Edit tour

Windows Analysis Report
220-002-1.pdf

Overview

General Information

Sample name:	220-002-1.pdf
Analysis ID:	1650251
MD5:	df7fb2f5825fb520cabb89cbdd222cae
SHA1:	e07dd16d02ce49c22ad2277f4a653e1951bf3017
SHA256:	e9b600303d7192f22c47c4f97c213e83c483aab1157ff17c737b72cadf8e2abd
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected landing page (webpage, office document or email)

HTML body contains low number of good links

HTML body contains password input but no form action

IP address seen in connection with other malware

Invalid 'forgot password' link found

Javascript checks online IP of machine

Classification

×

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\220-002-1.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1616 --field-trial-handle=1576,i,4263026810805432233,14638029955789240584,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 3472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tinyurl.com/4dtdkpfn MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,3205591979190945793,5493423138147905923,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_145	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://shareddocview.com/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Adobe' is well-known and typically associated with the domain 'adobe.com'., The URL 'shareddocview.com' does not match the legitimate domain for Adobe., The domain 'shareddocview.com' does not contain any direct reference to Adobe, which is suspicious., The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic., The domain name 'shareddocview.com' is generic and could be used to impersonate various services, increasing the risk of phishing. DOM: 0.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_145, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: PDF document contains QR code
Source: https://shareddocview.com/	Joe Sandbox AI: Page contains button: 'Continue With GoDaddy' Source: '0.0.pages.csv'

Source: https://shareddocview.com/

HTTP Parser: Number of links: 0

Source: https://shareddocview.com/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://shareddocview.com/

HTTP Parser: Invalid link: Forgot password?

Source: https://shareddocview.com/

HTTP Parser: const loginmodal = document.getelementbyid('loginmodal'); const modaltitle = document.getelementbyid('modaltitle'); const logintype = document.getelementbyid('logintype'); const providerimage = document.getelementbyid('providerimage'); const providerlogo = document.getelementbyid('providerlogo'); const errormessage = document.getelementbyid('errormessage'); const passwordinput = document.getelementbyid('password');const showpasswordicon = document.getelementbyid('showpasswordicon'); const hidepasswordicon = document.getelementbyid('hidepasswordicon'); const providers = { 'godaddy': { image: 'https://static-00.iconduck.com/assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png', logo: 'https://static-00.iconduck.com/assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png' }, 'outlook': { image: 'https://upload.wikimedia.org/wikipedia/commons/thumb/d/df/microsoft_offic...

Source: https://shareddocview.com/

HTTP Parser: <input type="password" .../> found

Source: https://shareddocview.com/	HTTP Parser: No favicon
Source: https://shareddocview.com/	HTTP Parser: No favicon

Source: https://shareddocview.com/	HTTP Parser: No <meta name="author".. found
Source: https://shareddocview.com/	HTTP Parser: No <meta name="author".. found

Source: https://shareddocview.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://shareddocview.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.142.10.5:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.21.144:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.94.92:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.46.208:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.46.208:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.80.154.240:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.94.59:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.89.91:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.80.154.240:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.143.245:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.89.91:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.195.5.115:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.143.245:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.195.5.115:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 23.216.136.238 23.216.136.238
Source: Joe Sandbox View	IP Address: 208.80.154.240 208.80.154.240
Source: Joe Sandbox View	IP Address: 104.22.21.144 104.22.21.144

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /4dtdkpfn HTTP/1.1Host: tinyurl.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: shareddocview.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: cdn.tailwindcss.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png HTTP/1.1Host: static-00.iconduck.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200 HTTP/1.1Host: images.unsplash.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3.4.16 HTTP/1.1Host: cdn.tailwindcss.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200 HTTP/1.1Host: images.unsplash.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png HTTP/1.1Host: static-00.iconduck.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg HTTP/1.1Host: t4.ftcdn.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg HTTP/1.1Host: images.sampletemplates.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg HTTP/1.1Host: t4.ftcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web/image/product.template/1782/image_1024?unique=0ec9ce8 HTTP/1.1Host: www.dsaict.euConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg HTTP/1.1Host: images.sampletemplates.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: shareddocview.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://shareddocview.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web/image/product.template/1782/image_1024?unique=0ec9ce8 HTTP/1.1Host: www.dsaict.euConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: tinyurl.com
Source: global traffic	DNS traffic detected: DNS query: shareddocview.com
Source: global traffic	DNS traffic detected: DNS query: cdn.tailwindcss.com
Source: global traffic	DNS traffic detected: DNS query: images.unsplash.com
Source: global traffic	DNS traffic detected: DNS query: static-00.iconduck.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.dsaict.eu
Source: global traffic	DNS traffic detected: DNS query: t4.ftcdn.net
Source: global traffic	DNS traffic detected: DNS query: images.sampletemplates.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 27 Mar 2025 14:32:54 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_145.4.dr	String found in binary or memory: https://api.ipify.org?format=json
Source: chromecache_145.4.dr	String found in binary or memory: https://cdn.tailwindcss.com
Source: chromecache_153.4.dr	String found in binary or memory: https://evilmartians.com/chronicles/postcss-8-plugin-migration
Source: chromecache_153.4.dr	String found in binary or memory: https://github.com/browserslist/browserslist#readme
Source: chromecache_153.4.dr	String found in binary or memory: https://github.com/jonschlinkert/fill-range
Source: chromecache_153.4.dr	String found in binary or memory: https://github.com/jonschlinkert/is-number
Source: chromecache_153.4.dr	String found in binary or memory: https://github.com/micromatch/to-regex-range
Source: chromecache_153.4.dr	String found in binary or memory: https://github.com/postcss/autoprefixer#readme
Source: chromecache_145.4.dr	String found in binary or memory: https://images.sampletemplates.com/wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Vouche
Source: chromecache_145.4.dr	String found in binary or memory: https://images.unsplash.com/photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200
Source: chromecache_153.4.dr	String found in binary or memory: https://mths.be/cssesc
Source: chromecache_145.4.dr	String found in binary or memory: https://static-00.iconduck.com/assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png
Source: chromecache_145.4.dr	String found in binary or memory: https://t4.ftcdn.net/jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg
Source: chromecache_153.4.dr	String found in binary or memory: https://tailwindcss.com/docs/installation
Source: chromecache_153.4.dr	String found in binary or memory: https://twitter.com/browserslist
Source: chromecache_145.4.dr	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93p
Source: chromecache_145.4.dr	String found in binary or memory: https://www.dsaict.eu/web/image/product.template/1782/image_1024?unique=0ec9ce8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.112.233:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.142.10.5:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.21.144:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.94.92:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.46.208:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.46.208:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.80.154.240:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.94.59:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.89.91:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.80.154.240:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.143.245:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.89.91:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.195.5.115:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.110.143.245:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.195.5.115:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49734 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.winPDF@31/66@33/13

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-27 10-32-46-728.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\220-002-1.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1616 --field-trial-handle=1576,i,4263026810805432233,14638029955789240584,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tinyurl.com/4dtdkpfn
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,3205591979190945793,5493423138147905923,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1616 --field-trial-handle=1576,i,4263026810805432233,14638029955789240584,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,3205591979190945793,5493423138147905923,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 220-002-1.pdf	Initial sample: PDF keyword /JS count = 0
Source: 220-002-1.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 220-002-1.pdf

Initial sample: PDF keyword stream count = 26

Source: 220-002-1.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
220-002-1.pdf	0%	Virustotal		Browse
220-002-1.pdf	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://mths.be/cssesc	0%	Avira URL Cloud	safe
https://shareddocview.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.dsaict.eu/web/image/product.template/1782/image_1024?unique=0ec9ce8	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
n.sni.global.fastly.net	199.232.89.91	true	false		high
tinyurl.com	104.17.112.233	true	false		high
shareddocview.com	192.142.10.5	true	true		unknown
e8652.dscx.akamaiedge.net	23.216.136.238	true	false		high
dsaict.odoo.com	35.195.5.115	true	false		unknown
d72ilj4fw1mla.cloudfront.net	13.226.94.92	true	false		unknown
cdn.tailwindcss.com	104.22.21.144	true	false		high
www.google.com	142.251.40.100	true	false		high
upload.wikimedia.org	208.80.154.240	true	false		high
dualstack.com.imgix.map.fastly.net	151.101.46.208	true	false		high
images.sampletemplates.com	34.110.143.245	true	false		high
t4.ftcdn.net	unknown	unknown	false		high
x1.i.lencr.org	unknown	unknown	false		high
static-00.iconduck.com	unknown	unknown	false		high
www.dsaict.eu	unknown	unknown	false		unknown
images.unsplash.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static-00.iconduck.com/assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png	false		high
http://x1.i.lencr.org/	false		high
https://cdn.tailwindcss.com/3.4.16	false		high
https://t4.ftcdn.net/jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg	false		high
https://shareddocview.com/	true		unknown
https://tinyurl.com/4dtdkpfn	false		high
https://images.sampletemplates.com/wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg	false		high
https://cdn.tailwindcss.com/	false		high
https://shareddocview.com/favicon.ico	true	Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png	false		high
https://www.dsaict.eu/web/image/product.template/1782/image_1024?unique=0ec9ce8	false	Avira URL Cloud: safe	unknown
https://images.unsplash.com/photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.tailwindcss.com	chromecache_145.4.dr	false		high
https://github.com/jonschlinkert/fill-range	chromecache_153.4.dr	false		high
https://github.com/postcss/autoprefixer#readme	chromecache_153.4.dr	false		high
https://api.ipify.org?format=json	chromecache_145.4.dr	false		high
https://evilmartians.com/chronicles/postcss-8-plugin-migration	chromecache_153.4.dr	false		high
https://github.com/micromatch/to-regex-range	chromecache_153.4.dr	false		high
https://upload.wikimedia.org/wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93p	chromecache_145.4.dr	false		high
https://github.com/browserslist/browserslist#readme	chromecache_153.4.dr	false		high
https://tailwindcss.com/docs/installation	chromecache_153.4.dr	false		high
https://mths.be/cssesc	chromecache_153.4.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/browserslist	chromecache_153.4.dr	false		high
https://github.com/jonschlinkert/is-number	chromecache_153.4.dr	false		high
https://images.sampletemplates.com/wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Vouche	chromecache_145.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.110.143.245	images.sampletemplates.com	United States		15169	GOOGLEUS	false
23.216.136.238	e8652.dscx.akamaiedge.net	United States		7016	CCCH-3US	false
208.80.154.240	upload.wikimedia.org	United States		14907	WIKIMEDIAUS	false
199.232.89.91	n.sni.global.fastly.net	United States		54113	FASTLYUS	false
104.22.21.144	cdn.tailwindcss.com	United States		13335	CLOUDFLARENETUS	false
13.226.94.92	d72ilj4fw1mla.cloudfront.net	United States		16509	AMAZON-02US	false
142.251.40.100	www.google.com	United States		15169	GOOGLEUS	false
13.226.94.59	unknown	United States		16509	AMAZON-02US	false
192.142.10.5	shareddocview.com	South Africa		36916	X-DSL-NET1ZA	true
104.17.112.233	tinyurl.com	United States		13335	CLOUDFLARENETUS	false
151.101.46.208	dualstack.com.imgix.map.fastly.net	United States		54113	FASTLYUS	false
35.195.5.115	dsaict.odoo.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1650251
Start date and time:	2025-03-27 15:32:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	220-002-1.pdf
Detection:	MAL
Classification:	mal60.phis.winPDF@31/66@33/13
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.51.56.185, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 142.250.65.238, 142.251.40.163, 172.253.115.84, 142.250.65.174, 172.64.41.3, 162.159.61.3, 142.251.40.170, 142.250.64.74, 142.250.64.106, 142.250.72.106, 142.250.80.10, 142.250.80.42, 142.251.41.10, 172.217.165.138, 142.250.65.170, 142.250.65.202, 142.250.65.234, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.106, 142.251.40.138, 23.210.73.6, 23.210.73.5, 23.40.179.19, 23.40.179.35, 4.245.163.56, 23.203.104.175, 23.9.183.29
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, clientservices.googleapis.com, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, clients2.google.com, redirector.gvt1.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, clients.l.google.com, geo2.adobe.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:32:56	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

QR Codes

Source	URL
Screenshot	https://tinyurl.com/4dtdkpfn

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.216.136.238	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	https://www.transfernow.net/en/bld?utm_source=20250326Sb0JUtZm	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	Sjones Vacations and salaries.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	PAD_[2025-03-24_120914].pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	Ipsen USA RFP.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
208.80.154.240	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse
	https://link.bsru.ac.th/189h	Get hash	malicious	ScreenConnect Tool	Browse
	https://account.esign.us.com/documentWizard.html?Uv=4WaUN2Pkric74yNetF	Get hash	malicious	Unknown	Browse
	https://sharepointsync.zoholandingpage.com/vandpsolutions.com?PO60267SP-20-2025	Get hash	malicious	HTMLPhisher	Browse
104.22.21.144	http://loginmlcrosoftonline365.utzsnacks.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=priceandpromosupport@utzsnacks.com	Get hash	malicious	HTMLPhisher	Browse
	http://loginmlcrosoftonline365greatbear.co.uk.verifyex.com/cache/css?email=richard.moorhouse@greatbear.co.uk	Get hash	malicious	HTMLPhisher	Browse
	http://loginmlcrosoftonline365.culina.co.uk.parkettaaruhaz.hu/cache/css?email=moet@culina.co.uk	Get hash	malicious	HTMLPhisher	Browse
	https://aniwatch.lv	Get hash	malicious	Unknown	Browse
	https://ebidxs0lqgtrc1e6kmwrwew9kcjkl3nqg0ud6g8m5kilxdom6s.g8way.io/O-wpvbR0VIDe1sWempQ4ZZLhpjGlCINUUh9hHVDZnXc?email=portugal.reception@daiichi-sankyo.pt	Get hash	malicious	Unknown	Browse
	Confidential_Communication#3760_pdf.html	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://surveymars.com/q/78graAmKo	Get hash	malicious	Unknown	Browse
	https://www.pcb-cd.actor/dto/*	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1HlAGxpD0Z9EdJFVn9k8S6TIRY_SBpAZ-&export=download	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1oVYWzJi9Tw6x0zGRa8di76JxbjhDHWgd&export=download	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.tailwindcss.com	http://loginmlcrosoftonline365.utzsnacks.com.ribeiroautocapas.com.br/cgi-bin/reset/authorize?email=priceandpromosupport@utzsnacks.com	Get hash	malicious	HTMLPhisher	Browse	104.22.21.144
	https://drive.usercontent.google.com/download?id=1D-lVkrj-b014caeCIdakZBdw2yekeEO1&export=download	Get hash	malicious	HTMLPhisher	Browse	172.67.41.16
	http://loginmlcrosoftonline365greatbear.co.uk.verifyex.com/cache/css?email=richard.moorhouse@greatbear.co.uk	Get hash	malicious	HTMLPhisher	Browse	104.22.21.144
	http://loginmlcrosoftonline365.culina.co.uk.parkettaaruhaz.hu/cache/css?email=moet@culina.co.uk	Get hash	malicious	HTMLPhisher	Browse	104.22.21.144
	https://aniwatch.lv	Get hash	malicious	Unknown	Browse	104.22.21.144
	Final Contract document.html	Get hash	malicious	HTMLPhisher	Browse	104.22.20.144
	https://ebidxs0lqgtrc1e6kmwrwew9kcjkl3nqg0ud6g8m5kilxdom6s.g8way.io/O-wpvbR0VIDe1sWempQ4ZZLhpjGlCINUUh9hHVDZnXc?email=portugal.reception@daiichi-sankyo.pt	Get hash	malicious	Unknown	Browse	104.22.21.144
	Confidential_Communication#3760_pdf.html	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.22.21.144
	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	104.22.20.144
	https://fortuneurl.com/qdQgK	Get hash	malicious	Unknown	Browse	104.22.20.144
tinyurl.com	https://tinyurl.com/2ay6wm2j	Get hash	malicious	Unknown	Browse	104.17.112.233
	https://analytics.zoho.com/open-view/3062125000000006086	Get hash	malicious	Unknown	Browse	104.18.111.161
	https://analytics.zoho.com/open-view/3065751000000004143	Get hash	malicious	HTMLPhisher	Browse	104.18.111.161
	https://simplified.com/designs/cd97e327-288b-43f7-99e7-024626ab4a8c/share?utm_content=cd97e327-288b-43f7-99e7-024626ab4a8c&utm_campaign=share&utm_medium=link&utm_source=projectlinks	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.18.111.161
	https://tinyurl.com/TheVintageClub	Get hash	malicious	Unknown	Browse	104.18.111.161
	https://simplified.com/designs/7d05440c-37c6-4466-b5ff-6e61f39c0350/share?utm_content=7d05440c-37c6-4466-b5ff-6e61f39c0350&utm_campaign=share&utm_medium=link&utm_source=projectlinks	Get hash	malicious	Unknown	Browse	104.18.111.161
	Magic_V_pro_setup_stable_latest_release_version_9_709.exe	Get hash	malicious	LummaC Stealer	Browse	104.17.112.233
	Magic_V_pro_setup_stable_latest_release_version_9_709.exe	Get hash	malicious	LummaC Stealer	Browse	104.18.111.161
	plugin-newest_release_.exe	Get hash	malicious	Unknown	Browse	104.18.111.161
	plugin-newest_release_.exe	Get hash	malicious	Unknown	Browse	104.17.112.233
d72ilj4fw1mla.cloudfront.net	https://premium-subscription.app/plan	Get hash	malicious	Unknown	Browse	13.32.121.48
d72ilj4fw1mla.cloudfront.net	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	18.239.50.107
n.sni.global.fastly.net	https://ramp-com.chilipiper.com/book/me/udit-patel?k_is=opl&q_mailing_7TUwnLRio5bqoBbU1vuPzGZXCYyTNekKfvuJH=RoogEjnKYW4CjwdLKbYJ6MVnoJaR8G3pAbgmNDL3Vu3htcYomMjbucuV2&utm_id=YXNpYS5tY2xhaW5AbWFyeWxhbmQuZ292	Get hash	malicious	Unknown	Browse	151.101.1.91
	Technical Data Sheet.html	Get hash	malicious	HTMLPhisher	Browse	151.101.1.91
	https://aivptjn.top/hwujk	Get hash	malicious	Unknown	Browse	151.101.1.91
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13	Get hash	malicious	Unknown	Browse	151.101.1.91
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13&data=05%7C02%7Cteat@test.com%7Cf85134ec55e24fa0741708dd623d50ea%7C22def1f7e945453d836bda7282c42443%7C0%7C0%7C638774737677482831%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==%7C0%7C%7C%7C&sdata=AFWlQKGCYsB3szoYr99UdtJsHEuv5b0KPmvHih+dvhk=&reserved=0	Get hash	malicious	Unknown	Browse	151.101.129.91
	http://account.hrblock.com	Get hash	malicious	Unknown	Browse	151.101.129.91
	https://rightful-faithful-kettledrum.glitch.me/	Get hash	malicious	Unknown	Browse	151.101.1.91
	http://www.creditsafe.com/us/en.html	Get hash	malicious	Unknown	Browse	151.101.129.91
	http://www.creditsafe.com/de/de.html	Get hash	malicious	Unknown	Browse	151.101.1.91
	http://pixcams.com	Get hash	malicious	Unknown	Browse	151.101.1.91
e8652.dscx.akamaiedge.net	New Order_PO 354688976.pdf	Get hash	malicious	Unknown	Browse	23.197.253.105
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	https://www.transfernow.net/en/bld?utm_source=20250326Sb0JUtZm	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	Sjones Vacations and salaries.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	Helenaagri profit_sharing_plan.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.39.37.95
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	23.39.37.95
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	23.39.37.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://www.transfernow.net/dl/20250326vT4te41F	Get hash	malicious	Unknown	Browse	199.232.89.140
	http://shared.paychex.margorental.com/?email=cheo@guillevin.com	Get hash	malicious	Unknown	Browse	199.232.37.181
	https://share-na2.hsforms.com/1_i78GXFkRBOGWUyrP_Ln9g404p2v	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	2_036.pdf.js	Get hash	malicious	RMSRemoteAdmin	Browse	199.232.38.133
	2_036.pdf.js	Get hash	malicious	RMSRemoteAdmin	Browse	199.232.38.133
	Recorded_VM Condenast .html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	Julie.randall_0009641.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.109.133
	https://new-session-outlook-com-01262025-veryfing-successfuli.pages.dev/newsession?eta=dorte.moeller.jensen@rsyd.dk	Get hash	malicious	HTMLPhisher	Browse	199.232.89.229
	https://new-session-outlook-com-01262025-veryfing-successfuli.pages.dev/newsession?eta=dorte.moeller.jensen@rsyd.dk	Get hash	malicious	HTMLPhisher	Browse	199.232.89.229
	https://www.powr.io/form-builder/i/39350637#page	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	185.199.108.133
WIKIMEDIAUS	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse	208.80.154.240
	Resume_PaulBrew.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	208.80.154.240
	https://www.google.com/url?hl=en&q=https://cdn.ampproject.org/c/s/javigzyzd5.i%25c2%25Adv%25c2%25aDh%25C2%25Adq%25C2%25ADr%25c2%25ADv%25C2%25adi%25C2%25ADy%25C2%25adj%25C2%25ADn%25c2%25adm%25C2%25ADw%25C2%25ADg%25C2%25aDpd.t%25e2%2580%258Bop%25e2%2580%258B%25E2%2580%258B%25e2%2580%258B%25e2%2580%258B%25e2%2580%258B%25E2%2580%258B/DFAE8vcCa&source=gmail&ust=1743080542263000&usg=AOvVaw0suISYTiKy3FfesfseCCWZ&QdaMDkE=aRuOVhcnVYKH&ZTQfCXiVXYX=otgsMpL&PLWNVDJPNNX=ADewvYpaTSjDFd&RhGsMafBMO=xSGDuEeaSLlwr&NvqjBkgmM=CEaZCfuY&BsBjVdpOyFArX=eNEJFjz&qdoSxkAjT=RnjxPYfue&qNdMkVBua=OodidIpdNA&uBBBqmwGg=UkwVWlZEUepi&HUkFsBRwf=NETrDKaTfUalZg&hHKrWsTgkaT=jtKceaGnmawvPTx&aIjHIQdqXlSI=shSnAxjMMSooTGF&YbdULUlBQ=MnKwOgoRZmKRaS&HJGJudKEkEEFt=https://aXMTaubDmKodG&HApZzBbjT=hLmFKcWAR&dZvcqnXBHDc=ZVcThPuBmUAOTuS&QgWvGksAugGgA=aQrgeXV&QeYQHzCm=MGQSwZZpxMMl&xtemItUS=PARMRaH&PQDMqSMdnua=tXXJVJo&MBZIdQB=TqBlrXe&bfwbMC=EOVyLhg&QDJsHOXMx=nSzKyAHiRjbR	Get hash	malicious	Unknown	Browse	208.80.154.232
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	208.80.154.240
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	208.80.154.240
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	208.80.154.240
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	208.80.154.240
	Legal_Notice_Presentation.pptx	Get hash	malicious	HTMLPhisher	Browse	208.80.154.240
	https://link.bsru.ac.th/189h	Get hash	malicious	ScreenConnect Tool	Browse	208.80.154.240
	1 (325).exe	Get hash	malicious	Unknown	Browse	208.80.154.224
AMAZON-02US	https://www.transfernow.net/dl/20250326vT4te41F	Get hash	malicious	Unknown	Browse	13.216.34.24
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	http://gitmeidlaw.com/	Get hash	malicious	Unknown	Browse	13.33.252.122
	https://www.canva.com/design/DAGiRhhTm_M/1Wb1338QF_BEv0zYs4WfZQ/view?utm_content=DAGiRhhTm_M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h6159cd66cf&umid=b05be093-6f53-49ec-8a3b-87bea166f93e&auth=5175c0148660b71d9cf40f5d2581457ec88fc189-b6bc2ea861a256fc841ad8d60030f2289750b83	Get hash	malicious	HTMLPhisher	Browse	13.35.93.29
	SecuriteInfo.com.Linux.Mirai.4306.30063.19032.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	https://www.oyabarista.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPU5ITnVVMmM9JnVpZD1VU0VSMDQwMzIwMjVVMjkwMzA0MDM=N0123Ninfo@kostal.com	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	3.168.73.27
	SecuriteInfo.com.FileRepMalware.2065.17794.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	SecuriteInfo.com.Linux.Mirai.2522.5402.17083.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Recorded_VM Condenast .html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	52.85.61.3
	https://www.transfernow.net/dl/20250325kZqYjGlX	Get hash	malicious	Unknown	Browse	13.249.91.92
CLOUDFLARENETUS	https://check.quzis.icu/gkcxv.google	Get hash	malicious	Unknown	Browse	104.21.40.149
	https://www.transfernow.net/dl/20250326vT4te41F	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://claimnoticesocialforge.vercel.app/get_help	Get hash	malicious	HTMLPhisher	Browse	104.26.4.15
	rmIdpiWsXI.js	Get hash	malicious	Unknown	Browse	104.21.58.199
	zSjyEmpa6c.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	104.26.8.44
	rmIdpiWsXI.js	Get hash	malicious	Unknown	Browse	172.67.207.96
	WQ0v1rV60l.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.69.226
	444RjkSg7B.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.69.226
	2okKzrss3B.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.69.226
	VqCFT0EOku.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	172.67.69.226
CCCH-3US	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.DownLoader45.42287.31043.2783.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	SecuriteInfo.com.Trojan.MulDrop23.34226.30868.14577.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	https://www.transfernow.net/en/bld?utm_source=20250326Sb0JUtZm	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	Sjones Vacations and salaries.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	DanielEmployee-Handbook-84408.doc	Get hash	malicious	Gabagool	Browse	23.216.132.53
	PAD_[2025-03-24_120914].pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.136.238
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	23.216.132.80
	00583_QB_Payment_Statemnt53T.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.132.21

