy</key>..<string>50:1 \| 10:2 \| 10:5 \| 10:30 \| 9:40 \| 1:510</string>..<key>SingleDeviceFetchChangesThrottlingPolicy</key>..<string>11:15 \| 1:1275</string>..<key>MultipleDeviceFetchChangesThrottlingPolicy</key>..<string>50:1 \| 50:3 \| 20:4 \| 20:5 \| 20:15 \| 20:18 \| 20:20</string>..<key>SyncCircleSizeRetrievalThrottlingPolicy</key>..<string>1:1440</string>..<key>MaximumRequestLimitCharacterCount</key>..<integer>100000</integer>..<key>SyncWindow</key>..<real>1209600</real>..<key>HistoryModificationIdleDelayBeforeSyncAttemptKey</key>..<integer>90</integer>..<key>HistoryRemovalIdleDelayBeforeSyncAttempt</key>..<integer>6</integer>..<key>SaveChangesBeforeTerminationTimeout</key>..<integer>1</integer>.</dic

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	2890
Entropy (8bit):	6.383267531551876
Encrypted:	false
SSDEEP:	48:FMO+0F/o0CCPb/bCCoumzC6kiaR/wN4Gfhb0NegHI5mP0waijwg+tiEe:FMO+EoOfjovzCuv5I12msjtHe
MD5:	99707B6E8B1DAA434DE2A176A458F85C
SHA1:	96324F62483DD7AC8683D1850D694BB900EB3419
SHA-256:	F282D8A52BFDCD208792A47C074E59A1E16D627D53094E11FC73E595AEC7DDAD
SHA-512:	E8018018F91A5CE5C418F5C6445DC11A44B40AA6F619958D496B18507B3FE309415BF9AB293E9C7C0B3E4BA109213D0216D39C0304A7BC3CCE301DB0A729430C
Malicious:	false
Preview:	bplist00..=..........!$'*-0369<?BEHKNPRTWZ]`cfilnqtwz}......................._..Bundle Identifier_..Developer Identifier_..com.ci.LetyShopsZ8SY8U2YJ38....._..com.stopallads.stopalladssafariZW5672G9B78....._..com.ci.MyPointsScoreZPV79DKGW8E....._..com.shopicks.safariZ52637H29AM....._..com.mallforafrica.mfaZW67LVM7587....._..com.ci.FatWalletExpressZMUA2CU723E....._..com.ci.CashrewardsZWPDLU326V5....._..com.ci.ObybSecurityZ284W368NRK.....^com.ci.AmikashZP77C556755.... _..com.ci.ShopBackCashbackButtonZ63768R85VC..."#_..com.skaggivara.UniblockZ9ZWDNJ5X28...%&_..com.pcvark.adblockerZRQA86TX865...()_..com.ci.PrescritZDPQ487PKR3...+,^com.ci.CashBagZWPHQAS3C45..../_..com.betteradvertising.ghosteryZHPY23A294X...12_..com.ci.RotaryGumdropZ24MGUH34FU...45_..com.ci.DeippiesnlSpaarhulpZH8MVFTTJJ3...78_..com.ci.Rewards4RacingZL6C8C726SQ...:;_..com.findx.privacycontrolZ5QE6FTCMP9...=>_..com.ci.ShopandGivereminderZ5KWKJVWBTS...@A_..com.el1t.uBlockZ3NU33NW2M3...CD_..com.ci.DealDoktorZN64U5Y52L6...FG_.(co

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	3224
Entropy (8bit):	7.685711247366019
Encrypted:	false
SSDEEP:	96:zsAMozR/eyuKgoh71qgJVdYmfZ3r0+o4+tEWXgypdokPzW:A/gxeyuKgoHq83ItvEKjVPa
MD5:	58C94FC7DD3E98DC2E3F49FE4BB2B790
SHA1:	1E0344E08E34DCAFD5DDD62678BA5D08CF46C4BA
SHA-256:	857BD5ED6B7BBCD62E5380D5891D925A26201E91A0A1C0EE373818EFFAB64640
SHA-512:	A3B8732C57EA3B7BACEE732CBC57401DE5181FB8CDD6A57EAD83FD6F24DA35686FC6EC34AB2424EEEEB018466BB7DBC60180B195C7DB81BBE042440B8FFE1071
Malicious:	false
Preview:	bplist00.....^SessionVersion^SessionWindowsS1.0............................9_..SelectedTabIndex\TabBarHiddenZDateClosed_..FavoritesBarHidden]IsPopupWindow_. PrefersReadingListSidebarVisible\Miniaturized_..WindowStateVersionZWindowUUID_..WindowContentRectYTabStates_..IsPrivateWindow_..SelectedPinnedTabIndex...3A.go,e.....S2.0_.$CC867525-ED25-434F-85EB-6363A6032489_..{{0, 49}, {1024, 696}}.... !."#.$%&'().,-...0123456.\IsDisposable\SessionState_..AncestorTabIdentifers_..SessionStateIsEncryptedXTabIndex]LastVisitTimeWTabUUIDVTabURL]TabIdentifierXTabTitle_..ProcessIdentifierWIsMuted.O.....4.... ....@x....]k.....N..7&.....(....f...Y.......Wn<..(fn)-.k....h.#..J.au.3...?}..).....wp.y;e.l.........St^..U.54>d..}5.R .j...eM..@.b#CL+n...aP.w7i..4.b..Y....Yd...Wb..}f"l.m.W.-.....7'.b.c.1....OZi....3j..h....\..P..\Y%.J.4q...*.....>!v.{.pU.....<...i....m.0^..{\|.a.. .8y..^.......2..T...'.U...L..O.uVd.J.~.5t...9.-...N.,[k.... ..doDdw.M.0/.3Gu...e\.U.R..Y.R....lk4./d9.ez=..e..

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.9370658315190226
Encrypted:	false
SSDEEP:	3:N1n6qMvRGNMTAnd/t1tH:N1nleRaMTAltH
MD5:	CDC65B5F112547EAFAE0F16F9C149426
SHA1:	AEAF9908A5B6FF3E2F7B738ABF5FE9E79108BA01
SHA-256:	1C6D085D871A855CE4A3902BAB4B9B92631B8EE8F0B7F6536768A2AAF427B45C
SHA-512:	E8B0E4CE6A760A718A19976D3CFE9063F04FB4BF179947AECA84E94C83F21459FB9DC0FFABEA8F633BD2D0BA94FE1E15D8C97E9604FDE8BD0DEA961EB83BDDB7
Malicious:	false
Preview:	bplist00..._..ExtensionArchivesExtracted...(...............................)

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/C35370E4.jpeg

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 337x150, components 3
Category:	dropped
Size (bytes):	6217
Entropy (8bit):	7.910953250801019
Encrypted:	false
SSDEEP:	192:bi7WdHL0rhMOzR7SboKrNj59SFtH7I+MyZ:2idL0rttekoNfS3MG
MD5:	711770BAC92B61644F0A0FB4F917DB44
SHA1:	FF697068764E82833C34833ADE1E0866FC790E78
SHA-256:	F7A061901758E6043632DD450C736D218B256A08BE22DDF40DE2C57682A4CED3
SHA-512:	6DE07CD4BB5FBC1C3C8F8C5356ADB0562EC3D215DC5993F08EEDB52AFCC2F1B42C0A6BC50E000D2A6ADF19EA5686B7F4D6CFC2E30225C258424441E9AF834968
Malicious:	false
Preview:	......JFIF.................................................. ( ..&..."1!%)+../..383-8)-.+...........7% "3770573-17327+-0-5.75-.77-7427--82746--2-5-/3--5+-........Q.."........................................P.........................!...1"AQaq.2...#3BRrst.....456CSb...U.....$%.................................................................!4..123AQqr....a................?..Q..........)D..Q."...E6D..R.!...B)D..l.!...E6K .R.!..,..J .Sd..E(..JY.".".E(..........D.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.E.s....~......QS.q.....?..4z.7...T..5.......Y....w.f..eC...o.t....k+.....u...j..........=gS.Y.UL..<.\|...%..m...Q..a..4m.:..k..+..../.t}w..J......>...{.....+8.....=...\....._%.N6....v\.wi.N.xn.v1OP/.....Hx...=y.pH#....V....B.H.H....%.....O....rf6...U.Z>.5k..".....J0..g....kH#..d7..oJ...(..0.r...\.................+g..Y#......!``.q3.k.; a.......c4t.d5...ZQ.rT..t......@.}..l.$.iO.D.X..q....49..tO+.."......F.DT...w......<...../...43..C...{...jv...n..8...2

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ProofingPrefs.plist

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	4.643955085748496
Encrypted:	false
SSDEEP:	24:2dfyiwERAwwyyASfRfbRbVSE3/3EgRUJjUNHKY4sIsTqAh0:cfyiR5PyASfRfpVSE33UJjUNrOsTqi0
MD5:	BBFFB9FE7927462C0716B46EF1B33B14
SHA1:	5372579D96562551113AF14F86ABFEE757CC5A41
SHA-256:	BE10242DB69318C4F81B7534045CED1249E1B0FA4B41304C77AC7CA0CE2D3CD0
SHA-512:	C4D0428B0522D62A0D02527DF50260E5BBE859C77F26DE17825431694A656A1C4BEDA93D72585E61AD4C4BD57322C430F5E264CB1E9E659FB7032BEAF52866D5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>MS Proofing Tools\MS Proofing Tools\Custom Dictionary\16\1</key>..<data>..Ym9va8gDAAAAAAQQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AIA..AAUAAAABAQAAVXNlcnMAAAAHAAAAAQEAAGJlcm5hcmQABwAAAAEBAABMaWJyYXJ5ABAA..AAABAQAAR3JvdXAgQ29udGFpbmVycxEAAAABAQAAVUJGOFQzNDZHOS5PZmZpY2UAAAAR..AAAAAQEAAEN1c3RvbSBEaWN0aW9uYXJ5AAAAGAAAAAEGAAAEAAAAFAAAACQAAAA0AAAA..TAAAAGgAAAAIAAAABAMAAManCgADAAAACAAAAAQDAACwSBcAAwAAAAgAAAAEAwAAsUgX..AAMAAAAIAAAABAMAADJlFwADAAAACAAAAAQDAABlmhoAAwAAAAgAAAAEAwAAZLkaAAMA..AAAYAAAAAQYAAKQAAAC0AAAAxAAAANQAAADkAAAA9AAAAAgAAAAABAAAQcaGZ2dS2+sY..AAAAAQIAAAEAAAAAAAAADwAAAAAAAAAAAAAAAAAAAAgAAAABCQAAZmlsZTovLy8MAAAA..AQEAAE1hY2ludG9zaCBIRAgAAAAEAwAAAGB/8xgAAAAIAAAAAAQAAEHBZQzpAAAAJAAA..AAEBAAA2QTRCNDg0Ny1FNDcxLTMyRkQtOEE4Ri0zQjg0OTcwMjk0NDUYAAAAAQIAAIEA..AAABAAAA7xMAAAEAAAAAAAAAAAAAAAEAAAABAQAALwAAAAAAA

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ci.plist

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	57
Entropy (8bit):	3.2125246576774362
Encrypted:	false
SSDEEP:	3:N1n9z5+cZtTt4:N1n9FdZlt4
MD5:	4A6EAEF73E956D194C0A6097E25F2408
SHA1:	CF2A5A98CD62A9DB99E2BC45894CD6B80D31386A
SHA-256:	868970D5EF70AB113AFE61286EB79584016FC06C040FD7E88760CB8F90B47EDC
SHA-512:	4ECFA03D289518A42E2301A4FB8D60A0A06FF0AF5B311643F2E55AE6CACFF630F65EED0B210A473DE44DC660D0DFB3A403D6EBCC92DCEDF7DA1B99C18FA7D86A
Malicious:	false
Preview:	bplist00...Xseverity.2...................................

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/com.microsoft.Word.securebookmarks.plist

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5588
Entropy (8bit):	4.296190505183507
Encrypted:	false
SSDEEP:	96:Cys5ajSSM+N2PRghvcKBUmoau8ISys5ajSSM+N2PRAhvcKBUmoau8I3:XQCu6wAEnQCuuwAE3
MD5:	CD84E9DA7DF2DB562F0F4ED0038BD302
SHA1:	40667FED163A86D06EBB68907DEFA515D17D2667
SHA-256:	61ABD80D0390F35B384EA2365B617D1F356EA6C89E0F982A38AF0D97C54FA7AC
SHA-512:	37A23C7B170FD165083144AC5356DF64F511DE4B6757B412114437E18CE9DC54A1BB3EEF0B67D93E041B44A55F8DE24B2FD7187A44C09EC265CAC0975EC54E43
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>file:///Users/bernard/Desktop/18037.doc</key>..<dict>...<key>kBookmarkDataKey</key>...<data>...Ym9va7gCAAAAAAQQMAAAAEqaFQDUIzBSd57rg6pgEKGvRFSQIMyBPi5IL+WZ...DpUjtAEAAAQAAAADAwAAAAgAKAUAAAABAQAAVXNlcnMAAAAHAAAAAQEAAGJl...cm5hcmQABwAAAAEBAABEZXNrdG9wAAkAAAABAQAAMTgwMzcuZG9jAAAAEAAA...AAEGAAAQAAAAIAAAADAAAABAAAAACAAAAAQDAADGpwoAAwAAAAgAAAAEAwAA...sEgXAAMAAAAIAAAABAMAAMZIFwADAAAACAAAAAQDAAACrxoAAwAAABAAAAAB...BgAAbAAAAHwAAACMAAAAnAAAAAgAAAAABAAAQcXDoBtp/TIYAAAAAQIAAAEA...AAAAAAAADwAAAAAAAAAAAAAAAAAAAAgAAAAEAwAAAgAAAAAAAAAEAAAAAwMA...APYBAAAIAAAAAQkAAGZpbGU6Ly8vDAAAAAEBAABNYWNpbnRvc2ggSEQIAAAA...BAMAAABgf/MYAAAACAAAAAAEAABBwWUM6QAAACQAAAABAQAANkE0QjQ4NDct...RTQ3MS0zMkZELThBOEYtM0I4NDk3MDI5NDQ1GAAAAAECAACBAAAAAQAAAO8T...AAABAAAAAAAAAAAAAAABAAAAAQEAAC8AAAAAAAAAAQUAAMwAAAD+////AQAA...AAAAAAAQAAAABBAAAFQAAAAAAAAABRAAAKw

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/mso00027419

Download File

Process:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

Static File Info

General

File type:	Microsoft OOXML
Entropy (8bit):	7.996635035454019
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 37.96% Word Microsoft Office Open XML Format document (49504/1) 36.13% Word Microsoft Office Open XML Format document (27504/1) 20.07% ZIP compressed archive (8000/1) 5.84%
File name:	18037.doc
File size:	211'691 bytes
MD5:	592b5d0b7e4153d92e0d9c4ff3e9116c
SHA1:	82838e835531cde974734288c05f375002073274
SHA256:	d7d77cba0c087f438e5bbc7bc2764df7aec0aa22d2832260797fb565160195bf
SHA512:	6c96b481b9b385a1e1f858369e294e4206ca385266d0d554d2b8cf0a326aa504860250328473ef4916d39546dbe6448f92677d0c525c46386a2d923fd15cfc10
SSDEEP:	6144:zP7HH0H2zJky3eEGVdajJ66tAhUJOO3NDVxseg4:fiQkyuEGfMuhU71fh
TLSH:	BD2423B4ED410559D6E68134482A05BAE4492F0BEA6E38297933F744F5F02F42EE3DE7
File Content Preview:	PK........L..X~.._............[Content_Types].xml..Oo.@...H\|.k...)..P..h9B%..u..'[..v&i......U...^,.3...............kqY-D.^...M-..?..D..\|.l.P....Z.}.\."`.j......R...SX...+]HN.....J.T......R.O.......5tjg..y..C..xQ\|...U-T..hE\.{.V...uFC.o.m.w.I......G4.r..p