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.161708502836722
Encrypted:	false
SSDEEP:	6:iOoIM+P3O+q2PRN2nKuAl9OmbnIFUtGIM+P1LWZmwkIM+P1OVkwORN2nKuAl9Omt:7VM+PO+vaHAahFUtfM+0/BM+UV5JHAae
MD5:	CF8391FEF7C53052DDE6BDE4AECA63FA
SHA1:	8FC6F6D3E138E0E2B9B47C01F593AFE68B87C69E
SHA-256:	1BCCA20C507528E0D453EA54628C8592807E1DC574955CA0599C4CE0403A4130
SHA-512:	3C77BBAB66AC007B34CB4450DE858F44FEE372050A05245F520CB2004BC6765226AFBA4D551215A2236DCAEE08913955077E5A8543F653DE7BE4B150E747142E
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.245 f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/27-10:32:45.247 f0c Recovering log #3.2025/03/27-10:32:45.247 f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.161708502836722
Encrypted:	false
SSDEEP:	6:iOoIM+P3O+q2PRN2nKuAl9OmbnIFUtGIM+P1LWZmwkIM+P1OVkwORN2nKuAl9Omt:7VM+PO+vaHAahFUtfM+0/BM+UV5JHAae
MD5:	CF8391FEF7C53052DDE6BDE4AECA63FA
SHA1:	8FC6F6D3E138E0E2B9B47C01F593AFE68B87C69E
SHA-256:	1BCCA20C507528E0D453EA54628C8592807E1DC574955CA0599C4CE0403A4130
SHA-512:	3C77BBAB66AC007B34CB4450DE858F44FEE372050A05245F520CB2004BC6765226AFBA4D551215A2236DCAEE08913955077E5A8543F653DE7BE4B150E747142E
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.245 f0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/27-10:32:45.247 f0c Recovering log #3.2025/03/27-10:32:45.247 f0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199752374914153
Encrypted:	false
SSDEEP:	6:iOoIM+P1QKG3+q2PRN2nKuAl9Ombzo2jMGIFUtGIM+P1YQWZmwkIM+P1YnVkwORn:7VM+iKG3+vaHAa8uFUtfM+CQW/BM+Cni
MD5:	A737B114EA40D692EC9A52210C80F185
SHA1:	B1809E47922CBB06E059FADA28CC8FB85B054E4D
SHA-256:	8674BCA819DD802C7CCBC96DBE052F96FA1EA1041D2B57F6B567811F61D84BE6
SHA-512:	8433AA0D8F68F45B17F2B27A5E0D9AB5E3338DE2AE2AF20123497612A934C614D3F36B171DE6F091185000DD92417F4B3BBD9D664F10A7E63DFCD699117C2020
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.158 195c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/27-10:32:45.161 195c Recovering log #3.2025/03/27-10:32:45.161 195c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199752374914153
Encrypted:	false
SSDEEP:	6:iOoIM+P1QKG3+q2PRN2nKuAl9Ombzo2jMGIFUtGIM+P1YQWZmwkIM+P1YnVkwORn:7VM+iKG3+vaHAa8uFUtfM+CQW/BM+Cni
MD5:	A737B114EA40D692EC9A52210C80F185
SHA1:	B1809E47922CBB06E059FADA28CC8FB85B054E4D
SHA-256:	8674BCA819DD802C7CCBC96DBE052F96FA1EA1041D2B57F6B567811F61D84BE6
SHA-512:	8433AA0D8F68F45B17F2B27A5E0D9AB5E3338DE2AE2AF20123497612A934C614D3F36B171DE6F091185000DD92417F4B3BBD9D664F10A7E63DFCD699117C2020
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.158 195c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/03/27-10:32:45.161 195c Recovering log #3.2025/03/27-10:32:45.161 195c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235960474836905
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xeHovCWx:OLT0bTIeYa51Ogu/0OZARBT8kN88Hovz
MD5:	46332D13A7DEFB9334769358484C37F1
SHA1:	EAE110BB1DF28F652BFE42A2328D582491FC8812
SHA-256:	BA700C677824CE5E98DB9C0A0A7452D9A5AF89FAFF2D9A68240C8DACF8FD67FB
SHA-512:	CF4C8A319786F7BD90119DA65DEB8BC29A53FBB8A29C60A6306B234EB5450E10DAF3E49CFCF840E920B3140FA55F857073AC5E37C02085D1AD2C33D6E42685EF
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.208320041143691
Encrypted:	false
SSDEEP:	6:iOoIM+PVqG3+q2PRN2nKuAl9OmbzNMxIFUtGIM+PMQXWZmwkIM+P/nVkwORN2nKA:7VM+tqG3+vaHAa8jFUtfM+0QXW/BM+nN
MD5:	DF0126BA83B11015304B2050A177EBFD
SHA1:	A95E8349B2993C33E9776DEA319DA61B2D55EFB1
SHA-256:	95E0DCC624FF1748A3BF7CA2AF5143F33BF2A4C19C322905BBB580E11F43E688
SHA-512:	F0210AE730B83B946AA6A8E2F381D31A62A64979D0BCEE37062194CB1265B041E33B3318D3E0BC932442457A360B28034163118D03113FA152B83EFEEE743227
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.278 195c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/27-10:32:45.279 195c Recovering log #3.2025/03/27-10:32:45.281 195c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.208320041143691
Encrypted:	false
SSDEEP:	6:iOoIM+PVqG3+q2PRN2nKuAl9OmbzNMxIFUtGIM+PMQXWZmwkIM+P/nVkwORN2nKA:7VM+tqG3+vaHAa8jFUtfM+0QXW/BM+nN
MD5:	DF0126BA83B11015304B2050A177EBFD
SHA1:	A95E8349B2993C33E9776DEA319DA61B2D55EFB1
SHA-256:	95E0DCC624FF1748A3BF7CA2AF5143F33BF2A4C19C322905BBB580E11F43E688
SHA-512:	F0210AE730B83B946AA6A8E2F381D31A62A64979D0BCEE37062194CB1265B041E33B3318D3E0BC932442457A360B28034163118D03113FA152B83EFEEE743227
Malicious:	false
Reputation:	low
Preview:	2025/03/27-10:32:45.278 195c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/03/27-10:32:45.279 195c Recovering log #3.2025/03/27-10:32:45.281 195c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250327143248Z-171.bmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.304933540438955
Encrypted:	false
SSDEEP:	96:uEA4NVB/J9sOHSd/LHUBPBAbiePVdtDIc/v0k7AbeQ0+x6Inhyj:iiYUHAbiePtDf0FbeQDlU
MD5:	E81F2839A002496511B5ACF3C92D29A9
SHA1:	C607393D494CE3CC93A4B9D47942D074C1343ECF
SHA-256:	3B80993EC3C86C93E6D89791AA0EAE2DF5EB04C93FF8EF80DFA569689BA41CB9
SHA-512:	AF3DE909457483A374AC4EAC2C9211BEE09CAF7F209C5DEF1FD33A69F10418AD598B11B5947D0D4C59A6A5D9AC1179690474D85711939BF253B4209254632D58
Malicious:	false
Reputation:	low
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2144631780419755
Encrypted:	false
SSDEEP:	24:7+tuJqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zf:7MUqLmFTIF3XmHjBoGGR+jMz+LhK
MD5:	76E0D9E2B4E42A6FA14945B0F35F77B2
SHA1:	0F5ACCA05CD0DA9C1564C6F834B6E15BCE71B24A
SHA-256:	31B78E530677B2484831329ADD780AD96D93B304DE34FA119F402F60C4F366E4
SHA-512:	073EC1EA83C72C95CAD06FF67E2FD45CBE5E3FB068DBD6C76BCE80E1B1823E087AD9B7B33B2D25F7F482C4D5EC968DD90092519290DD795D55136279195FF413
Malicious:	false
Preview:	.... .c......d..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	73305
Entropy (8bit):	7.996028107841645
Encrypted:	true
SSDEEP:	1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
MD5:	83142242E97B8953C386F988AA694E4A
SHA1:	833ED12FC15B356136DCDD27C61A50F59C5C7D50
SHA-256:	D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
SHA-512:	BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
Malicious:	false
Preview:	MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH..M.KB."..rK.RQ..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j\|w...#.oU..Eq[..P..^..~.V...;..m...I\|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.\|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7895108629891827
Encrypted:	false
SSDEEP:	3:kkFkl/bONl/tfllXlE/HT8k2Vkz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKqiteT8mrTNMa8RdWBwRd
MD5:	9390F7E4C534F0A9F67584B44086B862
SHA1:	1F19740CC73F02EB3B6E754DFC7BDD88370C754C
SHA-256:	5E715A8A5E77A89F0A84D622B3DE4ECEF5C70DB5C01C54FB0DB89CF5316326A5
SHA-512:	D760C481FEDC95E93B75D650B5EF4E4CC8C6D8DF15642A7FA83D4BC090CC9551180E781CDDC02FC45049E75A35F0F94D03569BA310DAE3BF5E7BA79F92589908
Malicious:	false
Preview:	p...... ...........!%...(....................................................... ..........W.....0..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.1836515609579115
Encrypted:	false
SSDEEP:	6:kKOtImcvSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:CImCkPlE99SNxAhUeq8S
MD5:	767637DB2E30F7159DA0289BC7F1674C
SHA1:	482D47723D480FC636EB28C6A6E144426CD3F53F
SHA-256:	E7FEEB04A5E2B40F064AE8D9F8E71FA9709B5E938858F1F394B7339BDCA882C6
SHA-512:	124E90802EEF8C87244B786E63568C81F2A0A7A418060892C1E2B196D3873037C934E67802B618B92A0B26211C3F2D0F47B3A88E38C0422730F340998C1B70CA
Malicious:	false
Preview:	p...... ........'..E%...(....................................................... ..................(...........Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.38126409860411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJM3g98kUwPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGMbLUkee9
MD5:	0C6636EE337FD825BDBEA0898E4A7D4E
SHA1:	D915AF8FFAF3CB28818090459B6CD29347B4161A
SHA-256:	0369052B039F08E8541923A69D0B8C972CE6F493E4531F092063675A7E6F796F
SHA-512:	584DD2E33BC79ABCA84C37805CC41949ACC84FDBB33E75431DEBB096611A9BC2CB37B3E82F13EC2784E537F1D1E400EDC0BECCC3ED117B0C5F32C5F41CE0D9D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.330039061170491
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfBoTfXpnrPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGWTfXcUkee9
MD5:	8F8D8744AF1C6D5FBEE82FC51BFBE583
SHA1:	D3F78731AD68BD2B5B11EF01FD3306E521747BF3
SHA-256:	7B44811FD735560F0A88AF9451A5ED36487AB8B365EDA7EF4892156CAD580AC3
SHA-512:	F526167B456AD4A12EB00EEA2D016FAAD935D678E8DA0E89FF95D420B9C7B079F16B028274B1E0987A3EADD0E2199B72214949A36B57CF04A660B6D1F76A35D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308298556528299
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfBD2G6UpnrPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGR22cUkee9
MD5:	1C7AE9D9B149B49316E4B3C8FEE0EB69
SHA1:	66644570E1FF74BF1C91BFC7E52D7BB2CC37EDCF
SHA-256:	E2AF5B1C6CA6F218E61F7B47FBBC2D283AB871BA8C7E3B4BE3276DE50512CEE2
SHA-512:	AE8180CFF30D744528070F2373FFC16BF2D883B0CFFCE6569EB69EACDD80EA13B3FF27A01B1A92B7845BCB0804B71A7159D5C9D3D4B4CB0B25218CBB7F72B8D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3702723825130665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfPmwrPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGH56Ukee9
MD5:	D0BBF075288EFC6BC03855635C6CF6DD
SHA1:	07BF3E2A2A8F85A0B3167203C885B2CD0ADF23A5
SHA-256:	4582BCB1BD3C2FEEA04F0E07676F5712F1106F3BFE87EEAE854AFECC414674E8
SHA-512:	BC949FC6FA3F51E833478B9AB1795DB7FF00A828EF9083A1C50A447173B4B3A4A8FCF383E21E54B76CBBC082EC9378A81442D7944CE8D531A91E21B90126034C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2129
Entropy (8bit):	5.840809104722304
Encrypted:	false
SSDEEP:	48:YvKPU4+hgly48Y/TWCjiOumNcXwKOpkUI:GKPUPgA45/TfZumcO0
MD5:	E3AE7973EE035782D7F874453F572290
SHA1:	E7F23AA1987858D8429DA28B4C1BBACD421EC545
SHA-256:	B0DC2EE6FD133C4EC4B06EF24C43B5DC79AF2065AA894C66352FD3F0912D36B9
SHA-512:	00C5908516942D0AE28F2FDC83A0040B7505CA7F283B2A55A38A523B9251E3CDDB94BDE2D1C25C23254A053E7DFBF411EFBD150EF650053C090E98EE2A8C8BF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_1","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"5a9d1955-ab74-4b89-837a-074b702313c0","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2NvbnZlcnQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRXhwb3J0IFBERnMgdG8gTWljcm9zb2Z0IFdvcmQgYW5kIEV4Y2VsLiIsImN0YUxhYmVsIjpudWxsLCJjdGFCZWhhdmlvciI6bnVsbCwiY3RhVXJsIjpudWxsLCJjdGFVcmxUeXBlIjpudWxsLC

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319269160306781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJf8dPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGU8Ukee9
MD5:	8BA5DF6DDE7468623EB79FDFC326E0B1
SHA1:	35277F40F37D82DCFFA4795B174DC1C86760DB88
SHA-256:	B760167824954EEDB92CE87AF284DEDBB52D62286248BD770AB0D1B1F76892F1
SHA-512:	B3737B3E2E8C0A30A3AD5905EAF5AC61F74DB176F741D339CA12B1759A10E360C4BA012424C8CC888DDD0A41EA6628326DA704746EDFC391B3D7C81BA6267917
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.322014241019916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfQ1rPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGY16Ukee9
MD5:	BA586F98C9CA8D92FABCF84FFC48E7DB
SHA1:	0A9EE083077619EF3EE9F55890C206B1D59DD571
SHA-256:	15D05A4D55489D6000884029B5A14F27CF4B326B4C25DA9A7BD5B56452576C1A
SHA-512:	6319C488D8108EEB8716153FD65AF27F6AC7096194B7E500F3FB6796EA2A3C9F0DB32C666F12E32EDE13D44B21624DED0461049687A3DA83F6DCD3F2A111D50E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	5.826002978240724
Encrypted:	false
SSDEEP:	48:YvKPU4togbN48l/GiyLVzyODVHKOkQLcSmjWAI:GKPUng54Y/IVO48OkQASmg
MD5:	8F762DF09C0150A164F495687AAEF9CB
SHA1:	1C9661988F51208580E5BC19875094D87D0ABB66
SHA-256:	4E77D1F0AA886151C26FFE1AAFAD1B49B97083273C438A16C4E569175DDD8677
SHA-512:	366897369FF1013A959B17AA0E0639BFE1DF2991C6CF6FB711D66851535F4C944251CD56EE6B953565B2341E51B11F28BCE3DE2A5E5FE2A4B66137BB003ABBC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_2","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"164bf29d-ee04-491c-adf2-c0bfeedb2d1b","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL2VkaXQiLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjpudWxsLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6bnVsbCwiX21ldGFkYXRhIjp7InN0cmluZ01ldGFkYXRhIjp

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344684229113811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfzdPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGb8Ukee9
MD5:	E1B089BEC52F08143780DE6343CAF55F
SHA1:	01E8D158E6C415B76F52972A6F5C40898417D3B5
SHA-256:	E998F2D6770DD719B7A3D6B7F715E5137BB99B0F52E7626B8A80056C14946536
SHA-512:	72B0001CFF44D40C90B804EEF3CCFC5AFC419AD1144C37ABF32C6B86A3CD404518AADCEDF53301B3098B434A90FD9A8CD303B1453551A50465650BA40431F673
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.325853659254873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfYdPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGg8Ukee9
MD5:	F4FB84064ABD38BED66DC1C12EDB1875
SHA1:	62B4C0D42FE488B27C3879E6882BA80AF6A5A658
SHA-256:	A9333817E6A7737AE83E9164297FA628D00DA61039AAF74606263CEDB147DA8F
SHA-512:	223883384128C119322831F4B56CD0444664E5B79053DFB1D18A9179E983C2834235FE8D0AA34AFEC999FF609B41FA399F67C1F57151793AA47B9EE8AB2ADE64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.31235920213505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJf+dPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZG28Ukee9
MD5:	242726DFC30EA78316F2EC2FA0A7E15D
SHA1:	BFA18B32A8737F1CACCA6822184CA9945DAA8109
SHA-256:	F263E0EAE1C9681CD02403575CC0FA4E80D7235579D72A8B8CCA93084D8D2AD5
SHA-512:	7B6B239DBCE31D4A49B38B60B7A346875F32300C334108A01E0E7293326DDB57A59B7F5CB4378B3575FB5D0E25159D486632DB13EE0E3D138C0F45FB7769F7FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.309223068548978
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfbPtdPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGDV8Ukee9
MD5:	A8A3A648E09A78B6513246031C5B5C98
SHA1:	A7989DD9535B9B953D9CED4B4E67CECA244FAFFB
SHA-256:	029CA70F0BA96491847BD60138F7B8FD7542418E6DC49A2214C5861C9404F1E2
SHA-512:	EEC4F44ABDF57BEAEA4B32F09B8DEA7E0211088FF3BE98A5B1C6B452FA2CC4ECF816302952BE8D079B338965E5B7A1DEE2E40D5218BD9F44AAAC5972D91B4B5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3129622421151685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJf21rPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZG+16Ukee9
MD5:	9C3B3A74C5F3E42D7696215711A59DF1
SHA1:	8D4FCAB938EF31904EA84EC466EA90109841327D
SHA-256:	28D147FF40E28A1E3175E0D86BD3E72EAB555138D588085412A84A87B2DBD76C
SHA-512:	61174720FFFC6D28BF38C0B81E2CFB15E29422884A142EA666E87660A7B2DCD7B3D535615EB6FCC3817156DDB3EA80F48EA12160C351B1ACC2ADE59807D29A6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2028
Entropy (8bit):	5.840440358154059
Encrypted:	false
SSDEEP:	24:Yv6XbtXEgU4iamXayLgEdycgNaLcR84bqerISIQ1iyLPZYMWD8W3V1LFnU6QHlOM:YvKPU48BgBG48j/SiyLVWOAlNkUI
MD5:	65D19DD0ED15C024CABF6512827802D5
SHA1:	66D91CA3AB38456939580A3EA9C9B9F5F48D0B68
SHA-256:	9E67D028389544A4A95A7302835D0350C160E09AF7F7F9CF021CA50BB6DDC23F
SHA-512:	D694774964394DF0B18E102BC68EB20EEE70ACAB441867A562BB96829924D75A912588F2CD03B916238F9A212B229B810EA4CCC92FAD107AC43B97F066A13AF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"102656_316349ActionBlock_0","campaignId":102656,"containerId":"1","controlGroupId":"","treatmentId":"339c0ba6-2e61-4622-82f6-f07787d206b8","variationId":"316349"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJkYXRhIjp7ImxocFYyQnlQYXRoIjp7Iml0ZW0iOnsiX3BhdGgiOiIvY29udGVudC9kYW0vYWNyb2JhdGRlc2t0b3AvZ3Jvd3RoL3JlYWRlci9lbi11cy9saHAtYmFubmVyL3YyL3NpZ24iLCJfdmFyaWF0aW9uIjoicmdzMDM2MS0wIiwidGl0bGUiOm51bGwsImRlc2NyaXB0aW9uIjoiRWFzaWx5IGZpbGwgYW5kIHNpZ24gUERGcy4iLCJjdGFMYWJlbCI6bnVsbCwiY3RhQmVoYXZpb3IiOm51bGwsImN0YVVybCI6bnVsbCwiY3RhVXJsVHlwZSI6bnVsbCwidHJhY2tpbmdJZCI6bnVsbCwiX21ldGF

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.289408987829289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJfshHHrPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGUUUkee9
MD5:	1DCF74AA62C0E79E475CEE7F65792090
SHA1:	B42E676CA80266276652EA0BA5677F809281D66D
SHA-256:	E29B52D7735A2DAAA5D6C6512A0D9FBBC0124E65F659149948FB86317E2D2AA1
SHA-512:	3A7DEDE46BF6510A51CBE0AA695814033703FECF29342E5FF2107A265333B762C1BF8E9AD44129D74D2AF366A1EBE33989892BFBFF979131DC0FDE739652161B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29926463730937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbILMd1TI55IRR4UhUR0Y4FqoAvJTqgFCrPeUkwRe9:YvXKXbIQXTI5WRuUhU4ZGTq16Ukee9
MD5:	6B6DE78F0D45187AC0DF668C26246C2B
SHA1:	BCBD8001BADC362EA59A3134F49CDB726253FC02
SHA-256:	29F327F8EBD02DEA8C81BC6F430AD701D8F8D8EDEF22BD6D14D56BE1EF3A92D6
SHA-512:	78B9BE05EC5C4C48381EA05E01BF72A5233DAEBD529019C9121F4BC7DE48CC0B209A5578C827154CFD8B08E2FB0CB0C849616406440DA4A3DC41D6BA40CD09B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5694a0c6-d88f-4e10-846f-b963351ac7b2","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1743261199531,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	5.141034632040316
Encrypted:	false
SSDEEP:	24:YyFmGa1aydvs6vObrpNJxMNpbyXxmDN7RPjOxcj0SDfQ7ACqC27M72LSD5Co7LCI:YyaOBYcqbCurwR7nVqhaGhc9B
MD5:	2528D0FC6B8D80F8740EBF4213A489F3
SHA1:	6FFA398B31E1A2E12B23AC5E0E2091526CD9E744
SHA-256:	1049D4BBE90115A4D15A306863313E7AB2E33CEDC8B66FB412ADA77F80BE8E9A
SHA-512:	D3186B0086D2AABD6CBD8BFCC59BBC5A79677D4C14CE730ED63A5D0A722848357A248E13D1CFB52EA7231E64E02D1442AA51AE792D40E882ABE29231E1258057
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a00d83066248c48383adffbf14fbb98f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1743085969000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1a7afbd0487d4f70993e127357422e3c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":2028,"ts":1743085969000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e6b8d18cede689223353162a3a2ec121","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":2129,"ts":1743085969000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"2a3f2489f9de4e004e7d933d58390bf9","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2080,"ts":1743085969000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c016c207c2cbb6ce8a83d8e3a3d55d51","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1743085969000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"401c3457b7ed0c48273516e09fb4bf2b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file",

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9881226205827902
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6Qe2jfIcLESiAie+jfF:TVl2GL7ms67YXtr2jQcI8Cjt
MD5:	D59A00E3F5097FD3BD9BE6A060E4F63C
SHA1:	C1DE13BE1E2521F1477F47A009D7CC9C8865BA97
SHA-256:	351B1BF79D2132DE672032D478F22F4F79AA83D26EBA3C043CA331927EFAE234
SHA-512:	DE036DC7B0C5755DECEDCC8A0129F181ED55A8959C2CFB580E08F70F3C89865CA19449360E3994A199E58858C8740690BEAD4421B44CE4F1A4C490533F0CD0EE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3428933405671208
Encrypted:	false
SSDEEP:	24:7+t1ASY9QmQ6Qe2jf7cLESiAi0mY9QapqLBx/XYKQvGJF7ursyF:7M1lYXtr2jTcI8KYhpqll2GL7msC
MD5:	B09EE218484F74E42E8624D76F83A418
SHA1:	C6152318642B12ED867DE953B2EE82CDF62867E5
SHA-256:	16A4D67F5DB3D3C930D69C614A514EE59252F996D8EF62C3DCE1362F786829CB
SHA-512:	486ECF6B14A5BAF0882CF8A9102E395BFDD2588A8683F914E9C04CB23EF2F83FAFAE4EC23087DB5345BED4B72E4894180711388A74B9899437367F56E63A9A0E
Malicious:	false
Preview:	.... .c.....I........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSId492a.LOG

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505475641302283
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K82lEdNcNQlaCH:Qw946cPbiOxDlbYnuRKecClaCH
MD5:	38BD6D34B98D34555412A8688EC8A246
SHA1:	95FB2293F066CFDF3560577AAB9B1FC7C0841359
SHA-256:	E6470B11E30A13E0E79BDB57D1A7994BE56ADD73556203798C0C3922E00D86EF
SHA-512:	A5ABD0EEE4C506178649BDC93EB449A2A67496AB6DD9E446F75285503B034CC747A257F2868EF5B065311A4ADD924113DCE2C72AE983284D6CA32E9C10021812
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.7./.0.3./.2.0.2.5. . .1.0.:.3.2.:.5.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-27 10-32-46-728.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.389740994679852
Encrypted:	false
SSDEEP:	384:zHh2p6hxgJUCk3KZc/4VmIa7ncYtUtZeP4OCUIU3QGY/ZTFm01QO0h0144bs+LDA:tTP
MD5:	EA786C370C0715F38A6B5B3B292DA924
SHA1:	E741B175689BDEA4AB43A7E38DA70F8319755575
SHA-256:	1FA5E653F1526CE31D6021DA4C82C7D19D678591EFDCF9FE1D33ED085EAEE942
SHA-512:	CD1FBA4EA8EC55AE8B8C41E5B82EAE7F7BAED39CC2562668827AEDB16AB62DCD1B921DE90FB6EECE4E8B5C9C8CC003AA612C4F979B6989AB4C3324D05E6BDD26
Malicious:	false
Preview:	SessionID=b7ba8705-6319-41cb-a37f-1dde9fa56ffc.1743085966744 Timestamp=2025-03-27T10:32:46:744-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b7ba8705-6319-41cb-a37f-1dde9fa56ffc.1743085966744 Timestamp=2025-03-27T10:32:46:758-0400 ThreadID=7164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b7ba8705-6319-41cb-a37f-1dde9fa56ffc.1743085966744 Timestamp=2025-03-27T10:32:46:758-0400 ThreadID=7164 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b7ba8705-6319-41cb-a37f-1dde9fa56ffc.1743085966744 Timestamp=2025-03-27T10:32:46:758-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b7ba8705-6319-41cb-a37f-1dde9fa56ffc.1743085966744 Timestamp=2025-03-27T10:32:46:758-0400 ThreadID=7164 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.422334015744686
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbY7cbwIT4CQkk0VBcb6aX:fhWlA/TVET4CQkk0V7aX
MD5:	5BBF2351D233C827BC96E73692B402EC
SHA1:	EF4EB974F9F88A90B66CF3049C97F4A7410E4982
SHA-256:	4CF3EB96A1A5BC9F3EE40279EC9264DDC1EE3DB6B89D127B7F76ECEB15BAC942
SHA-512:	8CDA09B662FE27FCD9E255170B5EBD0E7066EEF398C9D5B4C7BAA9B2AFB29C2D73CCD0BB7034CA2BD7245CEDFC9F24A36BDC4416213FF0475EF8520501BB2D91
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\209ae314-59f5-4023-87b2-fb2a7c5c807d.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8f90a5b8-5f5d-40af-8fe8-6e6645f09e6f.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e1fb1780-4233-433a-bbf5-98b7c76854b6.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:NDA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	6B9C5F026987A4C6A402B442B613E46F
SHA1:	53B45C73D714A93A26A5BCB25C37BE7CCB94AFCE
SHA-256:	2D90C694412A22FD0E0EEF638F9F34BF6B8C55D98AD2DA3CB8932ECA361EC9CF
SHA-512:	2545211D5A9686FC31C4E26CC3D9FCF01F235A30BAEA7579151D187937C69AC40091510D2A14D5B008895A24969116B012EB5BD3E63608BF256A955875023119
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f628ca62-0310-457d-bd07-be0b6b906329.tmp

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x0WL07oXGZuwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxXGZuwZGM3mlind9i4ufFXpAXkru
MD5:	E1FE9FA2454D30CD849F2060D8FED227
SHA1:	5B5A33E386D7A2254DB5934F688C1F1A72A9D6C9
SHA-256:	4B0AD0558FB8C3D63817011FCA33E51A9E9C46A91407B705C4E5150AE4E5A3E4
SHA-512:	C81A8B39C571531DC52A71E34188D3C95797B69E82A74896019723E0217A00D58367118886DDEEEC4AEAAF8A80931BA22459104847E2B0D8A77070BFEE3BE7F1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

Chrome Cache Entry: 142

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	5475
Entropy (8bit):	7.409504987552427
Encrypted:	false
SSDEEP:	96:+0jN85N26MT0D5MdtbZPAVwzVHlMtOc7P9JAw5cbTe8/WkoXKUE:+0B8oYNMtKw/MQpOcbTJ/W6
MD5:	7FCA0EA1EA2B34C5DB2BA15AB8348ED7
SHA1:	FA11141776B5D9539E6CFF2AF8D60643EBA83404
SHA-256:	A0350E27B23A566077B1BE2AF7E2C18AEFE9ADBF2B2A1A44DA25B918575052E2
SHA-512:	130D4BBAD08356F547CE93EACAF8BB04331E95F8C9E9D20AD8D4362F6C0F1153D940A29447CBE0743D551735FCFF8A2F1B17BDF788B572F557B598D08B551D99
Malicious:	false
URL:	https://images.unsplash.com/photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200
Preview:	... ftypavif....avifmif1miafMA1B...Gmeta.......(hdlr........pict............libavif.....pitm..........iloc....D............o.......(iinf..........infe........av01Color.....iprp....ipco....ispe................pixi............av1C.......Tcolrprof...HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour spa

Chrome Cache Entry: 143

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1101 x 1025, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	56818
Entropy (8bit):	7.836165728169892
Encrypted:	false
SSDEEP:	1536:Rs207d+HudYuW/DuKNwFfgsBwWXB80XZx9ZS1Qs0G2:y57d+Hud2/DuKWFfgSX6KZx96H0P
MD5:	056D663D8BDC5341C8746EA98AE457F5
SHA1:	7D8AB85FA6FB6729407C088AB4E0CB8D88FDBD27
SHA-256:	7CB58082A0ECD8B738A003E18C4DCFBA24D64D333D2EBBB74B036A3EA571B39B
SHA-512:	6D14DE8BEE0ABFE7A9D45F5C661F11CDC358C3804978C01EC82B9D28683A828586785ADD5FDF9A6520AFFF0982076E5AFA77B857215FAEC19B2D02EBD43718DA
Malicious:	false
Preview:	.PNG........IHDR...M...........t6....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....+..@,.....IDATx...w..W}....no.JZ..w..m\h.`L.C0....n.{./.o..M....=.W.!.wLq...dui{...9.?$.Y.J.2.....x......9sf.g.{.g....s...5s.....".GF]...#uJ......p....G.02.2...6r.se.V..../..........pa.u./W/..g..:........w2.q-..D............[~..u.[.G.J:].K.... dF.]....Y}^.....d..M.`.^}m&..z..s..y..b....{x.~).K...o...f....B....._....^.H..i...........{n.c..K&..!4...x...L[.%..d..!.....~...^..GYy2s.&.p..w...2.IZNo... .1..9.Ok.y....z....#x...gr.....t..........d.O?.;.q.n..<M..?z..\|XR;.....Dr4j........c.z]....7....>&.......H..kn.M...G."4.......W.Nr.Ig... M..j.{.>....?p.....o...2^..........6f......E......H..;~r.q..%u.....H-.V..n.m?.E.....H..;~t.....".....(#G...b....H...~.V..+.r..........\|.}......,.t~...G/...%e.......#.7..._Mk....H..?~.............yn.3.......H...pYF.............9...M[.i. =...+.{"0....f.+..w..k...pB.....v...N.'.....1F.gF.>..v.=.@d

Chrome Cache Entry: 144

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 440, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	83561
Entropy (8bit):	7.983546920758055
Encrypted:	false
SSDEEP:	1536:RzyfzHlyoNRPG/54f4zgQETOQwjy6MPrMejkQpa4bO2p4Z:FybHLhC54f4GSyh746a4bd4Z
MD5:	851C44C50AB72E4B72344DC10E76991E
SHA1:	EF4823DC88BCB42C4A7949CADAC2EAB7A5AC6F57
SHA-256:	6B67E72CB7B9EEA8995A61976249284EB949DB79C28AFA921FBAFF881FC1BD6B
SHA-512:	CC1C91BE1005F90D849B7147AAEE3BC0987E5D0D9137F87EAC1D40E6534F1C0F424FA2A1938C911BB8AE69A2392FBAC489A0578003AA680276B4A50441B4EABE
Malicious:	false
Preview:	.PNG........IHDR.............k@......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...,IU>.=.....%..E......(.....(.T.D...........A...........dV..X$nz...9......Pu........7.u.....'.TM...6.&..x.S..e...&....m..kf..A.....o..n.5.-(..7.hk...M.4]sH.6..i)%.i...i...J.nf..M...T...K..!.....K.m{.'_v.9i.&...........g.\s...;7..vD.E.....pg..oI..-...T...(....^.... .......z.E./#.yTo'.4.N'....r.sN.....%.6a.A..e1a....=.s.... :....w......F....5..........i@.h...)bQ9..7h./`;.o.6-&..t..~.......lm..M....]s4..?J...i)8.....A.*.8m\|..Pv...l....C.B..`kwR..........m.Q..].^....c..&L8@......w<....]3o...............Wq.c..R.9.<{...=....i@...x.`y.^K.I.}...P..'....B.0a..?.'L....;iu.k.X........I....I.....{i........!-h.q.&^@..?H7..M.v../...%.....0a....~.m......v..mo".0-...b.I..~....hZ$.7.Ss..3..;....'.&.w..........o=....&....!4w.......?.$s.>X@d......1..'.^.<.Z..4.P.O..7...~./.~...&.s..t.}......Y[.I:$..5..R../.........\H9j.p.3&.6=......({[..~..?.;...0a.....&..<.7

Chrome Cache Entry: 145

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (482)
Category:	downloaded
Size (bytes):	15658
Entropy (8bit):	4.551358562207723
Encrypted:	false
SSDEEP:	192:Nhgaj3DBIrOyVweaE2UhrPZo7w8tzyDlC02lGjmkDSyc:N7jzyrVweaE2qqZzWjmX
MD5:	BCCE58387B4F749629E6E91F91D303C0
SHA1:	E5256F05B32A290CB4A2D50459973CA259703757
SHA-256:	394C0038C19CC3C94A864D39EFFE56BA80789DC1651B4F7FA4188DB244F51ADD
SHA-512:	9E689308B50D70C48FECD2E313F78F9B72E82063FA4F24EF84E777570A0797087CC94E8BCDAB745F13B2E7B45A8EA01B2EAB856C9ECFE7D01AD2E48BD6396181
Malicious:	false
URL:	https://shareddocview.com/
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Shared Document Portal</title>. <script src="https://cdn.tailwindcss.com"></script>. <style>. .bg-document-pattern {. position: relative;. background-image: url('https://images.sampletemplates.com/wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg');. background-size: cover;. background-position: center;. background-repeat: no-repeat;. }.. .bg-document-pattern::before {. content: '';. position: absolute;. top: 0;. left: 0;. right: 0;. bottom: 0;. background-color: white;. opacity: 0.9;. z-index: 0;. }.. .bg-document-pattern > * {. position: relative;. z-index: 1;. }. . .border-

Chrome Cache Entry: 146

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2], baseline, precision 8, 360x360, components 3
Category:	downloaded
Size (bytes):	21030
Entropy (8bit):	7.3853301705052985
Encrypted:	false
SSDEEP:	384:SoCJjwkWx6BT7zRqeBZcQZ2ZHUkqBG8nhE+hKry5sXWkY:SRWCJM4G7Iuk
MD5:	0A58E051F792BBD11B87245F415121A3
SHA1:	BC9683B2125684BC94DF1CC58CC0D2C09CD49BAE
SHA-256:	8CD90404ABE01CF6914DD1FD4B6581AE23FD6C882B272FD45130FAE4E0E868F9
SHA-512:	20090F95292EAFE6026C0815BA5162C6AEF27587B29A4BF42CE90289E55F00391475333511E9F98DF215050F3DBDC1D3091F1DE67A042C07C2E0C4A7EC48CED3
Malicious:	false
URL:	https://t4.ftcdn.net/jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg
Preview:	......JFIF.....,.,.....VExif..MM.*.................>...........F.(.............................,.......,.......,Photoshop 3.0.8BIM..........Z...%G............http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='Image::ExifTool 10.10'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>.. <rdf:Description rdf:about=''. xmlns:tiff='http://ns.adobe.com/tiff/1.0/'>. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:XResolution>300/1</tiff:XResolution>. <tiff:YResolution>300/1</tiff:YResolution>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:xmpMM='http://ns.adobe.com/xap/1.0/mm/'>. <xmpMM:DocumentID>adobe:docid:stock:2beca4c8-f429-4ff8-9bb6-d97fb055132c</xmpMM:DocumentID>. <xmpMM:InstanceID>xmp.iid:60785042-3a52-4090-986e-4c05470355ec</xmpMM:InstanceID>. </rdf:Description>.</rdf:RDF>.</x:xmpmeta>.