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 21:21:18.804280996 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:18.804353952 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:18.805314064 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:18.828912973 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:18.828969002 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.279016018 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.279679060 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.279906034 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.280081987 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.282063961 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.282762051 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.306031942 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.306092024 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.306170940 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.306211948 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.306305885 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.306341887 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.307102919 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.307544947 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.308379889 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.350292921 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.500623941 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.500891924 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:19.501336098 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.501550913 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.502013922 CET	49480	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:19.502042055 CET	443	49480	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:27.274003983 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.274029016 CET	443	49489	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.275140047 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.278532028 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.278548002 CET	443	49489	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.516803026 CET	443	49489	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.517393112 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.517393112 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.601217031 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.601294041 CET	443	49489	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.601416111 CET	443	49489	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.602138996 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.602317095 CET	49489	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.640630007 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.640656948 CET	443	49490	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.641386986 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.644486904 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.644545078 CET	443	49490	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.876957893 CET	443	49490	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.877705097 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.877901077 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.895648003 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.895695925 CET	443	49490	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.895773888 CET	443	49490	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.896245003 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.896322966 CET	49490	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.970264912 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.970283031 CET	443	49491	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:27.971510887 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.973952055 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:27.973959923 CET	443	49491	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.208856106 CET	443	49491	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.211357117 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.211577892 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.230571032 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.230648994 CET	443	49491	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.230789900 CET	443	49491	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.231364012 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.231519938 CET	49491	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.277450085 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.277477980 CET	443	49492	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.278021097 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.279819012 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.279838085 CET	443	49492	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.513124943 CET	443	49492	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.514434099 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.514434099 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.527337074 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.527414083 CET	443	49492	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.527543068 CET	443	49492	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:28.528717995 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:28.528718948 CET	49492	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:36.875010967 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:36.875097036 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:36.875732899 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:36.877315998 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:36.877370119 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.161739111 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.162945032 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.163017988 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.163026094 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.163568974 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.163820028 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.196494102 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.196506977 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.196742058 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.197442055 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.199037075 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.242353916 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.492114067 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.492188931 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:37.492986917 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.493012905 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.516324043 CET	49528	443	192.168.11.12	3.97.136.92
Dec 13, 2024 21:21:37.516379118 CET	443	49528	3.97.136.92	192.168.11.12
Dec 13, 2024 21:21:38.188143969 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.188186884 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.188841105 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.189470053 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.189483881 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.617505074 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.618268013 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.618330002 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.618427038 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.618494034 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.619096994 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.628334999 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.628386974 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.629348993 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:38.629911900 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.630738974 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:38.674240112 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.496237040 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.496300936 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.496360064 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.502301931 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.503074884 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503123045 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503150940 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.503298044 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503354073 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503387928 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.503529072 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503570080 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.503599882 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.504228115 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504280090 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.504687071 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504743099 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504743099 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504868984 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504868984 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504868984 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504985094 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.504985094 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.505124092 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.505124092 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.505191088 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.517396927 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.637006998 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.637065887 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.637614965 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.637794018 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.637809992 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.638895988 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639118910 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639118910 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639166117 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639297009 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639394045 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639486074 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639616013 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639703035 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639832973 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.639924049 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.640053988 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.640134096 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.666376114 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.672058105 CET	49531	443	192.168.11.12	15.222.187.200
Dec 13, 2024 21:21:40.672141075 CET	443	49531	15.222.187.200	192.168.11.12
Dec 13, 2024 21:21:40.707323074 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.707422018 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:40.708009958 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.708542109 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.708636999 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:40.709181070 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.709826946 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.709884882 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:40.710103035 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:40.710167885 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:40.820378065 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:40.820405006 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:40.820966005 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:40.821887016 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:40.821912050 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:40.822423935 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:40.822900057 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:40.822921038 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:40.829581976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:40.829600096 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:40.830801010 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:40.830825090 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:40.831341028 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:40.831959963 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:40.831978083 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.092078924 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.092124939 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.094202995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.094268084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.094264984 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.094347954 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.107995987 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.108819962 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.108861923 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.135926962 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.135978937 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.136972904 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.137545109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.140460968 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.140513897 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.141522884 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.141652107 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.142062902 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.142615080 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.142674923 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.143584013 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.143626928 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.144121885 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.144360065 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.148468971 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.149043083 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.165832043 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.165843010 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.166805029 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.166815042 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.167931080 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.177591085 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.182347059 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.184180975 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.184195042 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.186151981 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.186177015 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.186774969 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.186990023 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.187002897 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.188492060 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.188512087 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.189076900 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.189809084 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.189822912 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.190645933 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.190665007 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.210222006 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.218338966 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.332504034 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.332575083 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.332760096 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.333375931 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.333447933 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.335091114 CET	49532	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.335136890 CET	443	49532	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.353580952 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.353928089 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.354094982 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.354542017 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.355515957 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.355705023 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.355842113 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.355998039 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.356333017 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.356465101 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.356715918 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.360249996 CET	49536	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.360302925 CET	443	49536	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.361186981 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.362629890 CET	49534	443	192.168.11.12	52.216.144.19
Dec 13, 2024 21:21:41.362682104 CET	443	49534	52.216.144.19	192.168.11.12
Dec 13, 2024 21:21:41.367872000 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.367950916 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.368597031 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.369132996 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.369189978 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.425743103 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.425765038 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.429738998 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.430243969 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.430401087 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.430493116 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.430560112 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.430809021 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.430864096 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.431143045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.431143045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.431374073 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.431459904 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.431472063 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.433624029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.444003105 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.444051027 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.445254087 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.445297003 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.446372032 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.446420908 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.446851969 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.446894884 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.447657108 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.447715998 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.456717014 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.456763029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.456763029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.456794977 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.456903934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.456973076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.456973076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.457330942 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.457602978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.470608950 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.470684052 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.470732927 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.472320080 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472374916 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.472410917 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472410917 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472410917 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472443104 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.472472906 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472472906 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.472491026 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.473022938 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.473954916 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.473998070 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.473998070 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474108934 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474108934 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474214077 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474214077 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474298954 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474350929 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474350929 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.474395990 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.534406900 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.534462929 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.536356926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.536400080 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.536400080 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.536400080 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.536437035 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.536545992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.536545992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.537075043 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.537313938 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.553525925 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.553581953 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.555572987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.555634022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.555634022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.555670023 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.555767059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.555767059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.555826902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.556245089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.556744099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.574239969 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.574317932 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.576714039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.576778889 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.576920033 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.576972008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.576991081 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.577147961 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.577212095 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.577370882 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.577429056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.577721119 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.593360901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.593440056 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.596081972 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596144915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596144915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596179008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.596220970 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596220970 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596394062 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596760988 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.596966982 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.610779047 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.611105919 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.611160994 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.611347914 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.611862898 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.612565994 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612624884 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612654924 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.612740993 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612740993 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612803936 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612832069 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.612864971 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612864971 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.612864971 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613015890 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613085985 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.613106012 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.613132000 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.613398075 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613485098 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613579035 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613579035 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613620996 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.613642931 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613718033 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613718033 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613768101 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.613790989 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.614855051 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615277052 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615334034 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615334034 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615436077 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615436077 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615436077 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615561008 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615561008 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615650892 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.615650892 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.616096020 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.622529030 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.622574091 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.640628099 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.642467022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.642524004 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.642774105 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.642839909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.655322075 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.655396938 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.657346010 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.657411098 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.657411098 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.657445908 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.657474041 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.657557011 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.657612085 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.658042908 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.658292055 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.669967890 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.670025110 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.671717882 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.671776056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.671777010 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.671809912 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.671892881 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.671894073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.672034979 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.672173023 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.674109936 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.685823917 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.685882092 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.688107014 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688174009 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688174963 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688209057 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.688404083 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688644886 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688683987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.688868999 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.689001083 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.702553988 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.702613115 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.705291033 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705348969 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705349922 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705383062 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.705465078 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705465078 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705511093 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.705971003 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.706935883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.714737892 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.714795113 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.716943026 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717001915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717003107 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717035055 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.717149019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717149019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717149019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.717788935 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.718022108 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.727164030 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.727319002 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.728912115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.728975058 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.728975058 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.729007959 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.729037046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.729217052 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.729299068 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.729515076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.729569912 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.729868889 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.730074883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.742778063 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.742836952 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.744563103 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744621992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744621992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744656086 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.744765997 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744765997 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744765997 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.744821072 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.745201111 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.753371000 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.753428936 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.753871918 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.753927946 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.755477905 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755537033 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.755558014 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755558014 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755661011 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755661011 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755721092 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.755762100 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755762100 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755762100 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755901098 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755901098 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.755959034 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.756005049 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.756005049 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.756033897 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.756192923 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.756247997 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.756557941 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757278919 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757332087 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.757369995 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757369995 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757369995 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757524967 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757524967 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757580996 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.757626057 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757626057 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757673979 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757673979 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757699013 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.757729053 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757729053 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757739067 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.757755041 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.757786036 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.757797003 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.758218050 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.758234978 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.758481026 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.758506060 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.758974075 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759386063 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759408951 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.759511948 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759511948 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759665012 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759665012 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759665012 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759726048 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.759763956 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759763956 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.759812117 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759812117 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759812117 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.759902000 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.759902000 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759902000 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.759924889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.759999990 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.759999990 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.759999990 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760098934 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.760230064 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.760235071 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760235071 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760287046 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.760415077 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760415077 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760415077 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.760415077 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.761648893 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.761740923 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.761878967 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.761996984 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.762049913 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.762195110 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.762418032 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.762665987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.763655901 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.766161919 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.766262054 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.768148899 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768207073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768207073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768241882 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.768362999 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768362999 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768421888 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.768990040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.769285917 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.774827957 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.774909019 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.775538921 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.775746107 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.776423931 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776493073 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776493073 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776530981 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.776560068 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776638985 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776694059 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776699066 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776699066 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776869059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776869059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776869059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.776925087 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.777065039 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.777369022 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.777545929 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.777910948 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.785031080 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.785088062 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.788798094 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.788842916 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.788842916 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.788872957 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.788960934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.788960934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.789024115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.789081097 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.789414883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.793622017 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.793678999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.795836926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.795896053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.795896053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.795931101 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.796010017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.796010017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.796010017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.796134949 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.796410084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.802782059 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.802839994 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.805274963 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805331945 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805448055 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805499077 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.805545092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805669069 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805773020 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.805918932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.806009054 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.806099892 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.806873083 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.810275078 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.810338020 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.810553074 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.810597897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.810597897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.810638905 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.811177969 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.815556049 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.815613031 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.817373991 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.817437887 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.817697048 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.817749023 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.817784071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.817784071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.817874908 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.818020105 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.818296909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.818371058 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.824635029 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.824714899 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.826525927 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.826586962 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.826849937 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.826906919 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.826935053 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.827030897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.827099085 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.827359915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.827410936 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.827501059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.832792997 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.832849026 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.835295916 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.835340023 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.835613012 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.835613966 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.835666895 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.835833073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.835833073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.836365938 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.836606979 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.840106964 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.840163946 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.845946074 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.845990896 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.845990896 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.846024036 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.846076965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.846076965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.846122980 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.846434116 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.846620083 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.847697973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.847754955 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.849298954 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.849397898 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.849637032 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.849637032 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.849664927 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.849755049 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.849975109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.850183010 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.850444078 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.854273081 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.854332924 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.856242895 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.857002974 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857240915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857299089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857299089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857328892 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.857446909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857484102 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857666016 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857722044 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857856035 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.857980013 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.858186007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.861948967 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.862026930 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.862488985 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.862546921 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.865129948 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.865173101 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.865174055 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.865204096 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.865819931 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866038084 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866092920 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866092920 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866187096 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866317987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866420031 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866590977 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866641998 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.866674900 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866770029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866914034 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.866914034 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.867044926 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.867168903 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.868310928 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.868365049 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.874456882 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.875799894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.875864983 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.876002073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876076937 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876102924 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.876491070 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876584053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876689911 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876818895 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.876895905 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877026081 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877118111 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877290964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877347946 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877480030 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877607107 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.877665043 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.878344059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.879491091 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.879544973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.881333113 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881390095 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881478071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881520987 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.881622076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881692886 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881841898 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.881964922 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.882226944 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.883955002 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.884032965 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.884263039 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.884298086 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.884551048 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.884608030 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.886138916 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886192083 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886324883 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886380911 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886538982 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886676073 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886858940 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.886874914 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886874914 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.886976957 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887113094 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887139082 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.887197971 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887341022 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887440920 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887494087 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.887656927 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887828112 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.887893915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888175964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888176918 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888384104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888384104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888937950 CET	49538	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.888993979 CET	443	49538	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.889723063 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.890746117 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.890830040 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.891546965 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.891603947 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.892991066 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.893047094 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.893208981 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.893259048 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.893352032 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.893392086 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.893728971 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.893786907 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.894048929 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894049883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894088984 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.894294977 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894294977 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894503117 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894546986 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.894684076 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.894987106 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.895261049 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.896675110 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.896733046 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.897809982 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.897867918 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.898401976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.898437023 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.898494959 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.898524046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.898591995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.898727894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.898778915 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.898984909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.899038076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.899173975 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.899260998 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.899384975 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.899904966 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.900049925 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900132895 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900132895 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900494099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.900605917 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900691986 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900800943 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900829077 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.900892973 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.900985956 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901129007 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901258945 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901495934 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901495934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.901612997 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901643991 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.901681900 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901778936 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.901947975 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902168989 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902267933 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902350903 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902368069 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.902482033 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902600050 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902750969 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902960062 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.902960062 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903060913 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903290987 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903290987 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903337002 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.903387070 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.903419018 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903445005 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.903466940 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.903651953 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904020071 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904249907 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904336929 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904359102 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.904470921 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904470921 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904565096 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904670000 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.904701948 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904794931 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.904908895 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905004025 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905133963 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905160904 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.905261040 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905342102 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905481100 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905733109 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.905733109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.905777931 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.905937910 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.905937910 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906037092 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906303883 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906333923 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.906498909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906498909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906517029 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.906543970 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906593084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906594038 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906615019 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.906693935 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906693935 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906739950 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906790972 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906841993 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906841993 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.906889915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.906889915 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.907016039 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.907016039 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.907063961 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.907161951 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.907162905 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908071995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.908163071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.908163071 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908267021 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908267021 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908396959 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908396959 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.908441067 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.908490896 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.909233093 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.909291029 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.910037041 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.910368919 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.910753965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.910864115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.910864115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.910901070 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.910926104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.910926104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.911039114 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.911364079 CET	49533	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:41.911401987 CET	443	49533	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:41.911849022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.912292004 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.912412882 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.912775040 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.913043976 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.913393021 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.913933992 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.913990021 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.915576935 CET	49539	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:41.915631056 CET	443	49539	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:41.916021109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916073084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916073084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916119099 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.916148901 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916148901 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916218996 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.916765928 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.917155981 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.917726040 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.917783976 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.919795990 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.919856071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.919856071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.919888973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.919997931 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.920037985 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.920037985 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.920542002 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.922374964 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.922435999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.923269033 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.923973083 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924027920 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924195051 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924248934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924388885 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924441099 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.924489021 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924489021 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924609900 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924696922 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.924813986 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.925113916 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.926132917 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.926189899 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.926755905 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.927763939 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.927822113 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.927822113 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.927855015 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.927964926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.927964926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.928090096 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.928421021 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.928694963 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.929877996 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.929949045 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.931787014 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.931845903 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.931845903 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.931880951 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.931966066 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.931966066 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.932024956 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.932454109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.933100939 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.933758974 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.933813095 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.936028004 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936073065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936073065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936073065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936108112 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.936229944 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936229944 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936294079 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936527014 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.936683893 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.936743975 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.936794996 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.940288067 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.940342903 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.941178083 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941220999 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941358089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941358089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941411972 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.941437960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941550970 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.941970110 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.944653988 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.944709063 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.948322058 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.949176073 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.949228048 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.949270010 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.949270964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.949997902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.950675964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.951735973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.951790094 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.954925060 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.954978943 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.954994917 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.955094099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.955241919 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.955302000 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.958425999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.959270000 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.959321976 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.959359884 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.959359884 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.959484100 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.960988998 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.961735964 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.961791039 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.961946964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.963247061 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.963304043 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.963490963 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.963679075 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.964066982 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.965034962 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.965090036 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.966698885 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.966754913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.966773987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.967310905 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.967560053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.968400002 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.968456984 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.972068071 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.973134995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.973186970 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.973223925 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.973320961 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.974737883 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.974796057 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.974931955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.974983931 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.977471113 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.977511883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.977511883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.977914095 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.978032112 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.978086948 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.980612993 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.980668068 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.980684996 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.981025934 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.981086969 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.981266022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.981323004 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.982425928 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.982547045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.982547045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.983825922 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.983879089 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.986115932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.986166954 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.986340046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.986752987 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.986766100 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.986819029 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.986946106 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.987540960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.988233089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.988291025 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.988291025 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.988321066 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.988898039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.989523888 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.989577055 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.990318060 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.991270065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.991323948 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.991354942 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.991998911 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.992469072 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.992526054 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.993465900 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.994031906 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.994085073 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.994117975 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.994641066 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.994909048 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.995038986 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.995094061 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.997561932 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.998496056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998553038 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.998589039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998589039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998616934 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:41.998644114 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998644114 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998791933 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:41.998960972 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.000870943 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.000924110 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.001890898 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.001954079 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.001954079 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.001983881 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.002100945 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.002507925 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.003314972 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.003374100 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.004439116 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.005069971 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.005120993 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.005155087 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.005390882 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.005527973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.005589962 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.005748987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.005800962 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.007034063 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.007122040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.007122993 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.008735895 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.008778095 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.010693073 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.011156082 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.011202097 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.011234045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.012046099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.012264967 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.013581991 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.013628960 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.015283108 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.015330076 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.015516043 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.016177893 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.017898083 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.017952919 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.020876884 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.020925999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.021114111 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.021616936 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.021740913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.021787882 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.022996902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.023322105 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.023369074 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.023564100 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.023948908 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.024180889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.024230003 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.024333954 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.025727987 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.025772095 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.025932074 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.026204109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.026290894 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.026338100 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.026429892 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.026475906 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.028211117 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.029006004 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.029063940 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.029283047 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.029320955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.029320955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.029345036 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.030822039 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.030879021 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.031606913 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.031658888 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.031682014 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.032445908 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.033375978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.033423901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.033457041 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.033588886 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.033634901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.033727884 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.034890890 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.034946918 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.035690069 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.035774946 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.035805941 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.035878897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.035967112 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.036794901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.036842108 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.039402008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.039582968 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.039609909 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.039705992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.039705992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.041126966 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.041882038 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.041929960 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.041963100 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.041982889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.042067051 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.042531967 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.042623043 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.043457985 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.043509007 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.044343948 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.044389009 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.044418097 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.045113087 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.045217991 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.045264959 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.047051907 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.047270060 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.047404051 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.047451973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.048947096 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.049009085 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.057068110 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.057121038 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.057145119 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.057636023 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059132099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059201002 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.059237957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059237957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059272051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.059312105 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059448957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.059484005 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.059508085 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.060707092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.060765028 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.060803890 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.060803890 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.060830116 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.060862064 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.060862064 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.060887098 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.062444925 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.062505960 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.062547922 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.062549114 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.062596083 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.062625885 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.062625885 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.062781096 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.062783957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065067053 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.065128088 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065170050 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065198898 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.065282106 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065383911 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065514088 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.065541983 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.066833019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.067039967 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.067378998 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.067467928 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.067512035 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.067554951 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.067672968 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.067707062 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.067893028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.068381071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.068577051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.068639040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.068639040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.068650961 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.068700075 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.069031000 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.070559978 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.070602894 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.070642948 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.070816040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.070816040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.070877075 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.071532965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.071716070 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.071778059 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.072443962 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.072503090 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.072669983 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.072721958 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.073484898 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.073540926 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.073551893 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.073551893 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.073579073 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.073635101 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.073816061 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.075126886 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.075206995 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.075293064 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.075347900 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.075355053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.075478077 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.075478077 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.075532913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.076086044 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.076829910 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.076911926 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.076986074 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.076986074 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.077307940 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.077382088 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.078254938 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.078325987 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.078474045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.079250097 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.079310894 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.079336882 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.079336882 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.079452991 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.079765081 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.079809904 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.079968929 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.080022097 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.081373930 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.081427097 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.081523895 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.081576109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.081744909 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.081795931 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.082895041 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.082952976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.082952976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.083250046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.083322048 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.083365917 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.084551096 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.084603071 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.084798098 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.084850073 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.084896088 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.084959030 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.085359097 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.086214066 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.086277008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.086390972 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.086477041 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.086477995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.086631060 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.086668015 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.086869001 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.087568045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.087661982 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.087661982 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.087898970 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.087943077 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.088689089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.088733912 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.088776112 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.089142084 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.089180946 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.089260101 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.089349031 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.089380026 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.090573072 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.090635061 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.090837955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.090981960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.090981960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.091042995 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.092124939 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.092179060 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.092885017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.092924118 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093066931 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093066931 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093102932 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.093122005 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093209028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093323946 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093643904 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.093919992 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.093976021 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.095025063 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.095087051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.095889091 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.095941067 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.095959902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.096018076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.096018076 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.096187115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.096471071 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.096474886 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.096528053 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.096551895 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.098014116 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.098067045 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.098807096 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.099025965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.099076986 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.099096060 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.099498987 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.099551916 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.100276947 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.100333929 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.100421906 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.100421906 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.100450039 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.100486040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.100856066 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.100917101 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.101001978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.101028919 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.101200104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.101835966 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.101881027 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.102611065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.102655888 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.102782011 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.102818012 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.103570938 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.103657007 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.103732109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.103775978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.103776932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.103809118 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.104352951 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.104394913 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.104501963 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.104912043 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.104958057 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.106384039 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.106445074 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.107053041 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.107105017 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.107124090 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.107399940 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.107439995 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.107451916 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.108325005 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.108443022 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.108501911 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.108503103 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.108531952 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.108565092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.109035015 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.109112978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.109124899 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.109180927 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.109877110 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.110245943 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.110317945 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.111062050 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111104965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111241102 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111242056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111298084 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.111323118 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111660004 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.111713886 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.111836910 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.111888885 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.112023115 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.112608910 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.112653971 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.113481045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113538980 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113646984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113646984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113703012 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.113727093 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113778114 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.113984108 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.114033937 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.114387035 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.114442110 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.115159988 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.115202904 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.115427971 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.115552902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.115552902 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.115613937 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.116611958 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.116844893 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.116862059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.116924047 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.117059946 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.117213011 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.117264986 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.117470026 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.118144989 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.118196964 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.118330956 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.118474007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.118474007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.118519068 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.119247913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.119299889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.120196104 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.120239973 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.120239973 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.120271921 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.120382071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.120382071 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.120425940 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.120482922 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.120764017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.121077061 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.121129990 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.121752024 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.121819973 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.121831894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.121906042 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.121906042 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.121944904 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.122658014 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.122703075 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.122703075 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.122718096 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.122749090 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.122838974 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.122891903 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.123749971 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.123806953 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.124064922 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124135017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124135017 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124275923 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124275923 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124330044 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.124353886 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.124845028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.125117064 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.125178099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.125325918 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.125368118 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.125456095 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.125502110 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.125526905 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.125679970 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.126516104 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.126568079 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.127356052 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.127424955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.127424955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.127471924 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.127516031 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.127516031 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.127625942 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.127671957 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.127959967 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.128012896 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.128088951 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.128983974 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.129034042 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.129188061 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.129231930 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.129232883 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.129264116 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.129861116 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.130076885 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.130119085 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.131017923 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131078959 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131078959 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131114006 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.131191969 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131191969 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131685019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.131922960 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.131978035 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.132132053 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.133246899 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.133327007 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.134114981 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.134166956 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.134196043 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.134296894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.134296894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.134835005 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.135040045 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.135418892 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.135493994 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.136451006 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.136513948 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.137355089 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.137418985 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.137438059 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.137522936 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.137522936 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.137783051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.137825966 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.138137102 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.138190031 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.138751030 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.138804913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.138855934 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.139249086 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.139317036 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.139420986 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.139450073 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.140362978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.140367031 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.140412092 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.140542984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.140630007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.140630007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.140666962 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.140928984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.141604900 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.141668081 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.141824961 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.141885042 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.141885042 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.141921043 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.142108917 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.142153978 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.142472029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.143259048 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.144032001 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144083977 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144084930 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144148111 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.144170046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144170046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144191027 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.144351006 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144351959 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144378901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.144390106 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144913912 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144969940 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.144999027 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.145719051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.145771027 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.145781040 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.145940065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.145940065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.145982981 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.146687984 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.146738052 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.147471905 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.147547960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.147702932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.147741079 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.147819996 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.147919893 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.147927999 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.147986889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.148391008 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.148447037 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.148727894 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.148824930 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.148868084 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.149677038 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.149938107 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.149996996 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.150019884 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.150043011 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.150099039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.150099039 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.150136948 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.150733948 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.151295900 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.151350021 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.152175903 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.152251005 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.152318001 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.152522087 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.152554989 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.152724028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.152724981 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.153189898 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.153219938 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.153244019 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.153527021 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.153589964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.153619051 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.154438972 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.154490948 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.154841900 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.155010939 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.155106068 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.155143023 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.155236959 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.155288935 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.155518055 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.155987978 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.156040907 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.156131029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.156131029 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.156158924 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.156188965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.156223059 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.156284094 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.157440901 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.157485008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.158634901 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.158694029 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.158715010 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.158814907 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.158814907 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.158870935 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.158912897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.158912897 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.159331083 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.159373999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.159549952 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160123110 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160180092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160180092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160217047 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.160312891 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160312891 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160347939 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.160389900 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160408020 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.160664082 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.160708904 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.161359072 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.161400080 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.161701918 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.161751986 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.161752939 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.161761999 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.161916971 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.161930084 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.162925005 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.162971020 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.163017988 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.163017988 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.163032055 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.163038015 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.163131952 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.163131952 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.163908005 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.163997889 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.164009094 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.164783955 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.164830923 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.164871931 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.164877892 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.164966106 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.164966106 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.164969921 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.165040016 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.165970087 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.166193008 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.166209936 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.166210890 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.166394949 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.166563988 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.166568995 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.166944027 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.166954041 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.167288065 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.167853117 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.167957067 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.167957067 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.167964935 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.168020964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.168020964 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.168112040 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.168123960 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.168188095 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.168462992 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.168467045 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.168728113 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.168737888 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.169590950 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.169682026 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.169682026 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.169686079 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.169779062 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.169779062 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.169799089 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.169811010 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.169904947 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.170881033 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.170891047 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.171780109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.171789885 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.171865940 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.171876907 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.171962976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.171962976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.171974897 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.171983957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.172287941 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.172646046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.172653913 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.172739983 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.172739983 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.172929049 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.172939062 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.173079967 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.173186064 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.173191071 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.173638105 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.173649073 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.173760891 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.174482107 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.174546957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.174546957 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.174587011 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.174597025 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.174671888 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.174683094 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.175493956 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.175580025 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.175971985 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.176028967 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.176089048 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.176191092 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.176249981 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.176249981 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.176284075 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.177136898 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.177189112 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.177892923 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.177943945 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.178002119 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.178031921 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.178112030 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.178123951 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.179116011 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179167986 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.179199934 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179299116 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179299116 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179351091 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179372072 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.179403067 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.179708958 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.179755926 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.179991007 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.180164099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.180164099 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.180195093 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.180394888 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.180650949 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.180773973 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.180918932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.181114912 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.181128979 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.181313038 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.181358099 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.181545019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.181705952 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.181951046 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.181978941 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.182142019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.182171106 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.182231903 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.183013916 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.183074951 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.183146000 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.183191061 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.183202028 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.183237076 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.183681965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.183799982 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.184149981 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.184185028 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.185013056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185091019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185091019 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185113907 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.185138941 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.185168028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185168028 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185201883 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.185365915 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.185971022 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.186007977 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.186877012 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.186942101 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.186983109 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.186986923 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.187027931 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.187058926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187058926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187058926 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187220097 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187540054 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.187593937 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.187628984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187707901 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187787056 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.187815905 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.187953949 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.188303947 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.188400984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.188400984 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.188508034 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.188545942 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.188663960 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.189069033 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.189112902 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.189240932 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.189273119 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.189305067 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.189654112 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.189941883 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.189979076 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.190536022 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.190747976 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.190871954 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.190871954 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.190926075 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.190973997 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.191941023 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.192153931 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.192775965 CET	49535	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.192802906 CET	443	49535	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.260000944 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.260020018 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.263731003 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.263777971 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.263936043 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.264111042 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.264136076 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.264136076 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.264223099 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.264497995 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.266525030 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.267249107 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.267294884 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.267575026 CET	49537	443	192.168.11.12	18.164.78.13
Dec 13, 2024 21:21:42.267601967 CET	443	49537	18.164.78.13	192.168.11.12
Dec 13, 2024 21:21:42.325934887 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.326586008 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.328301907 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.328341007 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.329477072 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.329514980 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.622955084 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623106956 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623203993 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623291969 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623397112 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623505116 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.623708010 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.624679089 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.624742031 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.624758959 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:42.624780893 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.624780893 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.624870062 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.624870062 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.624999046 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.626180887 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.626261950 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.626261950 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.626322031 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.627489090 CET	49540	443	192.168.11.12	104.17.246.203
Dec 13, 2024 21:21:42.627542973 CET	443	49540	104.17.246.203	192.168.11.12
Dec 13, 2024 21:21:43.905924082 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:43.906028032 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:43.906821966 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:43.917596102 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:43.917650938 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.203790903 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.204510927 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.204598904 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.204605103 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.205193996 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.229198933 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.229229927 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.229516983 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.230170965 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.231133938 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.274311066 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.490488052 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.490660906 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:44.491111994 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.491204977 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.492436886 CET	49541	443	192.168.11.12	3.98.99.217
Dec 13, 2024 21:21:44.492494106 CET	443	49541	3.98.99.217	192.168.11.12
Dec 13, 2024 21:21:51.619004965 CET	49345	80	192.168.11.12	23.219.217.195
Dec 13, 2024 21:21:51.733259916 CET	80	49345	23.219.217.195	192.168.11.12
Dec 13, 2024 21:21:51.733987093 CET	49345	80	192.168.11.12	23.219.217.195
Dec 13, 2024 21:21:58.333745003 CET	49356	443	192.168.11.12	23.208.128.109
Dec 13, 2024 21:21:58.334811926 CET	49356	443	192.168.11.12	23.208.128.109
Dec 13, 2024 21:21:58.447998047 CET	443	49356	23.208.128.109	192.168.11.12
Dec 13, 2024 21:21:58.448045015 CET	443	49356	23.208.128.109	192.168.11.12
Dec 13, 2024 21:21:58.448074102 CET	443	49356	23.208.128.109	192.168.11.12
Dec 13, 2024 21:21:58.448837042 CET	443	49356	23.208.128.109	192.168.11.12
Dec 13, 2024 21:21:58.450494051 CET	49356	443	192.168.11.12	23.208.128.109
Dec 13, 2024 21:21:58.450555086 CET	49356	443	192.168.11.12	23.208.128.109
Dec 13, 2024 21:21:58.450556040 CET	49356	443	192.168.11.12	23.208.128.109
Dec 13, 2024 21:21:59.010627031 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.010714054 CET	443	49549	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.011270046 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.012010098 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.012062073 CET	443	49549	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.254301071 CET	443	49549	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.255024910 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.255081892 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.269802094 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.269970894 CET	443	49549	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.270396948 CET	443	49549	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.271223068 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.271286011 CET	49549	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.370078087 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.370155096 CET	443	49550	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.370713949 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.374725103 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.374782085 CET	443	49550	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.621876001 CET	443	49550	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.622771978 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.622831106 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.641088009 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.641239882 CET	443	49550	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.641628981 CET	443	49550	151.101.67.6	192.168.11.12
Dec 13, 2024 21:21:59.641782045 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.642015934 CET	49550	443	192.168.11.12	151.101.67.6
Dec 13, 2024 21:21:59.831515074 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:21:59.831597090 CET	443	49551	151.101.3.6	192.168.11.12
Dec 13, 2024 21:21:59.832182884 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:21:59.833481073 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:21:59.833534002 CET	443	49551	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.068433046 CET	443	49551	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.070252895 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.070575953 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.077646971 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.077727079 CET	443	49551	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.077877998 CET	443	49551	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.078471899 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.078596115 CET	49551	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.089256048 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.089287996 CET	443	49552	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.089850903 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.090635061 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.090653896 CET	443	49552	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.242398024 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.242532969 CET	443	49553	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.243128061 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.244143963 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.244199038 CET	443	49553	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.333391905 CET	443	49552	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.335274935 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.335333109 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.342547894 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.342725992 CET	443	49552	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.343147993 CET	443	49552	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.343277931 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.343710899 CET	49552	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.486093998 CET	443	49553	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.487999916 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.488187075 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.517388105 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.517570972 CET	443	49553	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.517935038 CET	443	49553	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.518081903 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.518420935 CET	49553	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.557389975 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.557465076 CET	443	49554	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.558026075 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.558751106 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.558818102 CET	443	49554	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.800302982 CET	443	49554	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.802176952 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.802337885 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.812186003 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.812354088 CET	443	49554	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.812716007 CET	443	49554	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:00.813076019 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:00.813313961 CET	49554	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:01.781810999 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:01.781893015 CET	443	49558	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:01.782720089 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:01.783724070 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:01.783775091 CET	443	49558	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:02.025623083 CET	443	49558	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:02.027760983 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:02.027829885 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:02.033885002 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:02.034056902 CET	443	49558	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:02.034503937 CET	443	49558	151.101.3.6	192.168.11.12
Dec 13, 2024 21:22:02.034692049 CET	49558	443	192.168.11.12	151.101.3.6
Dec 13, 2024 21:22:02.034989119 CET	49558	443	192.168.11.12	151.101.3.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 21:21:16.424285889 CET	53	56798	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:18.627109051 CET	57695	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:18.791124105 CET	53	57695	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:35.129045963 CET	137	137	192.168.11.12	192.168.11.255
Dec 13, 2024 21:21:37.151995897 CET	137	137	192.168.11.12	192.168.11.255
Dec 13, 2024 21:21:37.152046919 CET	137	137	192.168.11.12	192.168.11.255
Dec 13, 2024 21:21:38.052751064 CET	64643	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:38.186007023 CET	53	64643	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:40.700009108 CET	65261	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:40.703368902 CET	53975	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:40.705832958 CET	58828	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:40.818192959 CET	53	65261	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:40.819176912 CET	53	53975	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:40.820209026 CET	53	58828	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:59.366089106 CET	49548	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:59.481230021 CET	53	49548	1.1.1.1	192.168.11.12
Dec 13, 2024 21:21:59.710484982 CET	65071	53	192.168.11.12	1.1.1.1
Dec 13, 2024 21:21:59.825428009 CET	53	65071	1.1.1.1	192.168.11.12

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 13, 2024 21:21:59.481973886 CET	192.168.11.12	1.1.1.1	3ac5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 21:21:18.627109051 CET	192.168.11.12	1.1.1.1	0x5659	Standard query (0)	montreal.banking-secure.net	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:38.052751064 CET	192.168.11.12	1.1.1.1	0x3ccf	Standard query (0)	secure.webmail-net.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.700009108 CET	192.168.11.12	1.1.1.1	0xe8bc	Standard query (0)	helpimg.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.703368902 CET	192.168.11.12	1.1.1.1	0xe789	Standard query (0)	training.knowbe4.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.705832958 CET	192.168.11.12	1.1.1.1	0xa374	Standard query (0)	unpkg.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.366089106 CET	192.168.11.12	1.1.1.1	0x396	Standard query (0)	h3.apis.apple.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.710484982 CET	192.168.11.12	1.1.1.1	0xa29a	Standard query (0)	h3.apis.apple.map.fastly.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 21:21:18.791124105 CET	1.1.1.1	192.168.11.12	0x5659	No error (0)	montreal.banking-secure.net		3.97.136.92	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:18.791124105 CET	1.1.1.1	192.168.11.12	0x5659	No error (0)	montreal.banking-secure.net		3.98.99.217	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:18.791124105 CET	1.1.1.1	192.168.11.12	0x5659	No error (0)	montreal.banking-secure.net		15.222.187.200	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:38.186007023 CET	1.1.1.1	192.168.11.12	0x3ccf	No error (0)	secure.webmail-net.com		15.222.187.200	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:38.186007023 CET	1.1.1.1	192.168.11.12	0x3ccf	No error (0)	secure.webmail-net.com		3.98.99.217	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:38.186007023 CET	1.1.1.1	192.168.11.12	0x3ccf	No error (0)	secure.webmail-net.com		3.97.136.92	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	helpimg.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.144.19	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.182	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.129.201	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.228.185	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.11.201	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.8.173	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.41.9	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.818192959 CET	1.1.1.1	192.168.11.12	0xe8bc	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.236.89	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.819176912 CET	1.1.1.1	192.168.11.12	0xe789	No error (0)	training.knowbe4.com		18.164.78.13	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.819176912 CET	1.1.1.1	192.168.11.12	0xe789	No error (0)	training.knowbe4.com		18.164.78.113	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.819176912 CET	1.1.1.1	192.168.11.12	0xe789	No error (0)	training.knowbe4.com		18.164.78.122	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.819176912 CET	1.1.1.1	192.168.11.12	0xe789	No error (0)	training.knowbe4.com		18.164.78.36	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.820209026 CET	1.1.1.1	192.168.11.12	0xa374	No error (0)	unpkg.com		104.17.246.203	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.820209026 CET	1.1.1.1	192.168.11.12	0xa374	No error (0)	unpkg.com		104.17.249.203	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.820209026 CET	1.1.1.1	192.168.11.12	0xa374	No error (0)	unpkg.com		104.17.247.203	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.820209026 CET	1.1.1.1	192.168.11.12	0xa374	No error (0)	unpkg.com		104.17.245.203	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:40.820209026 CET	1.1.1.1	192.168.11.12	0xa374	No error (0)	unpkg.com		104.17.248.203	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.481230021 CET	1.1.1.1	192.168.11.12	0x396	No error (0)	h3.apis.apple.map.fastly.net		151.101.3.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.481230021 CET	1.1.1.1	192.168.11.12	0x396	No error (0)	h3.apis.apple.map.fastly.net		151.101.131.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.481230021 CET	1.1.1.1	192.168.11.12	0x396	No error (0)	h3.apis.apple.map.fastly.net		151.101.195.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.481230021 CET	1.1.1.1	192.168.11.12	0x396	No error (0)	h3.apis.apple.map.fastly.net		151.101.67.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.825428009 CET	1.1.1.1	192.168.11.12	0xa29a	No error (0)	h3.apis.apple.map.fastly.net		151.101.3.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.825428009 CET	1.1.1.1	192.168.11.12	0xa29a	No error (0)	h3.apis.apple.map.fastly.net		151.101.131.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.825428009 CET	1.1.1.1	192.168.11.12	0xa29a	No error (0)	h3.apis.apple.map.fastly.net		151.101.67.6	A (IP address)	IN (0x0001)	false
Dec 13, 2024 21:21:59.825428009 CET	1.1.1.1	192.168.11.12	0xa29a	No error (0)	h3.apis.apple.map.fastly.net		151.101.195.6	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