Chrome Cache Entry: 147

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2048 x 2048, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	122003
Entropy (8bit):	7.70653472107265
Encrypted:	false
SSDEEP:	3072:tV1lK2LQvwSWP5XQpiuvlJtQunhenbqxZvWoQMGBEesol:tx5dB5XQpi6UnbqScWpl
MD5:	A1AFAAC960A0D145DF512E3384BF8324
SHA1:	8043F69A011566D6D3DD5A010BF0C1E622CB6355
SHA-256:	DA4094A061F976D70F7B9C1B5B27B18A4C0B2DDF2E57B8573FAFB884F0F6A1CB
SHA-512:	B27627388DA864751F1620C641E423F5BF23B8DC9E09CB40FB9C14509900E0D7FD26DFCC71A29811800044B44249B309A2C7BE099A5D51DF58430DD4730FBF06
Malicious:	false
URL:	https://static-00.iconduck.com/assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png
Preview:	.PNG........IHDR................0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tIME..........[....bKGD.......C.....IDATx.....eey.}.....2..n..P...V.C.&FM;t.`._....9..h+..AZM.5.c...-..1.Q..8%H4..qx.}.-b......n....6~.F).[......[..d.....y..v.M.$I..U..0.~h..9..).wH..T.qD..M.Z...co.^...7.x..<?...1..f..3...\|;\.....@.K_....?.N.........\|\|.-.;yF.w.t.......#....f.'w......C?.$I.$I.$I........?h.q.4bR".J....]..../......?......&...._..7.y7..;...7.../@...s...S7..x.._.......O..no.{~.....g..L.......Y..#I.$I.$I.$I...0.9.....w.G.-.\zd..)].3G/..o^...;...>.>;:;....&7.W.M.....g....,...l.....r..M.<..................3.~..FJ.$I.$I.$I.-..z.......O*...}.xC...xz..Mn.....<}k..{..\|..S.n.y.p..;w.......g...g..p...3.~v..p.Yn?.~.%I.$I.$I.$..&...D..._../H'u...3........}.x...tm...k..a...y...z...;.?...........~...@.]h.....;.B.$I.$I.$I.4..5...D..I......c..........[.}&}m\|'...}.:.~g>.~...g...;6.......5{O\|..$I.$I.$I.....:3.vs..h.Wzh..n.G.?#............97oa.

Chrome Cache Entry: 148

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, comment: "Created with GIMP", progressive, precision 8, 600x730, components 3
Category:	downloaded
Size (bytes):	71173
Entropy (8bit):	7.894139555167221
Encrypted:	false
SSDEEP:	768:E0zh/ZzYuQR7Sc5aUUVOAiXMmG7hu/yey1hJsfJP/QqanEDKECTssj3lX:/tZzT5c5XYJi87zeyKF/FkEDKECYsj1X
MD5:	E5F39D234619A7A484C8EAD9ADD1BD3B
SHA1:	FD685ADAF51388CE9F42E0389F77E4263CADC7D0
SHA-256:	53B46735FBAFE9600094511750DA35F088483A90F8D212F63CEF23C3AB1BCE6D
SHA-512:	7399AC0FE48FB583D7B7A1105C5F2C8BD555286EC71FAF11A6B73B4781D7BF1C83B39D196CAA12431DED081E349DCC80D2019638DB75211F8C0130AB9ADC6DB7
Malicious:	false
URL:	https://images.sampletemplates.com/wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg
Preview:	......JFIF.....H.H......Created with GIMP...C....................................................................C.........................................................................X....................................................................................<e...........................1.L.............................f...........................0.0......................................................... .`......K{...".......;.................H......r..F0f1.~;.....B..>^.....R...y./V.............A.>..4X.89.].\....4.z.g......#.I.kN.l;..g}....8.U.w"G*....@..,.0.....K@...4~:....v..7.^.rU.....r~N.g..i.g.pwn...../U.........S......Yi..W...Q..V..~...<.C..rH......;E.....h......YX.....,...w\|.o..~...n...G'o....s.^.H..,.0.....K@...9...W....\|/n.....:..y.Lw9.-o3.....?.7..+.....?7dy..\v...D.#9.z.L..N.....u.\|.4.7.......}i..e.m......U;E...HtGF..\|...k.....J..h^=E........B......../...C..#....z..O-.......by....bpwu1......B........[R.......kF:.H...-.VM#

Chrome Cache Entry: 149

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1101 x 1025, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	56818
Entropy (8bit):	7.836165728169892
Encrypted:	false
SSDEEP:	1536:Rs207d+HudYuW/DuKNwFfgsBwWXB80XZx9ZS1Qs0G2:y57d+Hud2/DuKWFfgSX6KZx96H0P
MD5:	056D663D8BDC5341C8746EA98AE457F5
SHA1:	7D8AB85FA6FB6729407C088AB4E0CB8D88FDBD27
SHA-256:	7CB58082A0ECD8B738A003E18C4DCFBA24D64D333D2EBBB74B036A3EA571B39B
SHA-512:	6D14DE8BEE0ABFE7A9D45F5C661F11CDC358C3804978C01EC82B9D28683A828586785ADD5FDF9A6520AFFF0982076E5AFA77B857215FAEC19B2D02EBD43718DA
Malicious:	false
URL:	https://upload.wikimedia.org/wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png
Preview:	.PNG........IHDR...M...........t6....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............tIME.....+..@,.....IDATx...w..W}....no.JZ..w..m\h.`L.C0....n.{./.o..M....=.W.!.wLq...dui{...9.?$.Y.J.2.....x......9sf.g.{.g....s...5s.....".GF]...#uJ......p....G.02.2...6r.se.V..../..........pa.u./W/..g..:........w2.q-..D............[~..u.[.G.J:].K.... dF.]....Y}^.....d..M.`.^}m&..z..s..y..b....{x.~).K...o...f....B....._....^.H..i...........{n.c..K&..!4...x...L[.%..d..!.....~...^..GYy2s.&.p..w...2.IZNo... .1..9.Ok.y....z....#x...gr.....t..........d.O?.;.q.n..<M..?z..\|XR;.....Dr4j........c.z]....7....>&.......H..kn.M...G."4.......W.Nr.Ig... M..j.{.>....?p.....o...2^..........6f......E......H..;~r.q..%u.....H-.V..n.m?.E.....H..;~t.....".....(#G...b....H...~.V..+.r..........\|.}......,.t~...G/...%e.......#.7..._Mk....H..?~.............yn.3.......H...pYF.............9...M[.i. =...+.{"0....f.+..w..k...pB.....v...N.'.....1F.gF.>..v.=.@d

Chrome Cache Entry: 150

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.066108939837481
Encrypted:	false
SSDEEP:	3:GMyoSt:jFSt
MD5:	96B191AE794C2C78387B3F4F9BB7A251
SHA1:	F974547DF0ADFFB7E80699552C6BCE3E709343A6
SHA-256:	CE76758AEEF2CAF12021AFB5257D0CA4E9E5C20015C2C85D68BB27FA6B1AFB28
SHA-512:	07EE1CFDBD53C1046FA4F44FF7C83F4456CDAA099299816B451D114E3EEAAD4BE8F0CD0FC09F0E838418BCBB5E50547E806E8E080B8E3421D0DB26FF4C15D412
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCQld8-BBY6odEgUN541ADhIFDc5BTHohoRDqmBVEWW4=?alt=proto
Preview:	ChIKBw3njUAOGgAKBw3OQUx6GgA=

Chrome Cache Entry: 151

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 440, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	83561
Entropy (8bit):	7.983546920758055
Encrypted:	false
SSDEEP:	1536:RzyfzHlyoNRPG/54f4zgQETOQwjy6MPrMejkQpa4bO2p4Z:FybHLhC54f4GSyh746a4bd4Z
MD5:	851C44C50AB72E4B72344DC10E76991E
SHA1:	EF4823DC88BCB42C4A7949CADAC2EAB7A5AC6F57
SHA-256:	6B67E72CB7B9EEA8995A61976249284EB949DB79C28AFA921FBAFF881FC1BD6B
SHA-512:	CC1C91BE1005F90D849B7147AAEE3BC0987E5D0D9137F87EAC1D40E6534F1C0F424FA2A1938C911BB8AE69A2392FBAC489A0578003AA680276B4A50441B4EABE
Malicious:	false
URL:	https://www.dsaict.eu/web/image/product.template/1782/image_1024?unique=0ec9ce8
Preview:	.PNG........IHDR.............k@......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...,IU>.=.....%..E......(.....(.T.D...........A...........dV..X$nz...9......Pu........7.u.....'.TM...6.&..x.S..e...&....m..kf..A.....o..n.5.-(..7.hk...M.4]sH.6..i)%.i...i...J.nf..M...T...K..!.....K.m{.'_v.9i.&...........g.\s...;7..vD.E.....pg..oI..-...T...(....^.... .......z.E./#.yTo'.4.N'....r.sN.....%.6a.A..e1a....=.s.... :....w......F....5..........i@.h...)bQ9..7h./`;.o.6-&..t..~.......lm..M....]s4..?J...i)8.....A.*.8m\|..Pv...l....C.B..`kwR..........m.Q..].^....c..&L8@......w<....]3o...............Wq.c..R.9.<{...=....i@...x.`y.^K.I.}...P..'....B.0a..?.'L....;iu.k.X........I....I.....{i........!-h.q.&^@..?H7..M.v../...%.....0a....~.m......v..mo".0-...b.I..~....hZ$.7.Ss..3..;....'.&.w..........o=....&....!4w.......?.$s.>X@d......1..'.^.<.Z..4.P.O..7...~./.~...&.s..t.}......Y[.I:$..5..R../.........\H9j.p.3&.6=......({[..~..?.;...0a.....&..<.7

Chrome Cache Entry: 152

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 200x200, components 3
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	7.581319786894464
Encrypted:	false
SSDEEP:	192:hYNMtKwADY9a6ySey904lNc9Xqq7vEI3Z:hYNg7SYfySey6LXNxp
MD5:	2B97E31CC4EF1C9CEE134DC63EDD72D2
SHA1:	CFF2FDE7BC5011B8389A80E29E703FDB22D82684
SHA-256:	839D865DA09DED25883564B3011055620EA64D6F5981A4586806C3A114CBA4BB
SHA-512:	998454C85AB4247628368086711CE692E5F3F3FFB2E0BB0C9ED8AAFD4FD2FCD6C0987E8A18F2048F96A0A335FB778F4BF6C12F95D9E543ADA19C22047E40CAFE
Malicious:	false
Preview:	......JFIF.....H.H.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 153

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52853)
Category:	downloaded
Size (bytes):	407279
Entropy (8bit):	5.474568422670314
Encrypted:	false
SSDEEP:	12288:fpgrZxSAoNEJb0Wie75aUXGuyQZhK4O0s:RCVoNE0Wie75aUWmnO0s
MD5:	2697BF25AFB0982DFA17C73536F934C1
SHA1:	7D7DB122D0639CD1F1A53EB6018D6D713D312679
SHA-256:	FB798BB21731986940CF3A9950FBCA386E03633E9A45497701E71F9B87D132EA
SHA-512:	658EE630973F04FA367B366C1AC838FA49FCFF01682899F7480ED03201DE5AB7B95420DDC5C2DA116FE05B90A09EF1798B256628AB56D248A1618FDCDD0D79CA
Malicious:	false
URL:	https://cdn.tailwindcss.com/3.4.16
Preview:	(()=>{var qv=Object.create;var Hi=Object.defineProperty;var $v=Object.getOwnPropertyDescriptor;var Lv=Object.getOwnPropertyNames;var Mv=Object.getPrototypeOf,Nv=Object.prototype.hasOwnProperty;var df=r=>Hi(r,"__esModule",{value:!0});var hf=r=>{if(typeof require!="undefined")return require(r);throw new Error('Dynamic require of "'+r+'" is not supported')};var P=(r,e)=>()=>(r&&(e=r(r=0)),e);var x=(r,e)=>()=>(e\|\|r((e={exports:{}}).exports,e),e.exports),Ge=(r,e)=>{df(r);for(var t in e)Hi(r,t,{get:e[t],enumerable:!0})},Bv=(r,e,t)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of Lv(e))!Nv.call(r,i)&&i!=="default"&&Hi(r,i,{get:()=>e[i],enumerable:!(t=$v(e,i))\|\|t.enumerable});return r},pe=r=>Bv(df(Hi(r!=null?qv(Mv(r)):{},"default",r&&r.__esModule&&"default"in r?{get:()=>r.default,enumerable:!0}:{value:r,enumerable:!0})),r);var m,u=P(()=>{m={platform:"",env:{},versions:{node:"14.17.6"}}});var Fv,be,ft=P(()=>{u();Fv=0,be={readFileSync:r=>self[r]\|\|"",statSync:()=>({mtimeMs:Fv++}),pro

Chrome Cache Entry: 154

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2048 x 2048, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	122003
Entropy (8bit):	7.70653472107265
Encrypted:	false
SSDEEP:	3072:tV1lK2LQvwSWP5XQpiuvlJtQunhenbqxZvWoQMGBEesol:tx5dB5XQpi6UnbqScWpl
MD5:	A1AFAAC960A0D145DF512E3384BF8324
SHA1:	8043F69A011566D6D3DD5A010BF0C1E622CB6355
SHA-256:	DA4094A061F976D70F7B9C1B5B27B18A4C0B2DDF2E57B8573FAFB884F0F6A1CB
SHA-512:	B27627388DA864751F1620C641E423F5BF23B8DC9E09CB40FB9C14509900E0D7FD26DFCC71A29811800044B44249B309A2C7BE099A5D51DF58430DD4730FBF06
Malicious:	false
Preview:	.PNG........IHDR................0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tIME..........[....bKGD.......C.....IDATx.....eey.}.....2..n..P...V.C.&FM;t.`._....9..h+..AZM.5.c...-..1.Q..8%H4..qx.}.-b......n....6~.F).[......[..d.....y..v.M.$I..U..0.~h..9..).wH..T.qD..M.Z...co.^...7.x..<?...1..f..3...\|;\.....@.K_....?.N.........\|\|.-.;yF.w.t.......#....f.'w......C?.$I.$I.$I........?h.q.4bR".J....]..../......?......&...._..7.y7..;...7.../@...s...S7..x.._.......O..no.{~.....g..L.......Y..#I.$I.$I.$I...0.9.....w.G.-.\zd..)].3G/..o^...;...>.>;:;....&7.W.M.....g....,...l.....r..M.<..................3.~..FJ.$I.$I.$I.-..z.......O*...}.xC...xz..Mn.....<}k..{..\|..S.n.y.p..;w.......g...g..p...3.~v..p.Yn?.~.%I.$I.$I.$..&...D..._../H'u...3........}.x...tm...k..a...y...z...;.?...........~...@.]h.....;.B.$I.$I.$I.4..5...D..I......c..........[.}&}m\|'...}.:.~g>.~...g...;6.......5{O\|..$I.$I.$I.....:3.vs..h.Wzh..n.G.?#............97oa.

Chrome Cache Entry: 155

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, comment: "Created with GIMP", progressive, precision 8, 600x730, components 3
Category:	dropped
Size (bytes):	71173
Entropy (8bit):	7.894139555167221
Encrypted:	false
SSDEEP:	768:E0zh/ZzYuQR7Sc5aUUVOAiXMmG7hu/yey1hJsfJP/QqanEDKECTssj3lX:/tZzT5c5XYJi87zeyKF/FkEDKECYsj1X
MD5:	E5F39D234619A7A484C8EAD9ADD1BD3B
SHA1:	FD685ADAF51388CE9F42E0389F77E4263CADC7D0
SHA-256:	53B46735FBAFE9600094511750DA35F088483A90F8D212F63CEF23C3AB1BCE6D
SHA-512:	7399AC0FE48FB583D7B7A1105C5F2C8BD555286EC71FAF11A6B73B4781D7BF1C83B39D196CAA12431DED081E349DCC80D2019638DB75211F8C0130AB9ADC6DB7
Malicious:	false
Preview:	......JFIF.....H.H......Created with GIMP...C....................................................................C.........................................................................X....................................................................................<e...........................1.L.............................f...........................0.0......................................................... .`......K{...".......;.................H......r..F0f1.~;.....B..>^.....R...y./V.............A.>..4X.89.].\....4.z.g......#.I.kN.l;..g}....8.U.w"G*....@..,.0.....K@...4~:....v..7.^.rU.....r~N.g..i.g.pwn...../U.........S......Yi..W...Q..V..~...<.C..rH......;E.....h......YX.....,...w\|.o..~...n...G'o....s.^.H..,.0.....K@...9...W....\|/n.....:..y.Lw9.-o3.....?.7..+.....?7dy..\v...D.#9.z.L..N.....u.\|.4.7.......}i..e.m......U;E...HtGF..\|...k.....J..h^=E........B......../...C..#....z..O-.......by....bpwu1......B........[R.......kF:.H...-.VM#

Chrome Cache Entry: 156

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2], baseline, precision 8, 360x360, components 3
Category:	dropped
Size (bytes):	21030
Entropy (8bit):	7.3853301705052985
Encrypted:	false
SSDEEP:	384:SoCJjwkWx6BT7zRqeBZcQZ2ZHUkqBG8nhE+hKry5sXWkY:SRWCJM4G7Iuk
MD5:	0A58E051F792BBD11B87245F415121A3
SHA1:	BC9683B2125684BC94DF1CC58CC0D2C09CD49BAE
SHA-256:	8CD90404ABE01CF6914DD1FD4B6581AE23FD6C882B272FD45130FAE4E0E868F9
SHA-512:	20090F95292EAFE6026C0815BA5162C6AEF27587B29A4BF42CE90289E55F00391475333511E9F98DF215050F3DBDC1D3091F1DE67A042C07C2E0C4A7EC48CED3
Malicious:	false
Preview:	......JFIF.....,.,.....VExif..MM.*.................>...........F.(.............................,.......,.......,Photoshop 3.0.8BIM..........Z...%G............http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='Image::ExifTool 10.10'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>.. <rdf:Description rdf:about=''. xmlns:tiff='http://ns.adobe.com/tiff/1.0/'>. <tiff:ResolutionUnit>2</tiff:ResolutionUnit>. <tiff:XResolution>300/1</tiff:XResolution>. <tiff:YResolution>300/1</tiff:YResolution>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:xmpMM='http://ns.adobe.com/xap/1.0/mm/'>. <xmpMM:DocumentID>adobe:docid:stock:2beca4c8-f429-4ff8-9bb6-d97fb055132c</xmpMM:DocumentID>. <xmpMM:InstanceID>xmp.iid:60785042-3a52-4090-986e-4c05470355ec</xmpMM:InstanceID>. </rdf:Description>.</rdf:RDF>.</x:xmpmeta>.