montreal.banking-secure.net

https:

secure.webmail-net.com

training.knowbe4.com

unpkg.com

helpimg.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49480	3.97.136.92	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:19 UTC	381	OUT	GET /XRmhzQXIzMFhnQ1lRMy9VSXh1YllvR0VGcWJmZ2lqbDVDcDUxZzZjRlZLSlBRblN3N3Btbm5CMXBCRGdUMUdRSGRQQmdFTWI3emxMMExiNEdQVW9CZGRnWk5HVWRKY0R2bHR2RlVaSlVXb1pHYmEzRWRVNGNnZz09LS1nZWN0WmRoeVNCdkNRTjE2LS1VZ1pyeldhOGd6RlJ1R1NuSFdpZTRnPT0=?cid=23510450 HTTP/1.1 Host: montreal.banking-secure.net Connection: keep-alive User-Agent: Word/16.16.20101200 CFNetwork/976 Darwin/18.2.0 (x86_64)
2024-12-13 20:21:19 UTC	486	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:19 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 750e255a-73cc-4b67-a19c-22f82e6a7295 X-Runtime: 0.042999 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.12	49528	3.97.136.92	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:37 UTC	661	OUT	GET /XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450 HTTP/1.1 Host: montreal.banking-secure.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-gb Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
2024-12-13 20:21:37 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 457 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"7e7dfbad2a092fa0ebb0cd3a48ad22b7" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: f6d6709d-afd7-4107-9420-ccf77f8126d6 X-Runtime: 0.042395 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-13 20:21:37 UTC	457	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 77 65 62 6d 61 69 6c 2d 6e 65 74 2e 63 6f 6d 2f 70 61 67 65 73 2f 63 33 39 35 35 62 31 63 34 38 61 2f 58 51 55 64 72 4e 6b 64 47 54 55 68 44 65 55 5a 72 53 55 5a 77 4c 32 6b 30 64 46 46 47 64 56 59 72 63 69 39 58 4f 47 4e 5a 54 57 39 4d 4d 6a 56 56 4e 48 63 72 65 44 46 6b 56 30 38 33 4d 56 46 58 51 54 68 76 5a 6e 4e 77 55 55 52 4f 51 57 64 6b 53 30 31 78 55 31 68 73 51 32 56 59 4c 32 38 35 64 44 5a 4a 59 56 64 68 52 32 35 52 53 6e 68 6f 63 46 46 71 55 44 4e 32 56 7a 56 6a 56 30 5a 48 65 6d 4e 31 64 57 39 54 4d 55 46 73 55 55 5a 77 65 47 6b 33 51 55 6c Data Ascii: <html> <head> <script>window.location.href = 'https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUl

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.11.12	49531	15.222.187.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:38 UTC	1026	OUT	GET /pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 HTTP/1.1 Host: secure.webmail-net.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:40 UTC	833	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 74973 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"67e359c2c6680e0ad32fc4f251bc5165" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 1d00994b-9adb-4c86-b35a-5f7d8a1a30f0 X-Runtime: 1.580235 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-13 20:21:40 UTC	15551	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac
2024-12-13 20:21:40 UTC	10519	IN	Data Raw: 09 09 09 09 09 72 74 6c 3a 20 74 72 75 65 2c 0a 09 09 09 09 09 7d 2c 0a 09 09 09 09 09 7b 0a 09 09 09 09 09 09 69 64 3a 20 27 61 72 5f 6d 6f 64 27 2c 0a 09 09 09 09 09 09 6e 61 6d 65 5f 65 6e 67 6c 69 73 68 3a 20 27 41 72 61 62 69 63 27 2c 0a 09 09 09 09 09 09 6e 61 6d 65 5f 6c 6f 63 61 6c 69 7a 65 64 3a 20 27 d8 a7 d9 84 d8 b9 d8 b1 d8 a8 d9 8a d8 a9 27 2c 0a 09 09 09 09 09 09 72 74 6c 3a 20 74 72 75 65 2c 0a 09 09 09 09 09 7d 2c 0a 09 09 09 09 09 7b 0a 09 09 09 09 09 09 69 64 3a 20 27 68 69 5f 69 6e 27 2c 0a 09 09 09 09 09 09 6e 61 6d 65 5f 65 6e 67 6c 69 73 68 3a 20 27 48 69 6e 64 69 27 2c 0a 09 09 09 09 09 09 6e 61 6d 65 5f 6c 6f 63 61 6c 69 7a 65 64 3a 20 27 e0 a4 b9 e0 a4 bf e0 a4 82 e0 a4 a6 e0 a5 80 27 2c 0a 09 09 09 09 09 09 72 74 6c 3a 20 66 61 Data Ascii: rtl: true,},{id: 'ar_mod',name_english: 'Arabic',name_localized: '',rtl: true,},{id: 'hi_in',name_english: 'Hindi',name_localized: '',rtl: fa
2024-12-13 20:21:40 UTC	16384	IN	Data Raw: 65 6d 62 65 72 3a 20 41 6c 77 61 79 73 20 72 65 70 6f 72 74 20 73 75 73 70 69 63 69 6f 75 73 20 65 6d 61 69 6c 73 20 74 6f 20 79 6f 75 72 20 73 75 70 65 72 76 69 73 6f 72 20 6f 72 20 49 54 20 74 65 61 6d 2e 20 54 68 65 72 65 20 61 72 65 20 6d 61 6e 79 20 77 61 79 73 20 74 68 61 74 20 69 6e 74 65 72 6e 65 74 20 63 72 69 6d 69 6e 61 6c 73 20 77 69 6c 6c 20 74 72 79 20 74 6f 20 73 63 61 6d 20 79 6f 75 2e 20 53 74 61 79 20 61 6c 65 72 74 e2 80 94 59 4f 55 20 61 72 65 20 74 68 65 20 6c 61 73 74 20 6c 69 6e 65 20 6f 66 20 64 65 66 65 6e 63 65 21 27 2c 0a 09 09 09 09 09 09 64 69 73 63 6c 61 69 6d 65 72 3a 0a 09 09 09 09 09 09 09 27 50 6c 65 61 73 65 20 4e 6f 74 65 3a 20 54 68 69 73 20 6d 65 73 73 61 67 65 20 63 61 6d 65 20 66 72 6f 6d 20 4b 6e 6f 77 42 65 34 2c Data Ascii: ember: Always report suspicious emails to your supervisor or IT team. There are many ways that internet criminals will try to scam you. Stay alertYOU are the last line of defence!',disclaimer:'Please Note: This message came from KnowBe4,
2024-12-13 20:21:40 UTC	16384	IN	Data Raw: 74 61 20 71 75 65 20 69 6e 64 69 63 61 6d 20 71 75 65 20 75 6d 20 61 74 61 71 75 65 20 64 65 20 70 68 69 73 68 69 6e 67 20 65 73 74 c3 a1 20 61 63 6f 6e 74 65 63 65 6e 64 6f 2e 27 2c 0a 09 09 09 09 09 09 72 75 6c 65 33 3a 0a 09 09 09 09 09 09 09 27 56 65 72 69 66 69 71 75 65 20 65 2d 6d 61 69 6c 73 20 73 75 73 70 65 69 74 6f 73 20 63 6f 6d 20 6f 20 72 65 6d 65 74 65 6e 74 65 20 65 6e 74 72 61 6e 64 6f 20 65 6d 20 63 6f 6e 74 61 74 6f 20 63 6f 6d 20 65 6c 65 20 70 6f 72 20 6f 75 74 72 6f 20 6d 65 69 6f 2e 27 2c 0a 09 09 09 09 09 09 72 65 70 6f 72 74 3a 0a 09 09 09 09 09 09 09 27 4c 65 6d 62 72 65 2d 73 65 3a 20 73 65 6d 70 72 65 20 64 65 6e 75 6e 63 69 65 20 65 2d 6d 61 69 6c 73 20 73 75 73 70 65 69 74 6f 73 20 70 61 72 61 20 6f 20 73 65 75 20 73 75 70 65 Data Ascii: ta que indicam que um ataque de phishing est acontecendo.',rule3:'Verifique e-mails suspeitos com o remetente entrando em contato com ele por outro meio.',report:'Lembre-se: sempre denuncie e-mails suspeitos para o seu supe
2024-12-13 20:21:40 UTC	16135	IN	Data Raw: 95 20 d7 94 d7 99 d7 90 20 d7 9c d7 94 d7 93 d7 92 d7 99 d7 9d 20 d7 9b d7 99 d7 a6 d7 93 20 d7 99 d7 9b d7 95 d7 9c d7 95 d7 aa 20 d7 94 d7 aa d7 a7 d7 a4 d7 95 d7 aa 20 d7 93 d7 99 d7 95 d7 92 20 d7 9c d7 94 d7 99 d7 a8 d7 90 d7 95 d7 aa 20 d7 9b d7 9e d7 95 20 d7 94 d7 95 d7 93 d7 a2 d7 95 d7 aa 20 d7 93 d7 95 d7 90 e2 80 9c d7 9c 20 d7 9c d7 92 d7 99 d7 98 d7 99 d7 9e d7 99 d7 95 d7 aa 20 d7 a9 d7 9c 20 d7 97 d7 91 d7 a8 d7 95 d7 aa 20 d7 9e d7 9b d7 95 d7 91 d7 93 d7 95 d7 aa 2e 27 2c 0a 09 09 09 09 09 09 53 45 49 66 6c 61 67 73 3a 20 27 d7 94 d7 a0 d7 94 20 d7 94 d7 93 d7 92 d7 9c d7 99 d7 9d 20 d7 94 d7 90 d7 93 d7 95 d7 9e d7 99 d7 9d 20 d7 a9 d7 a4 d7 a1 d7 a4 d7 a1 d7 aa d7 9d 3a 27 2c 0a 09 09 09 09 09 09 53 45 49 63 6c 69 63 6b 3a 20 27 d7 97 Data Ascii: .',SEIflags: ' :',SEIclick: '