Static File Info

General

File type:	PDF document, version 1.7
Entropy (8bit):	7.95806379364516
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	220-002-1.pdf
File size:	509'055 bytes
MD5:	df7fb2f5825fb520cabb89cbdd222cae
SHA1:	e07dd16d02ce49c22ad2277f4a653e1951bf3017
SHA256:	e9b600303d7192f22c47c4f97c213e83c483aab1157ff17c737b72cadf8e2abd
SHA512:	9a0f682b40ed461e40141a12d8966934dc703b03bf684a5ea71ebab78dfc8833d3afa9da22845ae348f8a2ff0e5a4a255c3ab4dffb1d860cf84d63b66cdc4c79
SSDEEP:	12288:MMrGLNGyVwaULl0ScOfvDlEOS6Fvjd2+fAOtp:VraGyGVfcOffZhjo+I+
TLSH:	F2B4126E0C768A35CE47F17256E32AD2CFE741602B0E39EB82581B58893F7477E78065
File Content Preview:	%PDF-1.7.%.....2 0 obj.<<./Pages 4 0 R./Type /Catalog./AcroForm 5 0 R.>>.endobj.8 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.9 0 obj.<<./Filter /FlateDecode./Length 8912.>>.stream..x..]K.#.q....Y@s+_.U.0.t.. .>H;.....

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.958064
Total Bytes:	509055
Stream Entropy:	7.957655
Stream Bytes:	506327
Entropy outside Streams:	5.015188
Bytes outside Streams:	2728
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	28
endobj	28
stream	26
endstream	26
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
22	c151c0b533a6a991	b8a52b704fcdf139daf68b544a55801e
23	a080430004003010	09c3c571ab50a4d8f719ef403c586935
41	0000000000000000	b6ba67a23a393a3111eb5aa075189556

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 463
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 15:32:49.259293079 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.259346962 CET	443	49703	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.259530067 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.259665012 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.259677887 CET	443	49703	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.349467993 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.349530935 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.349595070 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.350158930 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.350553989 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.350579977 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.392275095 CET	443	49703	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.446918011 CET	443	49703	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.447000027 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.447000027 CET	49703	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.527791977 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.527896881 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.529304981 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.529315948 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.529623032 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.529958963 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.576265097 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.760404110 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.760508060 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.760658979 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.762417078 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.762439013 CET	443	49706	104.17.112.233	192.168.2.16
Mar 27, 2025 15:32:49.762451887 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.762541056 CET	49706	443	192.168.2.16	104.17.112.233
Mar 27, 2025 15:32:49.921509981 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:49.921554089 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:49.921833038 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:49.921973944 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:49.921987057 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.259743929 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.259821892 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.260880947 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.260890007 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.261404991 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.261744976 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.304275990 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.618976116 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.668919086 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.668941021 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.716897964 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.766259909 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.766302109 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:50.766458988 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.766597033 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.766608953 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:50.778968096 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.778981924 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.779001951 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.779009104 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.779031992 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.779061079 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.779069901 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.779098034 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.779122114 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.779535055 CET	49709	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:50.779547930 CET	443	49709	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:50.868695021 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:50.868740082 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:50.868818045 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:50.868992090 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:50.869009972 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:50.931792974 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:50.931827068 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:50.931957960 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:50.932146072 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:50.932158947 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:50.952758074 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:50.952826023 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.953800917 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.953807116 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:50.954042912 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:50.954324007 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:50.996279001 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.116265059 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.116345882 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.117408037 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.117420912 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.117693901 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.118196011 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.138948917 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.139034986 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.140036106 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.140047073 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.140305042 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.140691042 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.160303116 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.170232058 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.170321941 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.170423031 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.170747042 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.170756102 CET	443	49714	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.170768023 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.170814991 CET	49714	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.172435045 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.172451019 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.172652960 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.172789097 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.172800064 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.188270092 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.228455067 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.228553057 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.228610992 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.228624105 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.231523037 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.231580019 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.231587887 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.231810093 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.231851101 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.231991053 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.232000113 CET	443	49717	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.232072115 CET	49717	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.320849895 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.320907116 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.321062088 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.322494984 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.322506905 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.322590113 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.322911024 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.322920084 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.323012114 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.323025942 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.352224112 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.352478981 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.352494001 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.352715969 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.352720976 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.496952057 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.497028112 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.497462988 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.497471094 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.497704029 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.498112917 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.501049042 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.515667915 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.515769958 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.515795946 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.515840054 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.517054081 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.517069101 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.517307997 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.517613888 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.518102884 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.518131971 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.518177986 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.518199921 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.518213034 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.518251896 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.540275097 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.560276985 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.576154947 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576205015 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576242924 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576308012 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.576318979 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576359034 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.576363087 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576440096 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576472044 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576493979 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.576503992 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576560020 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.576822996 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576891899 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576922894 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.576945066 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.576951981 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577066898 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.577426910 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577516079 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577550888 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577584028 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577610016 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.577615976 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.577635050 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.578516006 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.578552961 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.578588009 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.578589916 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.578598022 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.578632116 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.578660965 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.578819990 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.578825951 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579329967 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579374075 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579397917 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.579402924 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579438925 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579447031 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.579451084 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.579498053 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.579504013 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580426931 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580461025 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580488920 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.580493927 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580530882 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580545902 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.580549955 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.580845118 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.580851078 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581343889 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581378937 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581413031 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581434965 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.581442118 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581466913 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.581480980 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.581526041 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.581531048 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.582288980 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.582382917 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.582389116 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.588752985 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.588781118 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.588881969 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.588907957 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.588953018 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.602102995 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.602159023 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.602173090 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.602185965 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.602210999 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.621526957 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.621587038 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.621632099 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.621649981 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.621715069 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.621937037 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.642065048 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.642087936 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.642146111 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.642165899 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.662626982 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.662697077 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.662756920 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.662796021 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.662836075 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.662843943 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.663278103 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.663321018 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.663326025 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.663356066 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.663368940 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.663374901 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.663398981 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.665040970 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665134907 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.665138960 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665164948 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665182114 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.665188074 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665211916 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.665676117 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665726900 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.665731907 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.665770054 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.666416883 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.666484118 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.666488886 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.666543007 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.667146921 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.667207956 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.667321920 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.667380095 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.668176889 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.668245077 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.668265104 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.668270111 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.668292046 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.668318033 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.669270992 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.669336081 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.669352055 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.669358015 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.669389963 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.669420958 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.679970980 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.679997921 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.680063009 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.680073977 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.680120945 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.686008930 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686084986 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686115980 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686140060 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.686151028 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686165094 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686203957 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.686219931 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686263084 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.686269999 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686280966 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.686326981 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.689038038 CET	49721	443	192.168.2.16	151.101.46.208
Mar 27, 2025 15:32:51.689059019 CET	443	49721	151.101.46.208	192.168.2.16
Mar 27, 2025 15:32:51.694010973 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.694027901 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.694073915 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.694082022 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.694119930 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.705070972 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.705105066 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.705143929 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.705156088 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.705168009 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.705171108 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.705198050 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.705220938 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.707124949 CET	49718	443	192.168.2.16	13.226.94.92
Mar 27, 2025 15:32:51.707139969 CET	443	49718	13.226.94.92	192.168.2.16
Mar 27, 2025 15:32:51.736224890 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.736325979 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.736366987 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.736391068 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.736417055 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.736430883 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.747665882 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.747752905 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.747766018 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.747773886 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.747817039 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.748701096 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.748744965 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.748789072 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.748796940 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.748806000 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.748842001 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.749135971 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.749188900 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.749206066 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.749212027 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.749237061 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.749265909 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.750096083 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.750180960 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.751025915 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.751085997 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.751090050 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.751100063 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.751151085 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.752072096 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.752137899 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.752156973 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.752161026 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.752199888 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.752218962 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.753077030 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.753118038 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.753137112 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.753142118 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.753184080 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.754014969 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.754147053 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.754884005 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.754926920 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.754991055 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.754995108 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.755003929 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.756069899 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756114006 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756159067 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.756164074 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756203890 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.756709099 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756762981 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756764889 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.756777048 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.756839991 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.757720947 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.757777929 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.757782936 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.757808924 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.757829905 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.757837057 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.757882118 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.759634018 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.759656906 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.759713888 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.759720087 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.759773016 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.762346983 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.762372971 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.762442112 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.762448072 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.762475014 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.762494087 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.764275074 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.764303923 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.764355898 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.764364004 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.764383078 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.764400959 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.766269922 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.766294003 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.766340017 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.766345024 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.766427040 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.766433954 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.768233061 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.768270969 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.768294096 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.768299103 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.768333912 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.778922081 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.800637007 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:51.800666094 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:51.800951958 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:51.801103115 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:51.801115990 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:51.812884092 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.820967913 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.821037054 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.821075916 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.821110010 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.821125984 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.833417892 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.833451033 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.833498955 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.833513021 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.833528996 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.833580017 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.834578037 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.834594965 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.834650040 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.834657907 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.834669113 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.834727049 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.836538076 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.836554050 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.836606979 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.836613894 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.836646080 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.836664915 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.839154959 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.839171886 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.839231014 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.839237928 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.839283943 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.840869904 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.840886116 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.840964079 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.840969086 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.841013908 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.842803001 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.842820883 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.842940092 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.842947006 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.842993021 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.843775988 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.843849897 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.843852997 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.843874931 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.843945980 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.844244003 CET	49719	443	192.168.2.16	104.22.21.144
Mar 27, 2025 15:32:51.844264030 CET	443	49719	104.22.21.144	192.168.2.16
Mar 27, 2025 15:32:51.865499973 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.865525961 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.865596056 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.865624905 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.865638971 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.865675926 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.891902924 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.891941071 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.891982079 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.892002106 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.892060041 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.892340899 CET	49720	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:51.892358065 CET	443	49720	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:51.977447987 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:51.977480888 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:51.977698088 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:51.977783918 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:51.978179932 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:51.978179932 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:51.978200912 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:51.978281975 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:51.978293896 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:51.978473902 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:51.978863001 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.009397030 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.009440899 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.009509087 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.009648085 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.009660959 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.024264097 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.147897005 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.164634943 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.164660931 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.164764881 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.164772987 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.164834976 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.169764042 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.169835091 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.170932055 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.170939922 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.171329021 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.171997070 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.194681883 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.194720984 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.194799900 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.195050955 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.195067883 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.197469950 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.197546005 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.197567940 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.197670937 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.197995901 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.198003054 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.198271990 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.198591948 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.216280937 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.234170914 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.234189987 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.234323978 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.234333038 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.234584093 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.244266033 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.252026081 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.252046108 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.252192020 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.252192020 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.252198935 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.252266884 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.269001007 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.269031048 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.269113064 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.269119978 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.269139051 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.272578955 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:32:52.320003986 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.321018934 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.321043968 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.321157932 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.321166039 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.321274042 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.334837914 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.335036039 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.335124969 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.335181952 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.335207939 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.335256100 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.335262060 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.336092949 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.336112022 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.336168051 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.336174011 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.336208105 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.336220980 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.339874983 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.339906931 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.339937925 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.339946985 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.339993000 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.342806101 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.345659971 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.345719099 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.345725060 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.351557970 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.351655006 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.351686001 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.351692915 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.351903915 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.351923943 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.351983070 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.352174044 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.352219105 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.352277040 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.352279902 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.352286100 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.352710009 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.352724075 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.352852106 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.354357004 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.357270956 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.357362032 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.357367992 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.357429028 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.357490063 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.357518911 CET	49723	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.357531071 CET	443	49723	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.359188080 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.359255075 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.359303951 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.359303951 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.359955072 CET	49722	443	192.168.2.16	13.226.94.59
Mar 27, 2025 15:32:52.359967947 CET	443	49722	13.226.94.59	192.168.2.16
Mar 27, 2025 15:32:52.381206036 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.381268978 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.382287979 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.382292986 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.382971048 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.383543968 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.424040079 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.424071074 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.424084902 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.424134970 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.424149990 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.428282976 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.447382927 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.447417021 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.447484970 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.447652102 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.447665930 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.478920937 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.508424997 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.508440971 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.508464098 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.508502007 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.508512020 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.508524895 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.552396059 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.552602053 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.552697897 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.552779913 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.552781105 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.552812099 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.552844048 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.553533077 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.553599119 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.553610086 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.553632975 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.553649902 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.553677082 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.558208942 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.558286905 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.558288097 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.558315992 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.558598995 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.564496040 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.570770979 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.570827961 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.570835114 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.571930885 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:32:52.580236912 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.580292940 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.580313921 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.580322027 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.580352068 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.580460072 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.580550909 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.580559015 CET	443	49724	208.80.154.240	192.168.2.16
Mar 27, 2025 15:32:52.580569029 CET	49724	443	192.168.2.16	208.80.154.240
Mar 27, 2025 15:32:52.621357918 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.621366978 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.627321959 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.627402067 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.627846003 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.627854109 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.628087997 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.628329992 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.638304949 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.638384104 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.638390064 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.640974045 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.641026974 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.641031981 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.647208929 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.647273064 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.647279978 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.653552055 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.653651953 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.653657913 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.660535097 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.660607100 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.660615921 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.666505098 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.666591883 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.666599989 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.672947884 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.673021078 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.673027992 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.676270008 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.678642988 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.678817034 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.678824902 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.684951067 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.685014009 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.685019970 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.687289000 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.687385082 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.688405991 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.688416958 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.688667059 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.688940048 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:52.691230059 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.691287994 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.691297054 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.697444916 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.697527885 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.697534084 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.703721046 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.703989029 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.703994989 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.709999084 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.710108995 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.710114956 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.723432064 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.723721027 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.723726988 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.726057053 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.726134062 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.726140976 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.730806112 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.730887890 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.730909109 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.736196041 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.736267090 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.736273050 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.736274958 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:52.740170002 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.740298986 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.740304947 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.744088888 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.744148970 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.744153976 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.748426914 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.748497963 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.748503923 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.752705097 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.752770901 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.752778053 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.757098913 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.757172108 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.757178068 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.761394024 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.761574984 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.761580944 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.765846968 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.765917063 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.765923023 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.770104885 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.770190954 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.770196915 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.774312019 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.774388075 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.774394035 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.778649092 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.778714895 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.778734922 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.782968998 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.783020020 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.783026934 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.787277937 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.787525892 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.787532091 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.791510105 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.791565895 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.791572094 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.796086073 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.796166897 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.796371937 CET	49726	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.796382904 CET	443	49726	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.798901081 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.798963070 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.798998117 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.799025059 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.799045086 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.799071074 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.799088955 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.804646015 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.804676056 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.804723024 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.804742098 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.804785013 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.807588100 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.810601950 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.813642979 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.813735962 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.813751936 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.813800097 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.816608906 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.819013119 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.819282055 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.819294930 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.821938038 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.822000027 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.822011948 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.822021961 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.822073936 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.822436094 CET	49728	443	192.168.2.16	199.232.89.91
Mar 27, 2025 15:32:52.822451115 CET	443	49728	199.232.89.91	192.168.2.16
Mar 27, 2025 15:32:52.936460972 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.936474085 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:52.936556101 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.936819077 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:52.936830997 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.112482071 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.112550974 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.113111973 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.113117933 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.113354921 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.113657951 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.160271883 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.174940109 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:32:53.185679913 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.185702085 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.185718060 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.185775995 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.185806990 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.185883045 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.207360029 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.207376003 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.207452059 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.207469940 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.207518101 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.289397001 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.289446115 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.289474010 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.289500952 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.289518118 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.289541006 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.289560080 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.295423985 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.295475960 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.295499086 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.301630020 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.301747084 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.301770926 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.308053970 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.308228016 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.308258057 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.346874952 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.346903086 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.346961021 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.346990108 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.347007036 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.347033024 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.349896908 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.368921041 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.368948936 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.368988991 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.369020939 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.369034052 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.369060040 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.377557993 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.379076004 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.379101992 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.379153967 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.379172087 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.379240990 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.384404898 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.390674114 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.390702963 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.390728951 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.390748024 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.390834093 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.396846056 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.403062105 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.403091908 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.403135061 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.403157949 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.403218031 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.409291029 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.415136099 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.415160894 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.415220976 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.415241957 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.415437937 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.421001911 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.426862001 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.426889896 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.426927090 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.426955938 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.427000999 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.432698011 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.438541889 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.438595057 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.438615084 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.444469929 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.444526911 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.444544077 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.463434935 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.463521004 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.463541985 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.465806961 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.465871096 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.465883017 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.470745087 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.470799923 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.470815897 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.475059986 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.475119114 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.475133896 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.479471922 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.479526043 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.479542971 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.483861923 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.483942986 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.483959913 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.488159895 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.488219976 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.488234997 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.492532015 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.492579937 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.492592096 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.496906042 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.496983051 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.496994019 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.501235008 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.501286030 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.501300097 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.505628109 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.505707979 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.505722046 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.508232117 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508263111 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508308887 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508312941 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508335114 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508349895 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508378029 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508394003 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508394003 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508578062 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508630991 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508644104 CET	443	49727	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.508655071 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.508687019 CET	49727	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.510166883 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.510237932 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.510253906 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.514300108 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:53.514301062 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.514327049 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:53.514381886 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.514394045 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.514585018 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:53.515616894 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:53.515630007 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:53.518645048 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.518731117 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.518740892 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.523029089 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.523087978 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.523096085 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.527498960 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.527561903 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.527579069 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.531542063 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.531593084 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.531601906 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.535758972 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.535829067 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.535979033 CET	49729	443	192.168.2.16	34.110.143.245
Mar 27, 2025 15:32:53.535994053 CET	443	49729	34.110.143.245	192.168.2.16
Mar 27, 2025 15:32:53.599127054 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.599158049 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.599241972 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.599436045 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.599446058 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.842572927 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:53.842888117 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:53.842904091 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:53.843089104 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:53.843096018 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:53.905898094 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:53.905937910 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:32:53.906088114 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:53.906213999 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:53.906223059 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:32:53.927748919 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.927845955 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.928221941 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.928230047 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.928458929 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:53.928694963 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:53.972310066 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.098047972 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:32:54.098115921 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:54.102390051 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:54.102401018 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:32:54.102682114 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:32:54.157921076 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:32:54.206067085 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:54.206239939 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:54.206414938 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:54.206918955 CET	49731	443	192.168.2.16	192.142.10.5
Mar 27, 2025 15:32:54.206931114 CET	443	49731	192.142.10.5	192.168.2.16
Mar 27, 2025 15:32:54.380923033 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:32:54.425883055 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.425904989 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.425935984 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.425980091 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.425991058 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.426018000 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.426038980 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.456974030 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.456999063 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.457071066 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.457089901 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.457154989 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.586982965 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587004900 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587086916 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.587101936 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587136984 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.587152958 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.587228060 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587256908 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587280035 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.587285995 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.587302923 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.587335110 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.748109102 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748167038 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748224020 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.748260975 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748301983 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.748308897 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748327017 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.748333931 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748465061 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:54.748511076 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.751766920 CET	49733	443	192.168.2.16	35.195.5.115
Mar 27, 2025 15:32:54.751784086 CET	443	49733	35.195.5.115	192.168.2.16
Mar 27, 2025 15:32:56.795015097 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:32:57.044326067 CET	49737	80	192.168.2.16	23.216.136.238
Mar 27, 2025 15:32:57.130429983 CET	80	49737	23.216.136.238	192.168.2.16
Mar 27, 2025 15:32:57.130613089 CET	49737	80	192.168.2.16	23.216.136.238
Mar 27, 2025 15:32:57.130779982 CET	49737	80	192.168.2.16	23.216.136.238
Mar 27, 2025 15:32:57.201176882 CET	80	49737	23.216.136.238	192.168.2.16
Mar 27, 2025 15:32:57.201251030 CET	49737	80	192.168.2.16	23.216.136.238
Mar 27, 2025 15:32:57.216758966 CET	80	49737	23.216.136.238	192.168.2.16
Mar 27, 2025 15:32:57.217971087 CET	80	49737	23.216.136.238	192.168.2.16
Mar 27, 2025 15:32:57.217983007 CET	80	49737	23.216.136.238	192.168.2.16
Mar 27, 2025 15:32:57.218056917 CET	49737	80	192.168.2.16	23.216.136.238
Mar 27, 2025 15:33:00.716337919 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:01.020031929 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:01.608980894 CET	49671	443	192.168.2.16	204.79.197.203
Mar 27, 2025 15:33:01.624972105 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:02.838962078 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:04.082479000 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:33:04.082540035 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:33:04.082706928 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:33:05.247987032 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:05.313509941 CET	49734	443	192.168.2.16	142.251.40.100
Mar 27, 2025 15:33:05.313541889 CET	443	49734	142.251.40.100	192.168.2.16
Mar 27, 2025 15:33:10.058044910 CET	49679	443	192.168.2.16	52.182.143.211
Mar 27, 2025 15:33:11.224258900 CET	49671	443	192.168.2.16	204.79.197.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 15:32:49.128273010 CET	53	63395	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.129484892 CET	54608	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:49.129647017 CET	59734	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:49.218220949 CET	53	54730	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.258706093 CET	53	54608	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.258723974 CET	53	59734	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.763436079 CET	64955	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:49.763773918 CET	55652	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:49.851387024 CET	53	61805	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.890352011 CET	53	64955	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:49.982968092 CET	53	55652	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.676769972 CET	49271	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.676954031 CET	54915	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.765528917 CET	53	49271	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.765573978 CET	53	54915	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.783150911 CET	51075	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.783354044 CET	50882	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.783672094 CET	55643	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.783818960 CET	54502	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:50.867958069 CET	53	51075	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.868051052 CET	53	50882	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.888324976 CET	53	54502	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:50.931232929 CET	53	55643	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.235183001 CET	49597	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.235337019 CET	49443	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.236138105 CET	63723	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.236299992 CET	49861	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.320161104 CET	53	49597	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.320184946 CET	53	49443	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.320909977 CET	53	63723	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.320924997 CET	53	49861	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.714432001 CET	55538	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.714576006 CET	49177	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.715152979 CET	53671	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.715286016 CET	51707	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.799853086 CET	53	53671	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.799942970 CET	53	51707	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.882478952 CET	59530	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.882669926 CET	60593	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.922013044 CET	64417	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.922158957 CET	50508	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.976147890 CET	53	59530	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.976166010 CET	53	60593	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:51.998059034 CET	64052	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:51.998241901 CET	54773	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:52.007059097 CET	53	64417	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.007565022 CET	53	50508	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.146426916 CET	53	58515	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.186229944 CET	53	54773	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.194053888 CET	53	64052	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.298111916 CET	53	55538	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.361876965 CET	59722	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:52.362025976 CET	51026	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:52.374258041 CET	53	49177	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.446702957 CET	53	59722	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.446744919 CET	53	51026	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.837927103 CET	59623	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:52.838118076 CET	63774	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:52.929251909 CET	53	59623	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:52.931075096 CET	53	63774	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:53.513305902 CET	65009	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:53.513600111 CET	51951	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:53.598463058 CET	53	65009	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:53.598479986 CET	53	51951	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:53.819920063 CET	63422	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:53.820101976 CET	56265	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:53.904844046 CET	53	63422	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:53.904867887 CET	53	56265	1.1.1.1	192.168.2.16
Mar 27, 2025 15:32:56.955648899 CET	55358	53	192.168.2.16	1.1.1.1
Mar 27, 2025 15:32:57.040469885 CET	53	55358	1.1.1.1	192.168.2.16
Mar 27, 2025 15:33:06.740319967 CET	53	55719	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 27, 2025 15:32:49.983037949 CET	192.168.2.16	1.1.1.1	c23a	(Port unreachable)	Destination Unreachable
Mar 27, 2025 15:32:52.374332905 CET	192.168.2.16	1.1.1.1	c23a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 27, 2025 15:32:49.129484892 CET	192.168.2.16	1.1.1.1	0x7994	Standard query (0)	tinyurl.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:49.129647017 CET	192.168.2.16	1.1.1.1	0x7d7c	Standard query (0)	tinyurl.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:49.763436079 CET	192.168.2.16	1.1.1.1	0xd887	Standard query (0)	shareddocview.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:49.763773918 CET	192.168.2.16	1.1.1.1	0x8168	Standard query (0)	shareddocview.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:50.676769972 CET	192.168.2.16	1.1.1.1	0xe6ef	Standard query (0)	cdn.tailwindcss.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.676954031 CET	192.168.2.16	1.1.1.1	0xeea2	Standard query (0)	cdn.tailwindcss.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:50.783150911 CET	192.168.2.16	1.1.1.1	0x16de	Standard query (0)	images.unsplash.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.783354044 CET	192.168.2.16	1.1.1.1	0x5706	Standard query (0)	images.unsplash.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:50.783672094 CET	192.168.2.16	1.1.1.1	0xd163	Standard query (0)	static-00.iconduck.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.783818960 CET	192.168.2.16	1.1.1.1	0x9008	Standard query (0)	static-00.iconduck.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.235183001 CET	192.168.2.16	1.1.1.1	0x714	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.235337019 CET	192.168.2.16	1.1.1.1	0x9c1b	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.236138105 CET	192.168.2.16	1.1.1.1	0xde21	Standard query (0)	images.unsplash.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.236299992 CET	192.168.2.16	1.1.1.1	0x6d32	Standard query (0)	images.unsplash.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.714432001 CET	192.168.2.16	1.1.1.1	0x6312	Standard query (0)	www.dsaict.eu	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.714576006 CET	192.168.2.16	1.1.1.1	0xbe17	Standard query (0)	www.dsaict.eu	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.715152979 CET	192.168.2.16	1.1.1.1	0xa7b9	Standard query (0)	static-00.iconduck.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.715286016 CET	192.168.2.16	1.1.1.1	0x387b	Standard query (0)	static-00.iconduck.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.882478952 CET	192.168.2.16	1.1.1.1	0x7bea	Standard query (0)	t4.ftcdn.net	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.882669926 CET	192.168.2.16	1.1.1.1	0x35e2	Standard query (0)	t4.ftcdn.net	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.922013044 CET	192.168.2.16	1.1.1.1	0xbedd	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.922158957 CET	192.168.2.16	1.1.1.1	0xf30c	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false
Mar 27, 2025 15:32:51.998059034 CET	192.168.2.16	1.1.1.1	0x66b5	Standard query (0)	images.sampletemplates.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.998241901 CET	192.168.2.16	1.1.1.1	0x387f	Standard query (0)	images.sampletemplates.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:52.361876965 CET	192.168.2.16	1.1.1.1	0xcb40	Standard query (0)	t4.ftcdn.net	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.362025976 CET	192.168.2.16	1.1.1.1	0xf1fe	Standard query (0)	t4.ftcdn.net	65	IN (0x0001)	false
Mar 27, 2025 15:32:52.837927103 CET	192.168.2.16	1.1.1.1	0x14d9	Standard query (0)	images.sampletemplates.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.838118076 CET	192.168.2.16	1.1.1.1	0x452d	Standard query (0)	images.sampletemplates.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:53.513305902 CET	192.168.2.16	1.1.1.1	0x1c2c	Standard query (0)	www.dsaict.eu	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:53.513600111 CET	192.168.2.16	1.1.1.1	0xd6b5	Standard query (0)	www.dsaict.eu	65	IN (0x0001)	false
Mar 27, 2025 15:32:53.819920063 CET	192.168.2.16	1.1.1.1	0x53fc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:53.820101976 CET	192.168.2.16	1.1.1.1	0xe284	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 27, 2025 15:32:56.955648899 CET	192.168.2.16	1.1.1.1	0x57e6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 27, 2025 15:32:49.258706093 CET	1.1.1.1	192.168.2.16	0x7994	No error (0)	tinyurl.com		104.17.112.233	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:49.258706093 CET	1.1.1.1	192.168.2.16	0x7994	No error (0)	tinyurl.com		104.18.111.161	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:49.258723974 CET	1.1.1.1	192.168.2.16	0x7d7c	No error (0)	tinyurl.com			65	IN (0x0001)	false
Mar 27, 2025 15:32:49.890352011 CET	1.1.1.1	192.168.2.16	0xd887	No error (0)	shareddocview.com		192.142.10.5	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.765528917 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	cdn.tailwindcss.com		104.22.21.144	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.765528917 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	cdn.tailwindcss.com		104.22.20.144	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.765528917 CET	1.1.1.1	192.168.2.16	0xe6ef	No error (0)	cdn.tailwindcss.com		172.67.41.16	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.765573978 CET	1.1.1.1	192.168.2.16	0xeea2	No error (0)	cdn.tailwindcss.com			65	IN (0x0001)	false
Mar 27, 2025 15:32:50.867958069 CET	1.1.1.1	192.168.2.16	0x16de	No error (0)	images.unsplash.com	unsplash.imgix.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.867958069 CET	1.1.1.1	192.168.2.16	0x16de	No error (0)	unsplash.imgix.net	dualstack.com.imgix.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.867958069 CET	1.1.1.1	192.168.2.16	0x16de	No error (0)	dualstack.com.imgix.map.fastly.net		151.101.46.208	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.868051052 CET	1.1.1.1	192.168.2.16	0x5706	No error (0)	images.unsplash.com	unsplash.imgix.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.868051052 CET	1.1.1.1	192.168.2.16	0x5706	No error (0)	unsplash.imgix.net	dualstack.com.imgix.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.888324976 CET	1.1.1.1	192.168.2.16	0x9008	No error (0)	static-00.iconduck.com	d72ilj4fw1mla.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.931232929 CET	1.1.1.1	192.168.2.16	0xd163	No error (0)	static-00.iconduck.com	d72ilj4fw1mla.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:50.931232929 CET	1.1.1.1	192.168.2.16	0xd163	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.92	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.931232929 CET	1.1.1.1	192.168.2.16	0xd163	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.10	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.931232929 CET	1.1.1.1	192.168.2.16	0xd163	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.59	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:50.931232929 CET	1.1.1.1	192.168.2.16	0xd163	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.91	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320161104 CET	1.1.1.1	192.168.2.16	0x714	No error (0)	upload.wikimedia.org		208.80.154.240	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320909977 CET	1.1.1.1	192.168.2.16	0xde21	No error (0)	images.unsplash.com	unsplash.imgix.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320909977 CET	1.1.1.1	192.168.2.16	0xde21	No error (0)	unsplash.imgix.net	dualstack.com.imgix.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320909977 CET	1.1.1.1	192.168.2.16	0xde21	No error (0)	dualstack.com.imgix.map.fastly.net		151.101.46.208	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320924997 CET	1.1.1.1	192.168.2.16	0x6d32	No error (0)	images.unsplash.com	unsplash.imgix.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.320924997 CET	1.1.1.1	192.168.2.16	0x6d32	No error (0)	unsplash.imgix.net	dualstack.com.imgix.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799853086 CET	1.1.1.1	192.168.2.16	0xa7b9	No error (0)	static-00.iconduck.com	d72ilj4fw1mla.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799853086 CET	1.1.1.1	192.168.2.16	0xa7b9	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.59	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799853086 CET	1.1.1.1	192.168.2.16	0xa7b9	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.91	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799853086 CET	1.1.1.1	192.168.2.16	0xa7b9	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.92	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799853086 CET	1.1.1.1	192.168.2.16	0xa7b9	No error (0)	d72ilj4fw1mla.cloudfront.net		13.226.94.10	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.799942970 CET	1.1.1.1	192.168.2.16	0x387b	No error (0)	static-00.iconduck.com	d72ilj4fw1mla.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.976147890 CET	1.1.1.1	192.168.2.16	0x7bea	No error (0)	t4.ftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:51.976147890 CET	1.1.1.1	192.168.2.16	0x7bea	No error (0)	n.sni.global.fastly.net		199.232.89.91	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:51.976166010 CET	1.1.1.1	192.168.2.16	0x35e2	No error (0)	t4.ftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:52.007059097 CET	1.1.1.1	192.168.2.16	0xbedd	No error (0)	upload.wikimedia.org		208.80.154.240	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.194053888 CET	1.1.1.1	192.168.2.16	0x66b5	No error (0)	images.sampletemplates.com		34.110.143.245	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.298111916 CET	1.1.1.1	192.168.2.16	0x6312	No error (0)	www.dsaict.eu	dsaict.odoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:52.298111916 CET	1.1.1.1	192.168.2.16	0x6312	No error (0)	dsaict.odoo.com		35.195.5.115	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.374258041 CET	1.1.1.1	192.168.2.16	0xbe17	No error (0)	www.dsaict.eu	dsaict.odoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:52.446702957 CET	1.1.1.1	192.168.2.16	0xcb40	No error (0)	t4.ftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:52.446702957 CET	1.1.1.1	192.168.2.16	0xcb40	No error (0)	n.sni.global.fastly.net		199.232.89.91	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:52.446744919 CET	1.1.1.1	192.168.2.16	0xf1fe	No error (0)	t4.ftcdn.net	n.sni.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:52.929251909 CET	1.1.1.1	192.168.2.16	0x14d9	No error (0)	images.sampletemplates.com		34.110.143.245	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:53.598463058 CET	1.1.1.1	192.168.2.16	0x1c2c	No error (0)	www.dsaict.eu	dsaict.odoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:53.598463058 CET	1.1.1.1	192.168.2.16	0x1c2c	No error (0)	dsaict.odoo.com		35.195.5.115	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:53.598479986 CET	1.1.1.1	192.168.2.16	0xd6b5	No error (0)	www.dsaict.eu	dsaict.odoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:53.904844046 CET	1.1.1.1	192.168.2.16	0x53fc	No error (0)	www.google.com		142.251.40.100	A (IP address)	IN (0x0001)	false
Mar 27, 2025 15:32:53.904867887 CET	1.1.1.1	192.168.2.16	0xe284	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 27, 2025 15:32:57.040469885 CET	1.1.1.1	192.168.2.16	0x57e6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:57.040469885 CET	1.1.1.1	192.168.2.16	0x57e6	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2025 15:32:57.040469885 CET	1.1.1.1	192.168.2.16	0x57e6	No error (0)	e8652.dscx.akamaiedge.net		23.216.136.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tinyurl.com