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.11.12	49535	18.164.78.13	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	727	OUT	GET /assets/application-b8fb25919f68be551e6730684a8ed34bc7dd2dac142e7cc51ebf7b09c48546d5.js HTTP/1.1 Host: training.knowbe4.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	14587	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 3205083 Connection: close Date: Fri, 13 Dec 2024 20:21:42 GMT Last-Modified: Thu, 23 May 2024 17:09:54 GMT ETag: "f1232635b40cbfae664ca09ba03fc9c3" x-amz-server-side-encryption: AES256 x-amz-version-id: MxTxI9TWeFRUpLQRLfZiUis0G3owgsQP Accept-Ranges: bytes Server: AmazonS3 content-security-policy-report-only: default-src 'self' data: wss://gruefbpuubghniw5iflbf2a6im.appsync-api.us-east-1.amazonaws.com/graphql wss://gruefbpuubghniw5iflbf2a6im.appsync-realtime-api.us-east-1.amazonaws.com/graphql s3.amazonaws.com/uploads.knowbe4.com/ api-js.mixpanel.com app.pendo.io btb-glossary-bucket-production-us-east-1.s3.amazonaws.com https://browser-intake-datadoghq.com/ cdn.pendo.io data.pendo.io fonts.googleapis.com metrics.articulate.com modstore.knowbe4.com modstore-production-us-east-1.s3.amazonaws.com https://.kmsat.kb4od.run https://.ckeditor.com/ https://.launchdarkly.com/ https://.zopim.com/ https://api-js.mixpanel.com/decide https://api-js.mixpanel.com/decide/ https://api-js.mixpanel.com/engage https://api-js.mixpanel.com/engage/ https://api-js.mixpanel.com/track https://api-js.mixpanel.com/track/ https://api.mixpanel.com/ https://cdnjs.cloudflare.com/ https://code.highcharts.com/ https://data.pendo.io/ https://ekr.zdassets.com/ https://ekr.zendesk.com/ https://knowbe4.zendesk. [TRUNCATED] referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubdomains; preload x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-permitted-cross-domain-policies: none x-xss-protection: 1; mode=block Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 5584a67adae1a4ad6dd53bc55e0a9b30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P5 X-Amz-Cf-Id: C9mQttagUtLyNlOU9TJbu4m1aiRiqmRHTd78YtWNq8bD-f1mv-Nd1A==
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 31 32 2e 34 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 35 2d 32 30 54 Data Ascii: /! jQuery JavaScript Library v1.12.4 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-05-20T
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 5c 5c 28 29 5b 5c 5c 5d 5d 7c 22 20 2b 20 61 74 74 72 69 62 75 74 65 73 20 2b 20 22 29 2a 29 7c 22 20 2b 0a 09 09 2f 2f 20 33 2e 20 61 6e 79 74 68 69 6e 67 20 65 6c 73 65 20 28 63 61 70 74 75 72 65 20 32 29 0a 09 09 22 2e 2a 22 20 2b 0a 09 09 22 29 5c 5c 29 7c 29 22 2c 0a 0a 09 2f 2f 20 4c 65 61 64 69 6e 67 20 61 6e 64 20 6e 6f 6e 2d 65 73 63 61 70 65 64 20 74 72 61 69 6c 69 6e 67 20 77 68 69 74 65 73 70 61 63 65 2c 20 63 61 70 74 75 72 69 6e 67 20 73 6f 6d 65 20 6e 6f 6e 2d 77 68 69 74 65 73 70 61 63 65 20 63 68 61 72 61 63 74 65 72 73 20 70 72 65 63 65 64 69 6e 67 20 74 68 65 20 6c 61 74 74 65 72 0a 09 72 77 68 69 74 65 73 70 61 63 65 20 3d 20 6e 65 77 20 52 65 67 45 78 70 28 20 77 68 69 74 65 73 70 61 63 65 20 2b 20 22 2b 22 2c 20 22 67 22 20 29 2c 0a Data Ascii: \$)[\\]]\|" + attributes + "))\|" +// 3. anything else (capture 2)"." +")\$\|)",// Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latterrwhitespace = new RegExp( whitespace + "+", "g" ),
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 72 62 75 67 67 79 51 53 41 2e 70 75 73 68 28 20 22 5b 2a 5e 24 5d 3d 22 20 2b 20 77 68 69 74 65 73 70 61 63 65 20 2b 20 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 20 29 3b 0a 09 09 09 7d 0a 0a 09 09 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 49 45 38 0a 09 09 09 2f 2f 20 42 6f 6f 6c 65 61 6e 20 61 74 74 72 69 62 75 74 65 73 20 61 6e 64 20 22 76 61 6c 75 65 22 20 61 72 65 20 6e 6f 74 20 74 72 65 61 74 65 64 20 63 6f 72 72 65 63 74 6c 79 0a 09 09 09 69 66 20 28 20 21 64 69 76 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 72 62 75 67 67 Data Ascii: orAll("[msallowcapture^='']").length ) {rbuggyQSA.push( "[^$]=" + whitespace + "(?:''\|\"\")" );}// Support: IE8// Boolean attributes and "value" are not treated correctlyif ( !div.querySelectorAll("[selected]").length ) {rbugg
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 3d 20 30 29 20 7c 7c 20 73 74 61 72 74 2e 70 6f 70 28 29 29 20 29 20 7b 0a 0a 09 09 09 09 09 09 09 09 09 69 66 20 28 20 28 20 6f 66 54 79 70 65 20 3f 0a 09 09 09 09 09 09 09 09 09 09 6e 6f 64 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 3d 3d 3d 20 6e 61 6d 65 20 3a 0a 09 09 09 09 09 09 09 09 09 09 6e 6f 64 65 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 31 20 29 20 26 26 0a 09 09 09 09 09 09 09 09 09 09 2b 2b 64 69 66 66 20 29 20 7b 0a 0a 09 09 09 09 09 09 09 09 09 09 2f 2f 20 43 61 63 68 65 20 74 68 65 20 69 6e 64 65 78 20 6f 66 20 65 61 63 68 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 65 6c 65 6d 65 6e 74 0a 09 09 09 09 09 09 09 09 09 09 69 66 20 28 20 75 73 65 43 61 63 68 65 20 29 20 7b 0a 09 09 09 09 09 09 09 09 09 09 09 6f 75 Data Ascii: = 0) \|\| start.pop()) ) {if ( ( ofType ?node.nodeName.toLowerCase() === name :node.nodeType === 1 ) &&++diff ) {// Cache the index of each encountered elementif ( useCache ) {ou
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 09 09 09 2f 2f 20 52 65 74 75 72 6e 20 73 70 65 63 69 61 6c 20 75 70 6f 6e 20 73 65 65 69 6e 67 20 61 20 70 6f 73 69 74 69 6f 6e 61 6c 20 6d 61 74 63 68 65 72 0a 09 09 09 69 66 20 28 20 6d 61 74 63 68 65 72 5b 20 65 78 70 61 6e 64 6f 20 5d 20 29 20 7b 0a 09 09 09 09 2f 2f 20 46 69 6e 64 20 74 68 65 20 6e 65 78 74 20 72 65 6c 61 74 69 76 65 20 6f 70 65 72 61 74 6f 72 20 28 69 66 20 61 6e 79 29 20 66 6f 72 20 70 72 6f 70 65 72 20 68 61 6e 64 6c 69 6e 67 0a 09 09 09 09 6a 20 3d 20 2b 2b 69 3b 0a 09 09 09 09 66 6f 72 20 28 20 3b 20 6a 20 3c 20 6c 65 6e 3b 20 6a 2b 2b 20 29 20 7b 0a 09 09 09 09 09 69 66 20 28 20 45 78 70 72 2e 72 65 6c 61 74 69 76 65 5b 20 74 6f 6b 65 6e 73 5b 6a 5d 2e 74 79 70 65 20 5d 20 29 20 7b 0a 09 09 09 09 09 09 62 72 65 61 6b 3b 0a 09 Data Ascii: // Return special upon seeing a positional matcherif ( matcher[ expando ] ) {// Find the next relative operator (if any) for proper handlingj = ++i;for ( ; j < len; j++ ) {if ( Expr.relative[ tokens[j].type ] ) {break;
2024-12-13 20:21:41 UTC	6389	IN	Data Raw: 2f 2c 0a 0a 09 2f 2f 20 6d 65 74 68 6f 64 73 20 67 75 61 72 61 6e 74 65 65 64 20 74 6f 20 70 72 6f 64 75 63 65 20 61 20 75 6e 69 71 75 65 20 73 65 74 20 77 68 65 6e 20 73 74 61 72 74 69 6e 67 20 66 72 6f 6d 20 61 20 75 6e 69 71 75 65 20 73 65 74 0a 09 67 75 61 72 61 6e 74 65 65 64 55 6e 69 71 75 65 20 3d 20 7b 0a 09 09 63 68 69 6c 64 72 65 6e 3a 20 74 72 75 65 2c 0a 09 09 63 6f 6e 74 65 6e 74 73 3a 20 74 72 75 65 2c 0a 09 09 6e 65 78 74 3a 20 74 72 75 65 2c 0a 09 09 70 72 65 76 3a 20 74 72 75 65 0a 09 7d 3b 0a 0a 6a 51 75 65 72 79 2e 66 6e 2e 65 78 74 65 6e 64 28 20 7b 0a 09 68 61 73 3a 20 66 75 6e 63 74 69 6f 6e 28 20 74 61 72 67 65 74 20 29 20 7b 0a 09 09 76 61 72 20 69 2c 0a 09 09 09 74 61 72 67 65 74 73 20 3d 20 6a 51 75 65 72 79 28 20 74 61 72 67 65 Data Ascii: /,// methods guaranteed to produce a unique set when starting from a unique setguaranteedUnique = {children: true,contents: true,next: true,prev: true};jQuery.fn.extend( {has: function( target ) {var i,targets = jQuery( targe
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 20 7b 0a 0a 09 09 09 09 2f 2f 20 4b 65 65 70 20 61 6e 20 65 6d 70 74 79 20 6c 69 73 74 20 69 66 20 77 65 20 68 61 76 65 20 64 61 74 61 20 66 6f 72 20 66 75 74 75 72 65 20 61 64 64 20 63 61 6c 6c 73 0a 09 09 09 09 69 66 20 28 20 6d 65 6d 6f 72 79 20 29 20 7b 0a 09 09 09 09 09 6c 69 73 74 20 3d 20 5b 5d 3b 0a 0a 09 09 09 09 2f 2f 20 4f 74 68 65 72 77 69 73 65 2c 20 74 68 69 73 20 6f 62 6a 65 63 74 20 69 73 20 73 70 65 6e 74 0a 09 09 09 09 7d 20 65 6c 73 65 20 7b 0a 09 09 09 09 09 6c 69 73 74 20 3d 20 22 22 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 2c 0a 0a 09 09 2f 2f 20 41 63 74 75 61 6c 20 43 61 6c 6c 62 61 63 6b 73 20 6f 62 6a 65 63 74 0a 09 09 73 65 6c 66 20 3d 20 7b 0a 0a 09 09 09 2f 2f 20 41 64 64 20 61 20 63 61 6c 6c 62 61 63 6b 20 6f 72 20 61 Data Ascii: {// Keep an empty list if we have data for future add callsif ( memory ) {list = [];// Otherwise, this object is spent} else {list = "";}}},// Actual Callbacks objectself = {// Add a callback or a
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 64 20 29 20 7b 0a 09 09 74 68 69 73 43 61 63 68 65 5b 20 6a 51 75 65 72 79 2e 63 61 6d 65 6c 43 61 73 65 28 20 6e 61 6d 65 20 29 20 5d 20 3d 20 64 61 74 61 3b 0a 09 7d 0a 0a 09 2f 2f 20 43 68 65 63 6b 20 66 6f 72 20 62 6f 74 68 20 63 6f 6e 76 65 72 74 65 64 2d 74 6f 2d 63 61 6d 65 6c 20 61 6e 64 20 6e 6f 6e 2d 63 6f 6e 76 65 72 74 65 64 20 64 61 74 61 20 70 72 6f 70 65 72 74 79 20 6e 61 6d 65 73 0a 09 2f 2f 20 49 66 20 61 20 64 61 74 61 20 70 72 6f 70 65 72 74 79 20 77 61 73 20 73 70 65 63 69 66 69 65 64 0a 09 69 66 20 28 20 74 79 70 65 6f 66 20 6e 61 6d 65 20 3d 3d 3d 20 22 73 74 72 69 6e 67 22 20 29 20 7b 0a 0a 09 09 2f 2f 20 46 69 72 73 74 20 54 72 79 20 74 6f 20 66 69 6e 64 20 61 73 2d 69 73 20 70 72 6f 70 65 72 74 79 20 64 61 74 61 0a 09 09 72 65 74 Data Ascii: d ) {thisCache[ jQuery.camelCase( name ) ] = data;}// Check for both converted-to-camel and non-converted data property names// If a data property was specifiedif ( typeof name === "string" ) {// First Try to find as-is property dataret
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 6f 64 79 3e 3c 74 72 3e 22 2c 20 22 3c 2f 74 72 3e 3c 2f 74 62 6f 64 79 3e 3c 2f 74 61 62 6c 65 3e 22 20 5d 2c 0a 0a 09 2f 2f 20 49 45 36 2d 38 20 63 61 6e 27 74 20 73 65 72 69 61 6c 69 7a 65 20 6c 69 6e 6b 2c 20 73 63 72 69 70 74 2c 20 73 74 79 6c 65 2c 20 6f 72 20 61 6e 79 20 68 74 6d 6c 35 20 28 4e 6f 53 63 6f 70 65 29 20 74 61 67 73 2c 0a 09 2f 2f 20 75 6e 6c 65 73 73 20 77 72 61 70 70 65 64 20 69 6e 20 61 20 64 69 76 20 77 69 74 68 20 6e 6f 6e 2d 62 72 65 61 6b 69 6e 67 20 63 68 61 72 61 63 74 65 72 73 20 69 6e 20 66 72 6f 6e 74 20 6f 66 20 69 74 2e 0a 09 5f 64 65 66 61 75 6c 74 3a 20 73 75 70 70 6f 72 74 2e 68 74 6d 6c 53 65 72 69 61 6c 69 7a 65 20 3f 20 5b 20 30 2c 20 22 22 2c 20 22 22 20 5d 20 3a 20 5b 20 31 2c 20 22 58 3c 64 69 76 3e 22 2c 20 22 Data Ascii: ody><tr>", "</tr></tbody></table>" ],// IE6-8 can't serialize link, script, style, or any html5 (NoScope) tags,// unless wrapped in a div with non-breaking characters in front of it._default: support.htmlSerialize ? [ 0, "", "" ] : [ 1, "X<div>", "
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 09 09 65 76 65 6e 74 2e 74 79 70 65 20 3d 20 74 79 70 65 3b 0a 0a 09 09 2f 2f 20 49 66 20 6e 6f 62 6f 64 79 20 70 72 65 76 65 6e 74 65 64 20 74 68 65 20 64 65 66 61 75 6c 74 20 61 63 74 69 6f 6e 2c 20 64 6f 20 69 74 20 6e 6f 77 0a 09 09 69 66 20 28 20 21 6f 6e 6c 79 48 61 6e 64 6c 65 72 73 20 26 26 20 21 65 76 65 6e 74 2e 69 73 44 65 66 61 75 6c 74 50 72 65 76 65 6e 74 65 64 28 29 20 29 20 7b 0a 0a 09 09 09 69 66 20 28 0a 09 09 09 09 28 20 21 73 70 65 63 69 61 6c 2e 5f 64 65 66 61 75 6c 74 20 7c 7c 0a 09 09 09 09 20 73 70 65 63 69 61 6c 2e 5f 64 65 66 61 75 6c 74 2e 61 70 70 6c 79 28 20 65 76 65 6e 74 50 61 74 68 2e 70 6f 70 28 29 2c 20 64 61 74 61 20 29 20 3d 3d 3d 20 66 61 6c 73 65 0a 09 09 09 09 29 20 26 26 20 61 63 63 65 70 74 44 61 74 61 28 20 65 6c Data Ascii: event.type = type;// If nobody prevented the default action, do it nowif ( !onlyHandlers && !event.isDefaultPrevented() ) {if (( !special._default \|\| special._default.apply( eventPath.pop(), data ) === false) && acceptData( el

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.11.12	49536	104.17.246.203	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	640	OUT	GET /petite-vue HTTP/1.1 Host: unpkg.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	523	IN	HTTP/1.1 302 Found Date: Fri, 13 Dec 2024 20:21:41 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, s-maxage=600, max-age=60 location: /petite-vue@0.4.1 vary: Accept via: 1.1 fly.io fly-request-id: 01JF0TWSDST0KBSM1BJ2NVFJ3A-iad CF-Cache-Status: HIT Age: 49 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8f18a9750d0aed84-ATL
2024-12-13 20:21:41 UTC	45	IN	Data Raw: 32 37 0d 0a 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 70 65 74 69 74 65 2d 76 75 65 40 30 2e 34 2e 31 0d 0a Data Ascii: 27Found. Redirecting to /petite-vue@0.4.1
2024-12-13 20:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.12	49534	52.216.144.19	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	689	OUT	GET /landing_pages/oops/styles.css HTTP/1.1 Host: helpimg.s3.amazonaws.com Connection: keep-alive Accept: text/css,/;q=0.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	502	IN	HTTP/1.1 200 OK x-amz-id-2: 0NlFp5mKUZ0jgU8NCcnNkM4W9IOxaJZm/5IqwpMzyR1KZTyOkmT36mmzfg6SqN2I+t9ZViNIvyg= x-amz-request-id: 6VGQDNHFQ5HCQWVZ Date: Fri, 13 Dec 2024 20:21:42 GMT x-amz-replication-status: COMPLETED Last-Modified: Thu, 05 Dec 2024 22:09:56 GMT ETag: "b13b4f098d80ac49dcc6bed4e459d560" x-amz-server-side-encryption: AES256 x-amz-version-id: euN8e1egT0HP5Qpqr.UG1XrfZxMZiG5f Accept-Ranges: bytes Content-Type: text/css Content-Length: 5649 Server: AmazonS3 Connection: close
2024-12-13 20:21:41 UTC	5649	IN	Data Raw: 3a 72 6f 6f 74 20 7b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 31 30 30 3a 20 23 66 66 66 66 66 66 3b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 32 30 30 3a 20 23 66 35 66 35 66 35 3b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 33 30 30 3a 20 23 64 35 64 35 64 35 3b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 34 30 30 3a 20 23 61 62 61 62 61 62 3b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 35 30 30 3a 20 23 37 30 37 30 37 30 3b 0a 09 2d 2d 63 6c 72 2d 6e 65 75 74 72 61 6c 2d 36 30 30 3a 20 23 32 63 32 63 32 63 3b 0a 0a 09 2f 2a 20 50 61 64 64 69 6e 67 20 2a 2f 0a 09 2d 2d 70 61 64 64 69 6e 67 2d 78 73 3a 20 63 6c 61 6d 70 28 30 2e 35 72 65 6d 2c 20 31 2e 35 25 2c 20 30 2e 37 35 72 65 6d 29 3b 0a 09 2d 2d 70 61 64 64 69 6e 67 2d 73 Data Ascii: :root {--clr-neutral-100: #ffffff;--clr-neutral-200: #f5f5f5;--clr-neutral-300: #d5d5d5;--clr-neutral-400: #ababab;--clr-neutral-500: #707070;--clr-neutral-600: #2c2c2c;/* Padding */--padding-xs: clamp(0.5rem, 1.5%, 0.75rem);--padding-s

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.11.12	49533	3.98.99.217	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	729	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secure.webmail-net.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:41 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Fri, 13 Dec 2024 19:48:28 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-13 20:21:41 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-13 20:21:41 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-13 20:21:41 UTC	3840	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 3b 76 61 72 20 44 74 3d 2f 5e 28 3f 3a 66 6f 63 75 73 69 6e 66 6f 63 75 73 7c 66 6f 63 75 73 6f 75 74 62 6c 75 72 29 24 2f 2c 4e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 7d 3b 63 65 2e 65 78 74 65 6e 64 28 63 65 2e 65 76 65 6e 74 2c 7b 74 72 69 67 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 2c 66 2c 70 3d 5b 6e 7c 7c 43 5d 2c 64 3d 75 65 2e 63 61 6c 6c 28 65 2c 22 74 79 70 65 22 29 3f 65 2e 74 79 70 65 3a 65 2c 68 3d 75 65 2e 63 61 6c 6c 28 65 2c 22 6e 61 6d 65 73 70 61 63 65 22 29 3f 65 2e 6e 61 6d 65 73 70 61 63 65 2e 73 70 6c 69 74 28 22 2e 22 29 3a 5b 5d 3b 69 66 28 6f 3d 66 3d 61 3d 6e 3d 6e 7c 7c 43 2c 33 21 3d 3d 6e 2e Data Ascii: ;var Dt=/^(?:focusinfocus\|focusoutblur)$/,Nt=function(e){e.stopPropagation()};ce.extend(ce.event,{trigger:function(e,t,n,r){var i,o,a,s,u,l,c,f,p=[n\|\|C],d=ue.call(e,"type")?e.type:e,h=ue.call(e,"namespace")?e.namespace.split("."):[];if(o=f=a=n=n\|\|C,3!==n.
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 61 72 67 69 6e 22 3a 22 62 6f 72 64 65 72 22 29 3b 72 65 74 75 72 6e 20 4d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 20 79 28 65 29 3f 30 3d 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 22 6f 75 74 65 72 22 29 3f 65 5b 22 69 6e 6e 65 72 22 2b 61 5d 3a 65 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 5b 22 63 6c 69 65 6e 74 22 2b 61 5d 3a 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 3f 28 72 3d 65 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2c 4d 61 74 68 2e 6d 61 78 28 65 2e 62 6f 64 79 5b 22 73 63 72 6f 6c 6c 22 2b 61 5d 2c 72 5b 22 73 63 72 6f 6c 6c 22 2b 61 5d 2c 65 2e 62 6f 64 79 5b 22 6f 66 66 73 65 74 22 2b 61 5d 2c 72 5b 22 6f 66 66 73 65 74 22 2b 61 5d 2c 72 5b 22 63 Data Ascii: argin":"border");return M(this,function(e,t,n){var r;return y(e)?0===o.indexOf("outer")?e["inner"+a]:e.document.documentElement["client"+a]:9===e.nodeType?(r=e.documentElement,Math.max(e.body["scroll"+a],r["scroll"+a],e.body["offset"+a],r["offset"+a],r["c
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 56 2e 75 69 2e 66 6f 63 75 73 61 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 73 2c 6e 2c 6f 2c 61 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 61 72 65 61 22 3d 3d 3d 61 3f 28 73 3d 28 69 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 2e 6e 61 6d 65 2c 21 28 21 74 2e 68 72 65 66 7c 7c 21 73 7c 7c 22 6d 61 70 22 21 3d 3d 69 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 26 26 28 30 3c 28 73 3d 56 28 22 69 6d 67 5b 75 73 65 6d 61 70 3d 27 23 22 2b 73 2b 22 27 5d 22 29 29 2e 6c 65 6e 67 74 68 26 26 73 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 29 29 3a 28 2f 5e 28 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 7c 6f 62 Data Ascii: V.ui.focusable=function(t,e){var i,s,n,o,a=t.nodeName.toLowerCase();return"area"===a?(s=(i=t.parentNode).name,!(!t.href\|\|!s\|\|"map"!==i.nodeName.toLowerCase())&&(0<(s=V("img[usemap='#"+s+"']")).length&&s.is(":visible"))):(/^(input\|select\|textarea\|button\|ob
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 73 2e 6f 66 66 73 65 74 2e 63 6c 69 63 6b 2e 74 6f 70 3e 69 5b 33 5d 26 26 28 61 3d 69 5b 33 5d 2b 74 68 69 73 2e 6f 66 66 73 65 74 2e 63 6c 69 63 6b 2e 74 6f 70 29 29 2c 73 2e 67 72 69 64 26 26 28 74 3d 73 2e 67 72 69 64 5b 31 5d 3f 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 50 61 67 65 59 2b 4d 61 74 68 2e 72 6f 75 6e 64 28 28 61 2d 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 50 61 67 65 59 29 2f 73 2e 67 72 69 64 5b 31 5d 29 2a 73 2e 67 72 69 64 5b 31 5d 3a 74 68 69 73 2e 6f 72 69 67 69 6e 61 6c 50 61 67 65 59 2c 61 3d 21 69 7c 7c 74 2d 74 68 69 73 2e 6f 66 66 73 65 74 2e 63 6c 69 63 6b 2e 74 6f 70 3e 3d 69 5b 31 5d 7c 7c 74 2d 74 68 69 73 2e 6f 66 66 73 65 74 2e 63 6c 69 63 6b 2e 74 6f 70 3e 69 5b 33 5d 3f 74 3a 74 2d 74 68 69 73 2e 6f 66 66 73 65 74 2e 63 6c Data Ascii: s.offset.click.top>i[3]&&(a=i[3]+this.offset.click.top)),s.grid&&(t=s.grid[1]?this.originalPageY+Math.round((a-this.originalPageY)/s.grid[1])*s.grid[1]:this.originalPageY,a=!i\|\|t-this.offset.click.top>=i[1]\|\|t-this.offset.click.top>i[3]?t:t-this.offset.cl

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.11.12	49532	3.98.99.217	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	751	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secure.webmail-net.com Connection: keep-alive Accept: text/css,/;q=0.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:41 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Fri, 13 Dec 2024 19:48:28 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-13 20:21:41 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.11.12	49537	18.164.78.13	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	680	OUT	GET /packs/js/vendor-954761ad0dceb106b971.js HTTP/1.1 Host: training.knowbe4.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:42 UTC	14587	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 1762 Connection: close Last-Modified: Fri, 13 Dec 2024 17:25:35 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: eINDJ.6ln..1m.T3bZuKqnVUEmmTlD5r Accept-Ranges: bytes Server: AmazonS3 content-security-policy-report-only: default-src 'self' data: wss://gruefbpuubghniw5iflbf2a6im.appsync-api.us-east-1.amazonaws.com/graphql wss://gruefbpuubghniw5iflbf2a6im.appsync-realtime-api.us-east-1.amazonaws.com/graphql s3.amazonaws.com/uploads.knowbe4.com/ api-js.mixpanel.com app.pendo.io btb-glossary-bucket-production-us-east-1.s3.amazonaws.com https://browser-intake-datadoghq.com/ cdn.pendo.io data.pendo.io fonts.googleapis.com metrics.articulate.com modstore.knowbe4.com modstore-production-us-east-1.s3.amazonaws.com https://.kmsat.kb4od.run https://.ckeditor.com/ https://.launchdarkly.com/ https://.zopim.com/ https://api-js.mixpanel.com/decide https://api-js.mixpanel.com/decide/ https://api-js.mixpanel.com/engage https://api-js.mixpanel.com/engage/ https://api-js.mixpanel.com/track https://api-js.mixpanel.com/track/ https://api.mixpanel.com/ https://cdnjs.cloudflare.com/ https://code.highcharts.com/ https://data.pendo.io/ https://ekr.zdassets.com/ https://ekr.zendesk.com/ https://knowbe4.zendesk. [TRUNCATED] referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubdomains; preload x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-permitted-cross-domain-policies: none x-xss-protection: 1; mode=block Date: Fri, 13 Dec 2024 20:21:42 GMT ETag: "16421ab93c7229ae787dc248a051034e" Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 f61eac44af4c242f84a8960a590c7fba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P5 X-Amz-Cf-Id: JIuPqbnz5U0fBh-sdlK0IDxwLeHG4oyPhqsIbEHTbvPBkmxRbtg2HA== Age: 2
2024-12-13 20:21:42 UTC	1762	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 75 69 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 75 69 2f 66 6f 6e 74 73 2f 6f 70 65 6e 73 61 6e 73 2e 63 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><meta http-equiv="X-UA-Compatible" content="IE=edge"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="icon" href="/ui/favicon.ico"/><link href="/ui/fonts/opensans.c