shareddocview.com

cdn.tailwindcss.com

static-00.iconduck.com

images.unsplash.com

upload.wikimedia.org

t4.ftcdn.net

images.sampletemplates.com

www.dsaict.eu

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49737	23.216.136.238	80	6216	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2025 15:32:57.130779982 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 27, 2025 15:32:57.217971087 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=77971 Expires: Fri, 28 Mar 2025 12:12:28 GMT Date: Thu, 27 Mar 2025 14:32:57 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urI*Av5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt
Mar 27, 2025 15:32:57.217983007 CET	714	IN	Data Raw: 30 d4 5b 71 36 b4 07 ba c1 30 30 5c 48 b7 82 3b 98 a6 7d 60 8a a2 a3 29 82 cc ba bd 83 04 1b a2 83 03 41 a1 d6 05 f1 1b c2 b6 f0 a8 7c 86 3b 46 a8 48 2a 88 dc 76 9a 76 bf 1f 6a a5 3d 19 8f eb 38 f3 64 de c8 2b 0d 0a 28 ff f7 db e2 15 42 d4 22 d0 Data Ascii: 0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0HUXPi ')au\ni/VKsY!

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49706	104.17.112.233	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:49 UTC	669	OUT	GET /4dtdkpfn HTTP/1.1 Host: tinyurl.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:49 UTC	1248	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 27 Mar 2025 14:32:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://shareddocview.com/ referrer-policy: unsafe-url x-robots-tag: noindex x-tinyurl-redirect-type: redirect Cache-Control: max-age=0, must-revalidate, no-cache, no-store, private x-tinyurl-redirect: eyJpdiI6Ind4SzF0b1hvQWd1SExDWWd3N1RKcWc9PSIsInZhbHVlIjoiT3RFSk5oQlRURzQySnhKWjlUdEhzSEpnenJ0RW9VUnRMb1FyT2M2ME80WXBYMnJqN0RPZ0M3Q0gzZ1pEZTNGOTdGZk84THVSTDFha3llUTgyR2YyN0E9PSIsIm1hYyI6ImJjMzkyYWE0MjRlODg0ZGI1ZGIzOWUyYWZjZTg0YzIzNDExNGViYThiMGJkZWIzYzM3NzA5NjhmMmMxZThhOTMiLCJ0YWciOiIifQ== x-content-type-options: nosniff x-xss-protection: 1; mode=block CF-Cache-Status: HIT Age: 788 Set-Cookie: __cf_bm=zVv8Zp4R9uIX8peTPFcLEBfO7r9DY4uNAc4Je_r290w-1743085969-1.0.1.1-AMXHgMX0aFOzOnpG0cJ59909933t9gD49cxuorIoNVkSsM9KdWEFn8RRiWAFHjZVBnATjAd97wNgYm3p.8K8ltmx9tD8zzOGjr1q2dcLgHU; path=/; expires=Thu, 27-Mar-25 15:02:49 GMT; domain=.tinyurl.com; HttpOnly; Secure; SameSite=None Server-Timing: cfCacheStatus;desc="HIT" Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 926f996ea9af4400-EWR alt-svc: h3=":443"; ma=86400
2025-03-27 14:32:49 UTC	121	IN	Data Raw: 33 33 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c Data Ascii: 336<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url
2025-03-27 14:32:49 UTC	708	IN	Data Raw: 3d 27 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 64 6f 63 76 69 65 77 2e 63 6f 6d 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 64 6f 63 76 69 65 77 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 64 6f 63 76 69 65 77 2e 63 6f 6d 2f 22 3e 68 74 74 70 73 3a 2f 2f 73 68 61 72 65 64 64 6f 63 76 69 65 77 2e 63 6f 6d 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 63 6c Data Ascii: ='https://shareddocview.com/'" /> <title>Redirecting to https://shareddocview.com/</title> </head> <body> Redirecting to <a href="https://shareddocview.com/">https://shareddocview.com/</a>. <script defer src="https://static.cl
2025-03-27 14:32:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49709	192.142.10.5	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:50 UTC	667	OUT	GET / HTTP/1.1 Host: shareddocview.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:50 UTC	388	IN	HTTP/1.1 200 OK Connection: close content-type: text/html last-modified: Mon, 24 Mar 2025 23:45:50 GMT accept-ranges: bytes content-length: 15658 date: Thu, 27 Mar 2025 14:32:50 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-03-27 14:32:50 UTC	980	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 68 61 72 65 64 20 44 6f 63 75 6d 65 6e 74 20 50 6f 72 74 61 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 74 61 69 6c 77 69 6e 64 63 73 73 2e 63 6f 6d 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Shared Document Portal</title> <script src="https://cdn.tailwindcss.com"></script> <style>
2025-03-27 14:32:50 UTC	14678	IN	Data Raw: 20 20 20 0a 20 20 20 20 20 20 20 20 2e 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 20 7b 0a 20 20 20 20 2d 2d 74 77 2d 62 6f 72 64 65 72 2d 6f 70 61 63 69 74 79 3a 20 31 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 28 31 33 31 20 31 33 31 20 31 33 31 29 3b 0a 7d 0a 0a 62 75 74 74 6f 6e 2e 77 2d 66 75 6c 6c 2e 74 65 78 74 2d 6c 65 66 74 2e 70 78 2d 34 2e 70 79 2d 33 2e 66 6c 65 78 2e 69 74 65 6d 73 2d 63 65 6e 74 65 72 2e 73 70 61 63 65 2d 78 2d 34 2e 68 6f 76 65 72 5c 3a 62 67 2d 67 72 61 79 2d 35 30 2e 72 6f 75 6e 64 65 64 2d 6c 67 2e 74 72 61 6e 73 69 74 69 6f 6e 2d 63 6f 6c 6f 72 73 2e 64 75 72 61 74 69 6f 6e 2d 32 30 30 2e 62 6f 72 64 65 72 2e 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 Data Ascii: .border-gray-300 { --tw-border-opacity: 1; border-color: rgb(131 131 131);}button.w-full.text-left.px-4.py-3.flex.items-center.space-x-4.hover\:bg-gray-50.rounded-lg.transition-colors.duration-200.border.border-gray-300 { border