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.11.12	49538	18.164.78.13	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	725	OUT	GET /assets/modernizr-79e0181ec91aff04bb01d87cba546535ede843f75d19f5c60f66b8dd6546971f.js HTTP/1.1 Host: training.knowbe4.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	14585	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 51364 Connection: close Date: Fri, 13 Dec 2024 20:21:42 GMT Last-Modified: Thu, 23 May 2024 17:10:02 GMT ETag: "bf2f96e6233de3d8c0346085ac28248a" x-amz-server-side-encryption: AES256 x-amz-version-id: RZAGGokfellBSB91hGWLp0WOKAUihfUC Accept-Ranges: bytes Server: AmazonS3 content-security-policy-report-only: default-src 'self' data: wss://gruefbpuubghniw5iflbf2a6im.appsync-api.us-east-1.amazonaws.com/graphql wss://gruefbpuubghniw5iflbf2a6im.appsync-realtime-api.us-east-1.amazonaws.com/graphql s3.amazonaws.com/uploads.knowbe4.com/ api-js.mixpanel.com app.pendo.io btb-glossary-bucket-production-us-east-1.s3.amazonaws.com https://browser-intake-datadoghq.com/ cdn.pendo.io data.pendo.io fonts.googleapis.com metrics.articulate.com modstore.knowbe4.com modstore-production-us-east-1.s3.amazonaws.com https://.kmsat.kb4od.run https://.ckeditor.com/ https://.launchdarkly.com/ https://.zopim.com/ https://api-js.mixpanel.com/decide https://api-js.mixpanel.com/decide/ https://api-js.mixpanel.com/engage https://api-js.mixpanel.com/engage/ https://api-js.mixpanel.com/track https://api-js.mixpanel.com/track/ https://api.mixpanel.com/ https://cdnjs.cloudflare.com/ https://code.highcharts.com/ https://data.pendo.io/ https://ekr.zdassets.com/ https://ekr.zendesk.com/ https://knowbe4.zendesk. [TRUNCATED] referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubdomains; preload x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-permitted-cross-domain-policies: none x-xss-protection: 1; mode=block Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 d8ad943d740b6238b25a2f7e6eea878e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P5 X-Amz-Cf-Id: adJRwjyNCpGOSSEQk089bO9g8-N9fd1u_v3imMNfQRLVKuBrzr-I-w==
2024-12-13 20:21:41 UTC	1383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4d 6f 64 65 72 6e 69 7a 72 20 76 32 2e 37 2e 31 0a 20 2a 20 77 77 77 2e 6d 6f 64 65 72 6e 69 7a 72 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 46 61 72 75 6b 20 41 74 65 73 2c 20 50 61 75 6c 20 49 72 69 73 68 2c 20 41 6c 65 78 20 53 65 78 74 6f 6e 0a 20 2a 20 41 76 61 69 6c 61 62 6c 65 20 75 6e 64 65 72 20 74 68 65 20 42 53 44 20 61 6e 64 20 4d 49 54 20 6c 69 63 65 6e 73 65 73 3a 20 77 77 77 2e 6d 6f 64 65 72 6e 69 7a 72 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 0a 20 2a 2f 0a 0a 2f 2a 0a 20 2a 20 4d 6f 64 65 72 6e 69 7a 72 20 74 65 73 74 73 20 77 68 69 63 68 20 6e 61 74 69 76 65 20 43 53 53 33 20 61 6e 64 20 48 54 4d 4c 35 20 66 65 61 74 75 72 65 73 20 61 72 65 20 61 76 61 69 6c 61 62 6c 65 20 69 6e 0a 20 Data Ascii: /! Modernizr v2.7.1 * www.modernizr.com * * Copyright (c) Faruk Ates, Paul Irish, Alex Sexton * Available under the BSD and MIT licenses: www.modernizr.com/license/ // * Modernizr tests which native CSS3 and HTML5 features are available in
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 20 2a 20 43 72 65 61 74 65 20 74 68 65 20 69 6e 70 75 74 20 65 6c 65 6d 65 6e 74 20 66 6f 72 20 76 61 72 69 6f 75 73 20 57 65 62 20 46 6f 72 6d 73 20 66 65 61 74 75 72 65 20 74 65 73 74 73 2e 0a 20 20 20 20 20 2a 2f 0a 20 20 20 20 69 6e 70 75 74 45 6c 65 6d 20 2f 2a 3e 3e 69 6e 70 75 74 65 6c 65 6d 2a 2f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 6e 70 75 74 27 29 20 2f 2a 3e 3e 69 6e 70 75 74 65 6c 65 6d 2a 2f 20 2c 0a 0a 20 20 20 20 2f 2a 3e 3e 73 6d 69 6c 65 2a 2f 0a 20 20 20 20 73 6d 69 6c 65 20 3d 20 27 3a 29 27 2c 0a 20 20 20 20 2f 2a 3e 3e 73 6d 69 6c 65 2a 2f 0a 0a 20 20 20 20 74 6f 53 74 72 69 6e 67 20 3d 20 7b 7d 2e 74 6f 53 74 72 69 6e 67 2c 0a 0a 20 20 20 20 2f 2f 20 54 4f 44 4f 20 3a 3a 20 6d 61 6b 65 Data Ascii: * Create the input element for various Web Forms feature tests. / inputElem />>inputelem/ = document.createElement('input') />>inputelem/ , />>smile/ smile = ':)', />>smile*/ toString = {}.toString, // TODO :: make
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 4d 6f 7a 57 65 62 53 6f 63 6b 65 74 27 20 69 6e 20 77 69 6e 64 6f 77 3b 0a 20 20 20 20 7d 3b 0a 0a 0a 20 20 20 20 2f 2f 20 63 73 73 2d 74 72 69 63 6b 73 2e 63 6f 6d 2f 72 67 62 61 2d 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 2f 0a 20 20 20 20 74 65 73 74 73 5b 27 72 67 62 61 27 5d 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 2f 2f 20 53 65 74 20 61 6e 20 72 67 62 61 28 29 20 63 6f 6c 6f 72 20 61 6e 64 20 63 68 65 63 6b 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 76 61 6c 75 65 0a 0a 20 20 20 20 20 20 20 20 73 65 74 43 73 73 28 27 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 31 35 30 2c 32 35 35 2c 31 35 30 2c 2e 35 29 27 29 3b 0a 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 63 6f 6e 74 61 69 6e 73 28 6d Data Ascii: MozWebSocket' in window; }; // css-tricks.com/rgba-browser-support/ tests['rgba'] = function() { // Set an rgba() color and check the returned value setCss('background-color:rgba(150,255,150,.5)'); return contains(m
2024-12-13 20:21:41 UTC	16384	IN	Data Raw: 74 75 72 65 4e 61 6d 65 5d 20 3d 20 74 65 73 74 73 5b 66 65 61 74 75 72 65 5d 28 29 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 65 73 2e 70 75 73 68 28 28 4d 6f 64 65 72 6e 69 7a 72 5b 66 65 61 74 75 72 65 4e 61 6d 65 5d 20 3f 20 27 27 20 3a 20 27 6e 6f 2d 27 29 20 2b 20 66 65 61 74 75 72 65 4e 61 6d 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2f 2a 3e 3e 77 65 62 66 6f 72 6d 73 2a 2f 0a 20 20 20 20 2f 2f 20 69 6e 70 75 74 20 74 65 73 74 73 20 6e 65 65 64 20 74 6f 20 72 75 6e 2e 0a 20 20 20 20 4d 6f 64 65 72 6e 69 7a 72 2e 69 6e 70 75 74 20 7c 7c 20 77 65 62 66 6f 72 6d 73 28 29 3b 0a 20 20 20 20 2f 2a 3e 3e 77 65 62 66 6f 72 6d 73 2a 2f 0a 0a 0a 20 20 20 20 2f 2a 2a 0a 20 20 20 20 20 2a 20 61 64 64 54 65 73 Data Ascii: tureName] = tests[feature](); classes.push((Modernizr[featureName] ? '' : 'no-') + featureName); } } />>webforms/ // input tests need to run. Modernizr.input \|\| webforms(); />>webforms/ /** * addTes
2024-12-13 20:21:41 UTC	829	IN	Data Raw: 20 20 20 20 2f 2f 20 20 20 20 20 7d 2c 0a 20 20 20 20 2f 2f 20 20 20 20 20 74 72 61 6e 73 45 6e 64 45 76 65 6e 74 4e 61 6d 65 20 3d 20 74 72 61 6e 73 45 6e 64 45 76 65 6e 74 4e 61 6d 65 73 5b 20 4d 6f 64 65 72 6e 69 7a 72 2e 70 72 65 66 69 78 65 64 28 27 74 72 61 6e 73 69 74 69 6f 6e 27 29 20 5d 3b 0a 0a 20 20 20 20 4d 6f 64 65 72 6e 69 7a 72 2e 70 72 65 66 69 78 65 64 20 20 20 20 20 20 3d 20 66 75 6e 63 74 69 6f 6e 28 70 72 6f 70 2c 20 6f 62 6a 2c 20 65 6c 65 6d 29 7b 0a 20 20 20 20 20 20 69 66 28 21 6f 62 6a 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 65 73 74 50 72 6f 70 73 41 6c 6c 28 70 72 6f 70 2c 20 27 70 66 78 27 29 3b 0a 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 2f 2f 20 54 65 73 74 69 6e 67 20 44 4f 4d Data Ascii: // }, // transEndEventName = transEndEventNames[ Modernizr.prefixed('transition') ]; Modernizr.prefixed = function(prop, obj, elem){ if(!obj) { return testPropsAll(prop, 'pfx'); } else { // Testing DOM