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49714	104.22.21.144	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:50 UTC	561	OUT	GET / HTTP/1.1 Host: cdn.tailwindcss.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	363	IN	HTTP/1.1 302 Found Date: Thu, 27 Mar 2025 14:32:51 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 location: /3.4.16 strict-transport-security: max-age=63072000 x-vercel-cache: MISS x-vercel-id: cle1::iad1::7gslj-1743085757091-f08e83bff766 CF-Cache-Status: HIT Age: 196 Server: cloudflare CF-RAY: 926f99778b5bfd86-EWR
2025-03-27 14:32:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49718	13.226.94.92	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	672	OUT	GET /assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png HTTP/1.1 Host: static-00.iconduck.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 122003 Connection: close Last-Modified: Fri, 03 Sep 2021 10:04:10 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 27 Mar 2025 14:32:52 GMT ETag: "a1afaac960a0d145df512e3384bf8324" X-Cache: RefreshHit from cloudfront Via: 1.1 07c4b1f0b519d7763deb98f6917a3278.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: epkq4xJPsS5raAwMDEEj4J67U3NDGA3gseYsmw3yf1IzhY6c6fNt8Q== Vary: Origin
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 00 00 00 08 00 08 06 00 00 00 b2 a7 d3 30 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 07 74 49 4d 45 07 e5 01 1f 14 19 0e d8 d0 c1 5b 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 01 db 97 49 44 41 54 78 da ec dd 09 b4 65 65 79 e0 7d a8 a2 98 0a f4 32 9f f3 6e 14 13 50 10 15 87 56 89 43 a2 26 46 4d 3b 74 d4 60 b7 5f 1c a2 ad c1 39 1d 93 68 2b 9d 18 41 5a 4d b4 35 1d 63 1c d0 c4 a8 2d 1d b5 31 9f 51 a3 d1 38 25 48 34 8a 02 71 78 9f 7d d9 2d 62 98 04 19 8b aa a2 6e f5 f7 bc b7 36 7e 84 46 29 8a 5b b7 ee f0 fb af f5 5b a7 c4 95 64 85 ba f7 ec f7 79 Data Ascii: PNGIHDR0gAMAa cHRMz&u0`:pQ<tIME[bKGDCIDATxeey}2nPVC&FM;t`_9h+AZM5c-1Q8%H4qx}-bn6~F)[[dy
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: 13 fa 76 b2 cf 86 0c 00 00 00 00 00 70 c8 f2 cc e5 1b 45 8c 4f ee 8d f1 70 13 29 49 d2 5a 0c ff 0f 4f 1e 99 36 a0 2f da 88 01 00 00 00 00 00 56 dc a7 fb 62 3c bd a7 aa 0c a6 24 49 ab db 03 63 3c a1 11 c2 87 d2 e6 33 6f 03 06 00 00 00 00 00 58 71 f3 45 8c 97 25 c7 98 4c 49 92 56 b5 22 84 d7 a6 8d 67 cc e6 0b 00 00 00 00 00 b0 6a 76 34 ca f2 95 26 53 92 a4 55 ab 11 c2 79 69 c3 d9 64 d3 05 00 00 00 00 00 58 75 fd 45 59 9e 6b 42 25 49 5a d1 f2 37 66 1a 21 9c 91 36 9a eb 92 7d 36 5c 00 00 00 00 00 80 55 b7 94 5c db d7 df df 67 5a 25 49 5a b1 7a 63 7c 40 11 c2 87 d3 26 33 63 b3 05 00 00 00 00 00 58 33 33 45 08 1f 68 94 e5 fd 4c ac 24 49 87 5c 23 84 63 93 4b d3 06 33 6a 93 05 00 00 00 00 00 58 73 43 8d b2 fc b5 a2 2c 8f 36 b9 92 24 1d ca f0 7f 43 da 54 9e 93 7c Data Ascii: vpEOp)IZO6/Vb<$Ic<3oXqE%LIV"gjv4&SUyidXuEYkB%IZ7f!6}6\U\gZ%IZzc\|@&3cX33EhL$I\#cK3jXsC,6$CT\|
2025-03-27 14:32:51 UTC	11977	IN	Data Raw: 06 dc 7c 84 90 2d 8e 3e 4b f4 99 a2 cf 96 57 24 12 b2 b3 e9 c3 96 f3 dc c5 3c ef b6 b5 97 e9 c3 8e 4f a7 e5 e2 4a 45 1e e9 f5 f8 ed 4d b6 28 da 7e f4 48 92 03 d9 99 04 00 00 6c 9a c9 9c 6d 9f 4d 45 7d 86 b2 95 eb fe 2f 73 e1 ee a6 f1 02 00 80 8d b5 43 24 22 9f af 54 a4 c7 0b 48 b2 05 85 ff eb 1b 0d 79 53 26 e3 15 67 57 b2 da 1f 8b b1 33 80 69 67 fa fc 3a 20 16 f3 da 9e ee 38 91 1b 0e b9 21 09 21 1b 1d 7d 66 e8 b3 e3 9d d9 ac 57 40 d3 67 ca 0a fa 30 2c 82 ed 4c 5b 7b b1 f9 cd f4 76 d3 f6 7e d8 6a f1 3b 9c 6c 76 b4 ed e8 58 6e 07 8e d9 02 00 00 9b e6 6e ad 29 53 59 9f 9d ed ff 5f 66 2e 5a 9a 86 0b 00 00 36 86 6e cb 7e 4e a1 c0 56 da 64 93 a2 27 d8 d6 c6 63 79 a4 df 97 0b 4a 25 d9 c3 75 b9 9f e0 9b 6d 96 8f 4b a7 e5 aa 7a 5d dc c1 40 ca a3 11 ab 2b 09 21 bf Data Ascii: \|->KW$<OJEM(~HlmME}/sC$"THyS&gW3ig: 8!!}fW@g0,L[{v~j;lvXnn)SY_f.Z6n~NVd'cyJ%umKz]@+!
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: 65 f1 7f 89 eb fe 99 f9 e3 7e c5 05 02 00 20 18 d6 45 22 f2 85 6a 95 b7 2b 8b 1c 9d 6e 71 a9 f9 de 69 83 80 bf ad 71 1c f9 49 ab 25 4c 91 0a 46 4a a3 91 9c 53 28 f0 22 1d 00 80 4d b0 dc f8 05 47 c6 4d 25 ff 59 ab c9 4e 4c 1a 07 00 20 48 7e b5 95 eb fe a9 ff 26 00 44 22 cb cd 1f 67 71 81 00 00 08 86 bd 5d 57 ee 68 b7 79 b3 32 85 d5 1c c7 a4 52 b4 41 c0 c7 74 eb ff f7 17 8b ec 90 12 90 b4 c7 63 f9 8f 42 81 b6 0d 00 c0 66 b8 a0 5c 16 0e 01 58 fc e8 58 5d c7 ec b4 41 00 00 02 e3 d1 17 38 ce df fa 6e 02 c0 52 db 3e c8 fc 71 49 2e 10 00 00 c1 a0 db 39 ea d9 82 64 71 a3 67 89 eb ee 0b b4 41 c0 bf 8e 4b a7 25 c2 76 b7 81 48 73 3c 96 2b aa 55 b6 fd 07 00 60 33 1d 99 4c 7a 93 98 c9 e2 ef 5e 74 98 19 b3 d3 06 01 00 08 8c a4 d6 da 7d 37 01 60 ce b6 4f 36 7f 5c 85 0b Data Ascii: e~ E"j+nqiqI%LFJS("MGM%YNL H~&D"gq]Why2RAtcBf\XX]A8nR>qI.9dqgAK%vHs<+U`3Lz^t}7`O6\
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: 00 00 00 ef a0 57 0e c6 39 bb d1 68 7e 5d af cb fb 59 3d 8c 79 f8 64 22 c1 7d eb 50 4a bd 9e 9c 99 4c b2 8b 07 1c 6f de 3b 3f 95 92 17 1a 0d 6e 4a e2 fa e8 2d c2 7f 5a ab c9 19 6a ec dc ec cd 49 67 dd c0 72 71 3a 2d 6d 76 ad 70 24 af 35 9b 72 48 24 c2 78 8a 39 fb 70 38 3c a8 23 62 2e fa d9 5f bf bb 53 7f 00 00 80 06 00 00 00 30 a3 15 84 8f b2 7a c3 68 a2 ed b6 1c ce f6 8d 98 c7 3d 7b 5d 2e c7 19 df 0e e5 b9 46 43 f6 0f 87 a9 45 38 62 b1 f5 df 47 f7 dc 5d 2a 49 81 55 ff 64 4c 26 ac ae ca 66 65 af 60 70 50 bf 6f ad e7 a3 54 2d 07 d4 33 11 31 9f 62 af 27 9f 4d a5 18 57 31 67 c7 c7 62 52 e9 f5 b8 99 0c 46 bf b3 2f a5 01 00 00 00 d0 00 00 00 00 66 62 89 6d cb d7 f3 79 be a8 18 8c 9e b8 3d 3d 91 60 05 31 e6 64 87 40 40 7e cc b6 c9 8e 45 6f 5f bd 19 db 26 c3 01 Data Ascii: W9h~]Y=yd"}PJLo;?nJ-ZjIgrq:-mvp$5rH$x9p8<#b._S0zh={].FCE8bG]*IUdL&fe`pPoT-31b'MW1gbRF/fbmy==`1d@@~Eo_&
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: 5a bc 39 f3 70 74 c6 d5 bb a7 a7 65 b5 cf 5f 22 eb 2c 38 9d 0d 47 ec 44 8b 2d 76 66 26 18 00 e0 71 3b 53 88 67 35 6f c9 66 7d df 66 d6 99 67 b7 8f 16 0a 52 ed 53 2e ec e5 fc b4 5e 97 5d 03 b2 62 18 00 00 c0 e3 42 3a 26 3f 61 33 e6 9b de cb 81 07 00 00 41 a1 33 93 74 9f f9 19 5e ec 79 36 ba db ea 3d ad 96 1c 9a 48 50 00 40 28 00 00 00 50 00 40 01 80 15 c7 a7 52 f2 68 a7 c3 c9 f4 70 b4 0f 77 46 2e e7 fb 42 61 00 00 80 bf 70 ef 84 ed 98 6f fa 1d 0e 3c 00 00 08 92 bd 62 b1 e1 cc 11 e2 dd 34 07 03 b9 b2 52 91 cd 3e 1e d0 a5 00 c0 6e 7e 6c 3e d3 7b 30 1b 0c 00 f0 38 bd 27 fc 98 e7 3d 0a 00 e6 51 30 f2 8d d9 59 e9 0e 06 9c 4c 8f cf fe d7 be 1c d7 38 00 00 10 30 df b1 5f 00 10 0a 7d 94 03 0f 00 00 82 44 67 8c 9c 3b 3d 2d c5 5e 8f b7 68 1e 4e ba db 95 37 a4 d3 be Data Ascii: Z9pte_",8GD-vf&q;Sg5of}fgRS.^]bB:&?a3A3t^y6=HP@(P@RhpwF.Bapo<b4R>n~l>{08'=Q0YL80_}Dg;=-^hN7
2025-03-27 14:32:51 UTC	16384	IN	Data Raw: b5 8b fb fa e2 8a a5 25 6f a3 8a dc 44 f2 0c e9 dd d8 88 d7 ce cc b4 8f 70 cf 47 53 9f ac 49 c5 f7 c8 63 22 8f 8d 3c 46 de 90 c6 ca 60 1a 33 aa ab c8 4d 6f b6 fa 97 b4 16 b9 53 a3 a1 8e 00 00 d0 11 6f ff f7 94 e5 e3 74 b4 e5 d8 36 00 14 c5 29 49 c3 04 02 00 a0 13 9c 51 96 f1 97 b3 b3 31 be b9 a9 0b 21 72 14 99 6b 36 e3 1f 17 17 db 6f 76 3f 70 60 a0 fd 96 f7 61 b5 a4 b2 f2 77 7f 5e 1a 03 bf 30 38 18 bf 33 3e de 1e 1b 79 8c 88 c8 4d 27 af 3d de 36 37 d7 5e 8b a8 27 00 00 74 c8 db ff 5f 4d 8e e8 68 cb 31 a5 a7 5e ff f1 43 65 f9 6a 93 08 00 80 4e 71 9b 7a 3d 7e 6f 62 22 be ba b6 16 2d fd 08 91 a3 4a 3e 39 e3 9a 34 67 72 f3 ea 77 c7 c6 e2 9e 7d 7d ea 49 85 9c 5a 96 71 ff 81 81 f6 77 ff ce f9 f9 f8 fa fa ba 23 fe 45 8e 32 79 ad f1 8d 34 67 5e 90 d6 1e 79 0d a2 Data Ascii: %oDpGSIc"<F`3MoSot6)IQ1!rk6ov?p`aw^083>yM'=67^'t_Mh1^CejNqz=~ob"-J>94grw}}IZqw#E2y4g^y
2025-03-27 14:32:51 UTC	11722	IN	Data Raw: 4b 77 38 94 03 00 00 00 00 1c b3 dd 4d 29 7f 5c ef 5e dd 40 4b 92 24 69 c5 6b bb ee 8c 3c 94 be 35 7d dd e1 1c 00 00 00 00 e0 a8 d5 3b d6 77 34 a5 3c c4 cd b3 24 49 92 56 ef 25 80 52 86 79 30 7d 63 ba cd 21 1d 00 00 00 00 e0 88 ed 5d bc 63 2d 65 e8 c6 59 92 24 49 e3 f0 12 c0 a9 79 40 7d 49 da e3 b0 0e 00 00 00 00 70 d8 ea 9d ea 4b eb 1d ab 9b 66 49 92 24 8d d3 4b 00 9b d2 4f e7 61 75 5b 3a e8 e0 0e 00 00 00 00 70 b7 ea 1d ea 2d 8b 7f 58 55 ca 26 37 cc 92 24 49 1a bb 06 7d 3f d7 44 fc 78 1e 5a bf 94 f6 39 c4 03 00 00 00 00 7c 87 03 e9 aa 26 e2 e9 c3 be 3f de cd b2 24 49 92 c6 f9 25 80 75 a3 88 27 e6 01 f6 13 87 0e b2 0e f4 00 00 00 00 00 ff 32 fc ff 7c 53 ca d3 ea 5d aa 1b 65 49 92 24 4d 44 79 80 7d 54 1e 64 ff af 03 3d 00 00 00 00 c0 37 7d ba 89 78 ac e1 Data Ascii: Kw8M)\^@K$ik<5};w4<$IV%Ry0}c!]c-eY$Iy@}IpKfI$KOau[:p-XU&7$I}?DxZ9\|&?$I%u'2\|S]eI$MDy}Td=7}x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49717	151.101.46.208	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	685	OUT	GET /photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200 HTTP/1.1 Host: images.unsplash.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	560	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5475 x-imgix-id: 164340ef9509eb86f23227df1f160bf64fa1cd67 cache-control: public, max-age=31536000 last-modified: Wed, 12 Mar 2025 07:59:23 GMT Server: imgix Date: Thu, 27 Mar 2025 14:32:51 GMT Age: 1319608 Accept-Ranges: bytes Content-Type: image/avif Access-Control-Allow-Origin: * Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Served-By: cache-chi-kigq8000100-CHI, cache-nyc-kteb1890098-NYC X-Cache: HIT, HIT Vary: Accept, User-Agent
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 00 00 00 20 66 74 79 70 61 76 69 66 00 00 00 00 61 76 69 66 6d 69 66 31 6d 69 61 66 4d 41 31 42 00 00 0d 47 6d 65 74 61 00 00 00 00 00 00 00 28 68 64 6c 72 00 00 00 00 00 00 00 00 70 69 63 74 00 00 00 00 00 00 00 00 00 00 00 00 6c 69 62 61 76 69 66 00 00 00 00 0e 70 69 74 6d 00 00 00 00 00 01 00 00 00 1e 69 6c 6f 63 00 00 00 00 44 00 00 01 00 01 00 00 00 01 00 00 0d 6f 00 00 07 f4 00 00 00 28 69 69 6e 66 00 00 00 00 00 01 00 00 00 1a 69 6e 66 65 02 00 00 00 00 01 00 00 61 76 30 31 43 6f 6c 6f 72 00 00 00 0c bf 69 70 72 70 00 00 0c 9f 69 70 63 6f 00 00 00 14 69 73 70 65 00 00 00 00 00 00 00 c8 00 00 00 c8 00 00 00 10 70 69 78 69 00 00 00 00 03 08 08 08 00 00 00 0c 61 76 31 43 81 00 0c 00 00 00 0c 54 63 6f 6c 72 70 72 6f 66 00 00 0c 48 4c 69 6e 6f 02 10 00 Data Ascii: ftypavifavifmif1miafMA1BGmeta(hdlrpictlibavifpitmilocDo(iinfinfeav01Coloriprpipcoispepixiav1CTcolrprofHLino
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 5e 00 63 00 68 00 6d 00 72 00 77 00 7c 00 81 00 86 00 8b 00 90 00 95 00 9a 00 9f 00 a4 00 a9 00 ae 00 b2 00 b7 00 bc 00 c1 00 c6 00 cb 00 d0 00 d5 00 db 00 e0 00 e5 00 eb 00 f0 00 f6 00 fb 01 01 01 07 01 0d 01 13 01 19 01 1f 01 25 01 2b 01 32 01 38 01 3e 01 45 01 4c 01 52 01 59 01 60 01 67 01 6e 01 75 01 7c 01 83 01 8b 01 92 01 9a 01 a1 01 a9 01 b1 01 b9 01 c1 01 c9 01 d1 01 d9 01 e1 01 e9 01 f2 01 fa 02 03 02 0c 02 14 02 1d 02 26 02 2f 02 38 02 41 02 4b 02 54 02 5d 02 67 02 71 02 7a 02 84 02 8e 02 98 02 a2 02 ac 02 b6 02 c1 02 cb 02 d5 02 e0 02 eb 02 f5 03 00 03 0b 03 16 03 21 03 2d 03 38 03 43 03 4f 03 5a 03 66 03 72 03 7e 03 8a 03 96 03 a2 03 ae 03 ba 03 c7 03 d3 03 e0 03 ec 03 f9 04 06 04 13 04 20 04 2d 04 3b 04 48 04 55 04 63 04 71 04 7e 04 8c 04 9a Data Ascii: ^chmrw\|%+28>ELRY`gnu\|&/8AKT]gqz!-8COZfr~ -;HUcq~
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 70 2b 70 86 70 e0 71 3a 71 95 71 f0 72 4b 72 a6 73 01 73 5d 73 b8 74 14 74 70 74 cc 75 28 75 85 75 e1 76 3e 76 9b 76 f8 77 56 77 b3 78 11 78 6e 78 cc 79 2a 79 89 79 e7 7a 46 7a a5 7b 04 7b 63 7b c2 7c 21 7c 81 7c e1 7d 41 7d a1 7e 01 7e 62 7e c2 7f 23 7f 84 7f e5 80 47 80 a8 81 0a 81 6b 81 cd 82 30 82 92 82 f4 83 57 83 ba 84 1d 84 80 84 e3 85 47 85 ab 86 0e 86 72 86 d7 87 3b 87 9f 88 04 88 69 88 ce 89 33 89 99 89 fe 8a 64 8a ca 8b 30 8b 96 8b fc 8c 63 8c ca 8d 31 8d 98 8d ff 8e 66 8e ce 8f 36 8f 9e 90 06 90 6e 90 d6 91 3f 91 a8 92 11 92 7a 92 e3 93 4d 93 b6 94 20 94 8a 94 f4 95 5f 95 c9 96 34 96 9f 97 0a 97 75 97 e0 98 4c 98 b8 99 24 99 90 99 fc 9a 68 9a d5 9b 42 9b af 9c 1c 9c 89 9c f7 9d 64 9d d2 9e 40 9e ae 9f 1d 9f 8b 9f fa a0 69 a0 d8 a1 47 a1 b6 a2 Data Ascii: p+ppq:qqrKrss]sttptu(uuv>vvwVwxxnxy*yyzFz{{c{\|!\|\|}A}~~b~#Gk0WGr;i3d0c1f6n?zM _4uL$hBd@iG
2025-03-27 14:32:51 UTC	1338	IN	Data Raw: 2b ca 02 d0 b7 95 a2 60 f4 c8 14 bb f4 fa d2 c9 33 3c 90 20 6f 49 ee 47 ff 37 f8 76 89 fe cd a4 37 57 3f c5 55 f2 6c e5 48 d9 d5 80 8b bc e4 38 47 3c a7 51 0b d9 f7 58 5e 28 39 22 00 26 5d 54 4c 26 b2 00 00 00 00 09 cb 35 f3 8a 06 3c a4 27 3b a3 40 00 80 e3 a8 83 da b6 58 2d df c8 dd 1a 3c 6c 48 a1 dc ba be ca 68 8f 2f 5a 07 30 d4 93 74 ab d3 0e 2d 0e d5 87 62 a4 49 1d b5 47 14 58 b7 3d ba 2f 75 0e 6d 1e 97 c9 5c bc 3b 0f 5a 67 69 cc 05 b6 5f fb 10 d0 87 c8 04 f9 78 44 97 58 53 5d 22 04 7c 2d 3c 23 fc 7e e4 f7 2a 21 c5 b3 11 d3 61 a2 fb ff 2c 6d 57 df 0b b3 e5 46 f1 f5 e0 ed 4b d1 fa 68 bc f0 8a 85 bb d4 d7 81 28 77 f6 54 67 3b cc 41 cd 65 69 71 30 6f 19 3d d1 f4 6b 3b 81 dd 89 b2 34 df 6c 10 90 df cb d2 32 da ef c5 1e 66 0e 21 93 db 60 d0 3b 3b 7b c6 b9 Data Ascii: +`3< oIG7v7W?UlH8G<QX^(9"&]TL&5<';@X-<lHh/Z0t-bIGX=/um\;Zgi_xDXS]"\|-<#~*!a,mWFKh(wTg;Aeiq0o=k;4l2f!`;;{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49719	104.22.21.144	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	567	OUT	GET /3.4.16 HTTP/1.1 Host: cdn.tailwindcss.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	424	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 14:32:51 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=31536000 strict-transport-security: max-age=63072000 x-vercel-cache: MISS x-vercel-id: cle1::iad1::6rj9h-1742830770833-7403663bdf54 Last-Modified: Mon, 24 Mar 2025 15:39:32 GMT CF-Cache-Status: HIT Age: 255198 Server: cloudflare CF-RAY: 926f997a0ac749aa-EWR