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.11.12	49539	104.17.246.203	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:41 UTC	646	OUT	GET /petite-vue@0.4.1 HTTP/1.1 Host: unpkg.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:41 UTC	544	IN	HTTP/1.1 302 Found Date: Fri, 13 Dec 2024 20:21:41 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 location: /petite-vue@0.4.1/dist/petite-vue.iife.js vary: Accept via: 1.1 fly.io fly-request-id: 01J85WQ8VP779A5X86AEE8ZVQC-iad CF-Cache-Status: HIT Age: 7346553 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8f18a9786df51386-ATL
2024-12-13 20:21:41 UTC	69	IN	Data Raw: 33 66 0d 0a 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 70 65 74 69 74 65 2d 76 75 65 40 30 2e 34 2e 31 2f 64 69 73 74 2f 70 65 74 69 74 65 2d 76 75 65 2e 69 69 66 65 2e 6a 73 0d 0a Data Ascii: 3fFound. Redirecting to /petite-vue@0.4.1/dist/petite-vue.iife.js
2024-12-13 20:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.11.12	49540	104.17.246.203	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:42 UTC	670	OUT	GET /petite-vue@0.4.1/dist/petite-vue.iife.js HTTP/1.1 Host: unpkg.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:42 UTC	575	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:42 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close access-control-allow-origin: * cache-control: public, max-age=31536000 last-modified: Tue, 18 Jan 2022 14:35:47 GMT etag: W/"4205-zDsr+dL8xxjIax7SrH2c1boS70M" via: 1.1 fly.io fly-request-id: 01JE5YA37S8M7WGR31195FEHPZ-iad CF-Cache-Status: HIT Age: 902438 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8f18a97ce8a0b0bd-ATL
2024-12-13 20:21:42 UTC	794	IN	Data Raw: 34 32 30 35 0d 0a 76 61 72 20 70 6e 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 2c 68 6e 3d 28 65 2c 74 2c 6e 29 3d 3e 74 20 69 6e 20 65 3f 70 6e 28 65 2c 74 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 6e 7d 29 3a 65 5b 74 5d 3d 6e 2c 43 3d 28 65 2c 74 2c 6e 29 3d 3e 28 68 6e 28 65 2c 22 73 79 6d 62 6f 6c 22 21 3d 74 79 70 65 6f 66 20 74 3f 74 2b 22 22 3a 74 2c 6e 29 2c 6e 29 2c 50 65 74 69 74 65 56 75 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 69 66 28 61 28 65 29 29 7b 63 6f 6e 73 74 20 6e 3d 7b 7d 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 73 3c 65 2e Data Ascii: 4205var pn=Object.defineProperty,hn=(e,t,n)=>t in e?pn(e,t,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[t]=n,C=(e,t,n)=>(hn(e,"symbol"!=typeof t?t+"":t,n),n),PetiteVue=function(e){"use strict";function t(e){if(a(e)){const n={};for(let s=0;s<e.
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 6d 65 28 29 3b 69 66 28 6e 3d 61 28 65 29 2c 73 3d 61 28 74 29 2c 6e 7c 7c 73 29 72 65 74 75 72 6e 21 28 21 6e 7c 7c 21 73 29 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 2e 6c 65 6e 67 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 6c 65 74 20 6e 3d 21 30 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 6e 26 26 73 3c 65 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 6e 3d 6f 28 65 5b 73 5d 2c 74 5b 73 5d 29 3b 72 65 74 75 72 6e 20 6e 7d 28 65 2c 74 29 3b 69 66 28 6e 3d 67 28 65 29 2c 73 3d 67 28 74 29 2c 6e 7c 7c 73 29 7b 69 66 28 21 6e 7c 7c 21 73 29 72 65 74 75 72 6e 21 31 3b 69 66 28 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 2e 6c 65 6e 67 74 68 21 3d 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 Data Ascii: me();if(n=a(e),s=a(t),n\|\|s)return!(!n\|\|!s)&&function(e,t){if(e.length!==t.length)return!1;let n=!0;for(let s=0;n&&s<e.length;s++)n=o(e[s],t[s]);return n}(e,t);if(n=g(e),s=g(t),n\|\|s){if(!n\|\|!s)return!1;if(Object.keys(e).length!==Object.keys(t).length)retur
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 75 64 65 73 28 74 68 69 73 29 29 74 72 79 7b 72 65 74 75 72 6e 20 54 2e 70 75 73 68 28 4d 3d 74 68 69 73 29 2c 46 2e 70 75 73 68 28 56 29 2c 56 3d 21 30 2c 4e 3d 31 3c 3c 2b 2b 52 2c 52 3c 3d 33 30 3f 28 28 7b 64 65 70 73 3a 65 7d 29 3d 3e 7b 69 66 28 65 2e 6c 65 6e 67 74 68 29 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 65 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 65 5b 74 5d 2e 77 7c 3d 4e 7d 29 28 74 68 69 73 29 3a 49 28 74 68 69 73 29 2c 74 68 69 73 2e 66 6e 28 29 7d 66 69 6e 61 6c 6c 79 7b 52 3c 3d 33 30 26 26 28 65 3d 3e 7b 63 6f 6e 73 74 7b 64 65 70 73 3a 74 7d 3d 65 3b 69 66 28 74 2e 6c 65 6e 67 74 68 29 7b 6c 65 74 20 6e 3d 30 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 73 3c 74 2e 6c 65 6e 67 74 68 3b 73 2b 2b 29 7b 63 6f 6e 73 74 20 72 3d 74 5b 73 5d 3b 6a Data Ascii: udes(this))try{return T.push(M=this),F.push(V),V=!0,N=1<<++R,R<=30?(({deps:e})=>{if(e.length)for(let t=0;t<e.length;t++)e[t].w\|=N})(this):I(this),this.fn()}finally{R<=30&&(e=>{const{deps:t}=e;if(t.length){let n=0;for(let s=0;s<t.length;s++){const r=t[s];j
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 28 65 2c 74 29 7b 66 6f 72 28 63 6f 6e 73 74 20 6e 20 6f 66 20 61 28 65 29 3f 65 3a 5b 2e 2e 2e 65 5d 29 28 6e 21 3d 3d 4d 7c 7c 6e 2e 61 6c 6c 6f 77 52 65 63 75 72 73 65 29 26 26 28 6e 2e 73 63 68 65 64 75 6c 65 72 3f 6e 2e 73 63 68 65 64 75 6c 65 72 28 29 3a 6e 2e 72 75 6e 28 29 29 7d 63 6f 6e 73 74 20 71 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6e 75 6c 6c 29 2c 73 3d 65 2e 73 70 6c 69 74 28 22 2c 22 29 3b 66 6f 72 28 6c 65 74 20 72 3d 30 3b 72 3c 73 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 6e 5b 73 5b 72 5d 5d 3d 21 30 3b 72 65 74 75 72 6e 20 74 3f 65 3d 3e 21 21 6e 5b 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3a 65 3d 3e 21 21 6e 5b 65 5d 7d 28 22 5f 5f 70 72 6f 74 6f 5f 5f 2c 5f Data Ascii: (e,t){for(const n of a(e)?e:[...e])(n!==M\|\|n.allowRecurse)&&(n.scheduler?n.scheduler():n.run())}const q=function(e,t){const n=Object.create(null),s=e.split(",");for(let r=0;r<s.length;r++)n[s[r]]=!0;return t?e=>!!n[e.toLowerCase()]:e=>!!n[e]}("__proto__,_
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 72 29 3b 72 65 74 75 72 6e 20 74 3d 3d 3d 6c 65 28 72 29 26 26 28 6f 3f 28 28 65 2c 74 29 3d 3e 21 4f 62 6a 65 63 74 2e 69 73 28 65 2c 74 29 29 28 73 2c 69 29 26 26 4a 28 74 2c 22 73 65 74 22 2c 6e 2c 73 29 3a 4a 28 74 2c 22 61 64 64 22 2c 6e 2c 73 29 29 2c 63 7d 7d 28 29 2c 64 65 6c 65 74 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 75 28 65 2c 74 29 3b 65 5b 74 5d 3b 63 6f 6e 73 74 20 73 3d 52 65 66 6c 65 63 74 2e 64 65 6c 65 74 65 50 72 6f 70 65 72 74 79 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 73 26 26 6e 26 26 4a 28 65 2c 22 64 65 6c 65 74 65 22 2c 74 2c 76 6f 69 64 20 30 29 2c 73 7d 2c 68 61 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 52 65 66 6c 65 63 74 2e 68 61 73 28 65 Data Ascii: r);return t===le(r)&&(o?((e,t)=>!Object.is(e,t))(s,i)&&J(t,"set",n,s):J(t,"add",n,s)),c}}(),deleteProperty:function(e,t){const n=u(e,t);e[t];const s=Reflect.deleteProperty(e,t);return s&&n&&J(e,"delete",t,void 0),s},has:function(e,t){const n=Reflect.has(e
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 6e 28 28 28 29 3d 3e 7b 6c 65 74 20 6e 3d 74 28 29 3b 69 66 28 73 29 28 6e 75 6c 6c 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 63 61 6d 65 6c 29 26 26 28 73 3d 77 28 73 29 29 2c 79 65 28 65 2c 73 2c 6e 2c 69 29 3b 65 6c 73 65 7b 66 6f 72 28 63 6f 6e 73 74 20 74 20 69 6e 20 6e 29 79 65 28 65 2c 74 2c 6e 5b 74 5d 2c 69 26 26 69 5b 74 5d 29 3b 66 6f 72 28 63 6f 6e 73 74 20 74 20 69 6e 20 69 29 28 21 6e 7c 7c 21 28 74 20 69 6e 20 6e 29 29 26 26 79 65 28 65 2c 74 2c 6e 75 6c 6c 29 7d 69 3d 6e 7d 29 29 7d 2c 79 65 3d 28 65 2c 6e 2c 73 2c 72 29 3d 3e 7b 69 66 28 22 63 6c 61 73 73 22 3d 3d 3d 6e 29 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 2c 69 28 65 2e 5f 63 6c 61 73 73 3f 5b 65 2e 5f 63 6c 61 73 73 2c 73 5d 3a 73 29 7c 7c 22 22 29 3b 65 6c Data Ascii: n((()=>{let n=t();if(s)(null==r?void 0:r.camel)&&(s=w(s)),ye(e,s,n,i);else{for(const t in n)ye(e,t,n[t],i&&i[t]);for(const t in i)(!n\|\|!(t in n))&&ye(e,t,null)}i=n}))},ye=(e,n,s,r)=>{if("class"===n)e.setAttribute("class",i(e._class?[e._class,s]:s)\|\|"");el
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 65 2e 73 6f 6d 65 28 28 6e 3d 3e 65 5b 60 24 7b 6e 7d 4b 65 79 60 5d 26 26 21 74 5b 6e 5d 29 29 7d 2c 53 65 3d 28 7b 65 6c 3a 65 2c 67 65 74 3a 74 2c 65 78 70 3a 6e 2c 61 72 67 3a 73 2c 6d 6f 64 69 66 69 65 72 73 3a 72 7d 29 3d 3e 7b 69 66 28 21 73 29 72 65 74 75 72 6e 3b 6c 65 74 20 69 3d 24 65 2e 74 65 73 74 28 6e 29 3f 74 28 60 28 65 20 3d 3e 20 24 7b 6e 7d 28 65 29 29 60 29 3a 74 28 60 28 24 65 76 65 6e 74 20 3d 3e 20 7b 20 24 7b 6e 7d 20 7d 29 60 29 3b 69 66 28 22 76 75 65 3a 6d 6f 75 6e 74 65 64 22 21 3d 3d 73 29 7b 69 66 28 22 76 75 65 3a 75 6e 6d 6f 75 6e 74 65 64 22 3d 3d 3d 73 29 72 65 74 75 72 6e 28 29 3d 3e 69 28 29 3b 69 66 28 72 29 7b 22 63 6c 69 63 6b 22 3d 3d 3d 73 26 26 28 72 2e 72 69 67 68 74 26 26 28 73 3d 22 63 6f 6e 74 65 78 74 6d 65 Data Ascii: e.some((n=>e[`${n}Key`]&&!t[n]))},Se=({el:e,get:t,exp:n,arg:s,modifiers:r})=>{if(!s)return;let i=$e.test(n)?t(`(e => ${n}(e))`):t(`($event => { ${n} })`);if("vue:mounted"!==s){if("vue:unmounted"===s)return()=>i();if(r){"click"===s&&(r.right&&(s="contextme
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 2e 74 79 70 65 2c 6c 3d 6e 28 60 28 76 61 6c 29 20 3d 3e 20 7b 20 24 7b 74 7d 20 3d 20 76 61 6c 20 7d 60 29 2c 7b 74 72 69 6d 3a 66 2c 6e 75 6d 62 65 72 3a 75 3d 22 6e 75 6d 62 65 72 22 3d 3d 3d 69 7d 3d 72 7c 7c 7b 7d 3b 69 66 28 22 53 45 4c 45 43 54 22 3d 3d 3d 65 2e 74 61 67 4e 61 6d 65 29 7b 63 6f 6e 73 74 20 74 3d 65 3b 77 65 28 65 2c 22 63 68 61 6e 67 65 22 2c 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 74 65 72 2e 63 61 6c 6c 28 74 2e 6f 70 74 69 6f 6e 73 2c 28 65 3d 3e 65 2e 73 65 6c 65 63 74 65 64 29 29 2e 6d 61 70 28 28 65 3d 3e 75 3f 4f 28 6a 65 28 65 29 29 3a 6a 65 28 65 29 29 29 3b 6c 28 74 2e 6d 75 6c 74 69 70 6c 65 3f 65 3a 65 5b 30 5d 29 7d 29 29 2c 73 28 28 28 29 3d 3e 7b 63 6f 6e 73 Data Ascii: .type,l=n(`(val) => { ${t} = val }`),{trim:f,number:u="number"===i}=r\|\|{};if("SELECT"===e.tagName){const t=e;we(e,"change",(()=>{const e=Array.prototype.filter.call(t.options,(e=>e.selected)).map((e=>u?O(je(e)):je(e)));l(t.multiple?e:e[0])})),s((()=>{cons
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 5b 5c 73 5c 53 5d 2a 29 2f 2c 4b 65 3d 2f 2c 28 5b 5e 2c 5c 7d 5c 5d 5d 2a 29 28 3f 3a 2c 28 5b 5e 2c 5c 7d 5c 5d 5d 2a 29 29 3f 24 2f 2c 56 65 3d 2f 5e 5c 28 7c 5c 29 24 2f 67 2c 46 65 3d 2f 5e 5b 7b 5b 5d 5c 73 2a 28 28 3f 3a 5b 5c 77 5f 24 5d 2b 5c 73 2a 2c 3f 5c 73 2a 29 2b 29 5b 5c 5d 7d 5d 24 2f 2c 7a 65 3d 28 65 2c 74 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 20 73 3d 74 2e 6d 61 74 63 68 28 49 65 29 3b 69 66 28 21 73 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 72 3d 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 2c 69 3d 65 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6f 3d 6e 65 77 20 54 65 78 74 28 22 22 29 3b 69 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6f 2c 65 29 2c 69 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 3b 63 6f 6e 73 74 20 63 3d 73 5b 32 5d 2e 74 72 Data Ascii: [\s\S])/,Ke=/,([^,\}\]])(?:,([^,\}\]]))?$/,Ve=/^$\|$$/g,Fe=/^[{[]\s((?:[\w_$]+\s,?\s)+)[\]}]$/,ze=(e,t,n)=>{const s=t.match(Ie);if(!s)return;const r=e.nextSibling,i=e.parentElement,o=new Text("");i.insertBefore(o,e),i.removeChild(e);const c=s[2].tr
2024-12-13 20:21:42 UTC	1369	IN	Data Raw: 21 3d 3d 6e 7c 7c 73 3d 3d 3d 6e 29 26 26 28 73 3d 66 2c 66 2e 69 6e 73 65 72 74 28 69 2c 6e 3f 6e 2e 65 6c 3a 6f 29 29 29 2c 65 2e 75 6e 73 68 69 66 74 28 6e 3d 66 29 7d 79 3d 65 7d 65 6c 73 65 20 79 3d 62 2e 6d 61 70 28 28 65 3d 3e 24 28 65 2c 6f 29 29 29 2c 5f 3d 21 30 7d 29 29 2c 72 7d 2c 48 65 3d 28 7b 65 6c 3a 65 2c 63 74 78 3a 7b 73 63 6f 70 65 3a 7b 24 72 65 66 73 3a 74 7d 7d 2c 67 65 74 3a 6e 2c 65 66 66 65 63 74 3a 73 7d 29 3d 3e 7b 6c 65 74 20 72 3b 72 65 74 75 72 6e 20 73 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 73 3d 6e 28 29 3b 74 5b 73 5d 3d 65 2c 72 26 26 73 21 3d 3d 72 26 26 64 65 6c 65 74 65 20 74 5b 72 5d 2c 72 3d 73 7d 29 29 2c 28 29 3d 3e 7b 72 26 26 64 65 6c 65 74 65 20 74 5b 72 5d 7d 7d 2c 4a 65 3d 2f 5e 28 3f 3a 76 2d 7c 3a 7c 40 29 Data Ascii: !==n\|\|s===n)&&(s=f,f.insert(i,n?n.el:o))),e.unshift(n=f)}y=e}else y=b.map((e=>$(e,o))),_=!0})),r},He=({el:e,ctx:{scope:{$refs:t}},get:n,effect:s})=>{let r;return s((()=>{const s=n();t[s]=e,r&&s!==r&&delete t[r],r=s})),()=>{r&&delete t[r]}},Je=/^(?:v-\|:\|@)

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.11.12	49541	3.98.99.217	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 20:21:44 UTC	654	OUT	GET /favicon.ico HTTP/1.1 Host: secure.webmail-net.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://secure.webmail-net.com/pages/c3955b1c48a/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09 Accept-Encoding: br, gzip, deflate
2024-12-13 20:21:44 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 20:21:44 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Fri, 13 Dec 2024 19:49:47 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

System Behavior

Analysis Process: mono-sgen32 PID: 623, Parent PID: 537

General

Start time (UTC):	20:21:05
Start date (UTC):	13/12/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time (UTC):	20:21:05
Start date (UTC):	13/12/2024
Path:	/usr/bin/open
Arguments:	/usr/bin/open /Users/bernard/Desktop/18037.doc
File size:	105952 bytes
MD5 hash:	34bd93241fa5d2aee225941b1ca14fa4

Start time (UTC):	20:21:05
Start date (UTC):	13/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	20:21:05
Start date (UTC):	13/12/2024
Path:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
Arguments:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
File size:	39051040 bytes
MD5 hash:	46aef48e4a9c8c37f6e0cd307d120622

Start time (UTC):	20:21:24
Start date (UTC):	13/12/2024
Path:	/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
Arguments:	-
File size:	39051040 bytes
MD5 hash:	46aef48e4a9c8c37f6e0cd307d120622

Start time (UTC):	20:21:29
Start date (UTC):	13/12/2024
Path:	/bin/sh
Arguments:	sh -c open -a Safari https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	20:21:29
Start date (UTC):	13/12/2024
Path:	/usr/bin/open
Arguments:	open -a Safari https://montreal.banking-secure.net/XQUdrNkdGTUhDeUZrSUZwL2k0dFFGdVYrci9XOGNZTW9MMjVVNHcreDFkV083MVFXQThvZnNwUUROQWdkS01xU1hsQ2VYL285dDZJYVdhR25RSnhocFFqUDN2VzVjV0ZHemN1dW9TMUFsUUZweGk3QUltRUFqcU5XN0ZEUEFtVEJjTkdxb1UycnZiRTRVSk5lWk4rN2cxZldBdFNtQ0p2SXRSWTViaU1OQVByamVoUythVjROU09nPS0tbDFMWWNTK3Qrb0czWWYraC0tY1dEVGhvdXYvT3VFTTM3UE13a2NSQT09?cid=23510450
File size:	105952 bytes
MD5 hash:	34bd93241fa5d2aee225941b1ca14fa4

Start time (UTC):	20:21:29
Start date (UTC):	13/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	20:21:29
Start date (UTC):	13/12/2024
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Arguments:	/Applications/Safari.app/Contents/MacOS/Safari
File size:	27120 bytes
MD5 hash:	2dde28c2f8a38ed2701ba17a0893cbc1

Start time (UTC):	20:21:48
Start date (UTC):	13/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Analysis Process: silhouette PID: 660, Parent PID: 1

General

Start time (UTC):	20:21:48
Start date (UTC):	13/12/2024
Path:	/usr/libexec/silhouette
Arguments:	/usr/libexec/silhouette
File size:	65920 bytes
MD5 hash:	485ec1bd3cd09293e26d05f6fe464bfd

Analysis Process: xpcproxy PID: 671, Parent PID: 1

General

Start time (UTC):	20:22:01
Start date (UTC):	13/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Analysis Process: eficheck PID: 671, Parent PID: 1

General

Start time (UTC):	20:22:01
Start date (UTC):	13/12/2024
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Tactics:	Execution
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report 18037.doc

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/Users/bernard/Desktop/~$18037.doc

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontCache/systemfontmetadata.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CatalogCacheMetaData.xml

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectbronze_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgalaxy_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgold_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectlava_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectocean_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrainbowglitter_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrosegold_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectsilver_apple.jpg

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/oart.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/SurveyEventActivityStats.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/SurveyHistoryStats.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.CampaignStates.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.GovernedChannelStates.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.Settings.json

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/WebServiceCache/AllUsers/officeclient.microsoft.com/E374FC6B-36D8-3849-9109-39FD6A965902

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRF{35270E85-32B4-1341-A07A-E8F06B2445DB}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{0768DEE2-8C83-6A48-840D-449C2F450101}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{FC16ED42-F565-4842-B7AE-EE0A7466FDFC}

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20241213-1421.log

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist

/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Preferences/MSForms.exd

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/Custom Dictionary

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ar.strings

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/cs.strings

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/da.strings

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/de.strings

/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/el.strings

macOS Analysis Report
18037.doc