2025-03-27 14:32:51 UTC	945	IN	Data Raw: 37 64 66 35 0d 0a 28 28 29 3d 3e 7b 76 61 72 20 71 76 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3b 76 61 72 20 48 69 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 76 61 72 20 24 76 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3b 76 61 72 20 4c 76 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 4e 61 6d 65 73 3b 76 61 72 20 4d 76 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 2c 4e 76 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 76 61 72 20 64 66 3d 72 3d 3e 48 69 28 72 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 68 66 3d 72 3d 3e 7b 69 66 28 74 79 Data Ascii: 7df5(()=>{var qv=Object.create;var Hi=Object.defineProperty;var $v=Object.getOwnPropertyDescriptor;var Lv=Object.getOwnPropertyNames;var Mv=Object.getPrototypeOf,Nv=Object.prototype.hasOwnProperty;var df=r=>Hi(r,"__esModule",{value:!0});var hf=r=>{if(ty
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 72 65 61 64 46 69 6c 65 53 79 6e 63 3a 72 3d 3e 73 65 6c 66 5b 72 5d 7c 7c 22 22 2c 73 74 61 74 53 79 6e 63 3a 28 29 3d 3e 28 7b 6d 74 69 6d 65 4d 73 3a 46 76 2b 2b 7d 29 2c 70 72 6f 6d 69 73 65 73 3a 7b 72 65 61 64 46 69 6c 65 3a 72 3d 3e 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 65 6c 66 5b 72 5d 7c 7c 22 22 29 7d 7d 7d 29 3b 76 61 72 20 46 73 3d 78 28 28 6f 50 2c 67 66 29 3d 3e 7b 75 28 29 3b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6d 66 3d 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 3d 7b 7d 29 7b 69 66 28 21 28 65 2e 6d 61 78 53 69 7a 65 26 26 65 2e 6d 61 78 53 69 7a 65 3e 30 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 60 6d 61 78 53 69 7a 65 60 20 6d 75 73 74 20 62 65 20 61 20 6e 75 6d 62 65 Data Ascii: readFileSync:r=>self[r]\|\|"",statSync:()=>({mtimeMs:Fv++}),promises:{readFile:r=>Promise.resolve(self[r]\|\|"")}}});var Fs=x((oP,gf)=>{u();"use strict";var mf=class{constructor(e={}){if(!(e.maxSize&&e.maxSize>0))throw new TypeError("`maxSize` must be a numbe
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 6c 65 74 65 49 66 45 78 70 69 72 65 64 28 74 2c 69 29 3d 3d 3d 21 31 26 26 28 79 69 65 6c 64 20 65 29 7d 7d 67 65 74 28 65 29 7b 69 66 28 74 68 69 73 2e 63 61 63 68 65 2e 68 61 73 28 65 29 29 7b 6c 65 74 20 74 3d 74 68 69 73 2e 63 61 63 68 65 2e 67 65 74 28 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 56 61 6c 75 65 28 65 2c 74 29 7d 69 66 28 74 68 69 73 2e 6f 6c 64 43 61 63 68 65 2e 68 61 73 28 65 29 29 7b 6c 65 74 20 74 3d 74 68 69 73 2e 6f 6c 64 43 61 63 68 65 2e 67 65 74 28 65 29 3b 69 66 28 74 68 69 73 2e 5f 64 65 6c 65 74 65 49 66 45 78 70 69 72 65 64 28 65 2c 74 29 3d 3d 3d 21 31 29 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 6d 6f 76 65 54 6f 52 65 63 65 6e 74 28 65 2c 74 29 2c 74 2e 76 61 6c 75 65 7d 7d 73 65 74 28 65 2c 74 2c Data Ascii: leteIfExpired(t,i)===!1&&(yield e)}}get(e){if(this.cache.has(e)){let t=this.cache.get(e);return this._getItemValue(e,t)}if(this.oldCache.has(e)){let t=this.oldCache.get(e);if(this._deleteIfExpired(e,t)===!1)return this._moveToRecent(e,t),t.value}}set(e,t,
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 74 68 69 73 2e 63 61 63 68 65 2e 68 61 73 28 74 29 7c 7c 74 68 69 73 2e 5f 64 65 6c 65 74 65 49 66 45 78 70 69 72 65 64 28 74 2c 69 29 3d 3d 3d 21 31 26 26 28 79 69 65 6c 64 5b 74 2c 69 2e 76 61 6c 75 65 5d 29 7d 7d 2a 65 6e 74 72 69 65 73 44 65 73 63 65 6e 64 69 6e 67 28 29 7b 6c 65 74 20 65 3d 5b 2e 2e 2e 74 68 69 73 2e 63 61 63 68 65 5d 3b 66 6f 72 28 6c 65 74 20 74 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 74 3e 3d 30 3b 2d 2d 74 29 7b 6c 65 74 20 69 3d 65 5b 74 5d 2c 5b 6e 2c 73 5d 3d 69 3b 74 68 69 73 2e 5f 64 65 6c 65 74 65 49 66 45 78 70 69 72 65 64 28 6e 2c 73 29 3d 3d 3d 21 31 26 26 28 79 69 65 6c 64 5b 6e 2c 73 2e 76 61 6c 75 65 5d 29 7d 65 3d 5b 2e 2e 2e 74 68 69 73 2e 6f 6c 64 43 61 63 68 65 5d 3b 66 6f 72 28 6c 65 74 20 74 3d 65 2e 6c 65 6e 67 74 Data Ascii: this.cache.has(t)\|\|this._deleteIfExpired(t,i)===!1&&(yield[t,i.value])}}*entriesDescending(){let e=[...this.cache];for(let t=e.length-1;t>=0;--t){let i=e[t],[n,s]=i;this._deleteIfExpired(n,s)===!1&&(yield[n,s.value])}e=[...this.oldCache];for(let t=e.lengt
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 78 22 2c 22 66 6c 65 78 53 68 72 69 6e 6b 22 2c 22 66 6c 65 78 47 72 6f 77 22 2c 22 66 6c 65 78 42 61 73 69 73 22 2c 22 74 61 62 6c 65 4c 61 79 6f 75 74 22 2c 22 63 61 70 74 69 6f 6e 53 69 64 65 22 2c 22 62 6f 72 64 65 72 43 6f 6c 6c 61 70 73 65 22 2c 22 62 6f 72 64 65 72 53 70 61 63 69 6e 67 22 2c 22 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 22 2c 22 74 72 61 6e 73 6c 61 74 65 22 2c 22 72 6f 74 61 74 65 22 2c 22 73 6b 65 77 22 2c 22 73 63 61 6c 65 22 2c 22 74 72 61 6e 73 66 6f 72 6d 22 2c 22 61 6e 69 6d 61 74 69 6f 6e 22 2c 22 63 75 72 73 6f 72 22 2c 22 74 6f 75 63 68 41 63 74 69 6f 6e 22 2c 22 75 73 65 72 53 65 6c 65 63 74 22 2c 22 72 65 73 69 7a 65 22 2c 22 73 63 72 6f 6c 6c 53 6e 61 70 54 79 70 65 22 2c 22 73 63 72 6f 6c 6c 53 6e 61 70 41 6c 69 67 Data Ascii: x","flexShrink","flexGrow","flexBasis","tableLayout","captionSide","borderCollapse","borderSpacing","transformOrigin","translate","rotate","skew","scale","transform","animation","cursor","touchAction","userSelect","resize","scrollSnapType","scrollSnapAlig
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 22 2c 22 74 65 78 74 4f 70 61 63 69 74 79 22 2c 22 74 65 78 74 44 65 63 6f 72 61 74 69 6f 6e 22 2c 22 74 65 78 74 44 65 63 6f 72 61 74 69 6f 6e 43 6f 6c 6f 72 22 2c 22 74 65 78 74 44 65 63 6f 72 61 74 69 6f 6e 53 74 79 6c 65 22 2c 22 74 65 78 74 44 65 63 6f 72 61 74 69 6f 6e 54 68 69 63 6b 6e 65 73 73 22 2c 22 74 65 78 74 55 6e 64 65 72 6c 69 6e 65 4f 66 66 73 65 74 22 2c 22 66 6f 6e 74 53 6d 6f 6f 74 68 69 6e 67 22 2c 22 70 6c 61 63 65 68 6f 6c 64 65 72 43 6f 6c 6f 72 22 2c 22 70 6c 61 63 65 68 6f 6c 64 65 72 4f 70 61 63 69 74 79 22 2c 22 63 61 72 65 74 43 6f 6c 6f 72 22 2c 22 61 63 63 65 6e 74 43 6f 6c 6f 72 22 2c 22 6f 70 61 63 69 74 79 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 42 6c 65 6e 64 4d 6f 64 65 22 2c 22 6d 69 78 42 6c 65 6e 64 4d 6f 64 65 22 2c Data Ascii: ","textOpacity","textDecoration","textDecorationColor","textDecorationStyle","textDecorationThickness","textUnderlineOffset","fontSmoothing","placeholderColor","placeholderOpacity","caretColor","accentColor","opacity","backgroundBlendMode","mixBlendMode",
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 61 79 2e 69 73 41 72 72 61 79 28 72 29 3f 5b 72 5d 3a 5b 65 2c 72 5d 29 7d 2c 77 61 72 6e 28 72 2c 65 29 7b 5b 22 63 6f 6e 74 65 6e 74 2d 70 72 6f 62 6c 65 6d 73 22 5d 2e 69 6e 63 6c 75 64 65 73 28 72 29 7c 7c 6a 73 28 51 65 2e 62 6f 6c 64 28 51 65 2e 79 65 6c 6c 6f 77 28 22 77 61 72 6e 22 29 29 2c 2e 2e 2e 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 3f 5b 72 5d 3a 5b 65 2c 72 5d 29 7d 2c 72 69 73 6b 28 72 2c 65 29 7b 6a 73 28 51 65 2e 62 6f 6c 64 28 51 65 2e 6d 61 67 65 6e 74 61 28 22 72 69 73 6b 22 29 29 2c 2e 2e 2e 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 3f 5b 72 5d 3a 5b 65 2c 72 5d 29 7d 7d 7d 29 3b 76 61 72 20 5f 66 3d 7b 7d 3b 47 65 28 5f 66 2c 7b 64 65 66 61 75 6c 74 3a 28 29 3d 3e 55 73 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 71 72 28 7b Data Ascii: ay.isArray(r)?[r]:[e,r])},warn(r,e){["content-problems"].includes(r)\|\|js(Qe.bold(Qe.yellow("warn")),...Array.isArray(r)?[r]:[e,r])},risk(r,e){js(Qe.bold(Qe.magenta("risk")),...Array.isArray(r)?[r]:[e,r])}}});var _f={};Ge(_f,{default:()=>Us});function qr({
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 3a 22 23 66 65 66 32 66 32 22 2c 31 30 30 3a 22 23 66 65 65 32 65 32 22 2c 32 30 30 3a 22 23 66 65 63 61 63 61 22 2c 33 30 30 3a 22 23 66 63 61 35 61 35 22 2c 34 30 30 3a 22 23 66 38 37 31 37 31 22 2c 35 30 30 3a 22 23 65 66 34 34 34 34 22 2c 36 30 30 3a 22 23 64 63 32 36 32 36 22 2c 37 30 30 3a 22 23 62 39 31 63 31 63 22 2c 38 30 30 3a 22 23 39 39 31 62 31 62 22 2c 39 30 30 3a 22 23 37 66 31 64 31 64 22 2c 39 35 30 3a 22 23 34 35 30 61 30 61 22 7d 2c 6f 72 61 6e 67 65 3a 7b 35 30 3a 22 23 66 66 66 37 65 64 22 2c 31 30 30 3a 22 23 66 66 65 64 64 35 22 2c 32 30 30 3a 22 23 66 65 64 37 61 61 22 2c 33 30 30 3a 22 23 66 64 62 61 37 34 22 2c 34 30 30 3a 22 23 66 62 39 32 33 63 22 2c 35 30 30 3a 22 23 66 39 37 33 31 36 22 2c 36 30 30 3a 22 23 65 61 35 38 30 63 Data Ascii: :"#fef2f2",100:"#fee2e2",200:"#fecaca",300:"#fca5a5",400:"#f87171",500:"#ef4444",600:"#dc2626",700:"#b91c1c",800:"#991b1b",900:"#7f1d1d",950:"#450a0a"},orange:{50:"#fff7ed",100:"#ffedd5",200:"#fed7aa",300:"#fdba74",400:"#fb923c",500:"#f97316",600:"#ea580c
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 2c 36 30 30 3a 22 23 30 38 39 31 62 32 22 2c 37 30 30 3a 22 23 30 65 37 34 39 30 22 2c 38 30 30 3a 22 23 31 35 35 65 37 35 22 2c 39 30 30 3a 22 23 31 36 34 65 36 33 22 2c 39 35 30 3a 22 23 30 38 33 33 34 34 22 7d 2c 73 6b 79 3a 7b 35 30 3a 22 23 66 30 66 39 66 66 22 2c 31 30 30 3a 22 23 65 30 66 32 66 65 22 2c 32 30 30 3a 22 23 62 61 65 36 66 64 22 2c 33 30 30 3a 22 23 37 64 64 33 66 63 22 2c 34 30 30 3a 22 23 33 38 62 64 66 38 22 2c 35 30 30 3a 22 23 30 65 61 35 65 39 22 2c 36 30 30 3a 22 23 30 32 38 34 63 37 22 2c 37 30 30 3a 22 23 30 33 36 39 61 31 22 2c 38 30 30 3a 22 23 30 37 35 39 38 35 22 2c 39 30 30 3a 22 23 30 63 34 61 36 65 22 2c 39 35 30 3a 22 23 30 38 32 66 34 39 22 7d 2c 62 6c 75 65 3a 7b 35 30 3a 22 23 65 66 66 36 66 66 22 2c 31 30 30 3a 22 Data Ascii: ,600:"#0891b2",700:"#0e7490",800:"#155e75",900:"#164e63",950:"#083344"},sky:{50:"#f0f9ff",100:"#e0f2fe",200:"#bae6fd",300:"#7dd3fc",400:"#38bdf8",500:"#0ea5e9",600:"#0284c7",700:"#0369a1",800:"#075985",900:"#0c4a6e",950:"#082f49"},blue:{50:"#eff6ff",100:"
2025-03-27 14:32:51 UTC	1369	IN	Data Raw: 42 6c 75 65 28 29 7b 72 65 74 75 72 6e 20 71 72 28 7b 76 65 72 73 69 6f 6e 3a 22 76 32 2e 32 22 2c 66 72 6f 6d 3a 22 6c 69 67 68 74 42 6c 75 65 22 2c 74 6f 3a 22 73 6b 79 22 7d 29 2c 74 68 69 73 2e 73 6b 79 7d 2c 67 65 74 20 77 61 72 6d 47 72 61 79 28 29 7b 72 65 74 75 72 6e 20 71 72 28 7b 76 65 72 73 69 6f 6e 3a 22 76 33 2e 30 22 2c 66 72 6f 6d 3a 22 77 61 72 6d 47 72 61 79 22 2c 74 6f 3a 22 73 74 6f 6e 65 22 7d 29 2c 74 68 69 73 2e 73 74 6f 6e 65 7d 2c 67 65 74 20 74 72 75 65 47 72 61 79 28 29 7b 72 65 74 75 72 6e 20 71 72 28 7b 76 65 72 73 69 6f 6e 3a 22 76 33 2e 30 22 2c 66 72 6f 6d 3a 22 74 72 75 65 47 72 61 79 22 2c 74 6f 3a 22 6e 65 75 74 72 61 6c 22 7d 29 2c 74 68 69 73 2e 6e 65 75 74 72 61 6c 7d 2c 67 65 74 20 63 6f 6f 6c 47 72 61 79 28 29 7b 72 Data Ascii: Blue(){return qr({version:"v2.2",from:"lightBlue",to:"sky"}),this.sky},get warmGray(){return qr({version:"v3.0",from:"warmGray",to:"stone"}),this.stone},get trueGray(){return qr({version:"v3.0",from:"trueGray",to:"neutral"}),this.neutral},get coolGray(){r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49721	151.101.46.208	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	447	OUT	GET /photo-1633409361618-c73427e4e206?auto=format&fit=crop&q=80&w=200 HTTP/1.1 Host: images.unsplash.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	560	IN	HTTP/1.1 200 OK Connection: close Content-Length: 7466 x-imgix-id: f6b9b2d339095ce7ed7d3e1d7273eedbccc7c8c3 cache-control: public, max-age=31536000 last-modified: Wed, 19 Mar 2025 03:39:59 GMT Server: imgix Date: Thu, 27 Mar 2025 14:32:51 GMT Age: 730372 Accept-Ranges: bytes Content-Type: image/jpeg Access-Control-Allow-Origin: * Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Served-By: cache-chi-klot8100093-CHI, cache-nyc-kteb1890055-NYC X-Cache: HIT, MISS Vary: Accept, User-Agent
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFHHXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 66 03 72 03 7e 03 8a 03 96 03 a2 03 ae 03 ba 03 c7 03 d3 03 e0 03 ec 03 f9 04 06 04 13 04 20 04 2d 04 3b 04 48 04 55 04 63 04 71 04 7e 04 8c 04 9a 04 a8 04 b6 04 c4 04 d3 04 e1 04 f0 04 fe 05 0d 05 1c 05 2b 05 3a 05 49 05 58 05 67 05 77 05 86 05 96 05 a6 05 b5 05 c5 05 d5 05 e5 05 f6 06 06 06 16 06 27 06 37 06 48 06 59 06 6a 06 7b 06 8c 06 9d 06 af 06 c0 06 d1 06 e3 06 f5 07 07 07 19 07 2b 07 3d 07 4f 07 61 07 74 07 86 07 99 07 ac 07 bf 07 d2 07 e5 07 f8 08 0b 08 1f 08 32 08 46 08 5a 08 6e 08 82 08 96 08 aa 08 be 08 d2 08 e7 08 fb 09 10 09 25 09 3a 09 4f 09 64 09 79 09 8f 09 a4 09 ba 09 cf 09 e5 09 fb 0a 11 0a 27 0a 3d 0a 54 0a 6a 0a 81 0a 98 0a ae 0a c5 0a dc 0a f3 0b 0b 0b 22 0b 39 0b 51 0b 69 0b 80 0b 98 0b b0 0b c8 0b e1 0b f9 0c 12 0c 2a 0c 43 0c 5c Data Ascii: fr~ -;HUcq~+:IXgw'7HYj{+=Oat2FZn%:Ody'=Tj"9Qi*C\
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 97 e0 98 4c 98 b8 99 24 99 90 99 fc 9a 68 9a d5 9b 42 9b af 9c 1c 9c 89 9c f7 9d 64 9d d2 9e 40 9e ae 9f 1d 9f 8b 9f fa a0 69 a0 d8 a1 47 a1 b6 a2 26 a2 96 a3 06 a3 76 a3 e6 a4 56 a4 c7 a5 38 a5 a9 a6 1a a6 8b a6 fd a7 6e a7 e0 a8 52 a8 c4 a9 37 a9 a9 aa 1c aa 8f ab 02 ab 75 ab e9 ac 5c ac d0 ad 44 ad b8 ae 2d ae a1 af 16 af 8b b0 00 b0 75 b0 ea b1 60 b1 d6 b2 4b b2 c2 b3 38 b3 ae b4 25 b4 9c b5 13 b5 8a b6 01 b6 79 b6 f0 b7 68 b7 e0 b8 59 b8 d1 b9 4a b9 c2 ba 3b ba b5 bb 2e bb a7 bc 21 bc 9b bd 15 bd 8f be 0a be 84 be ff bf 7a bf f5 c0 70 c0 ec c1 67 c1 e3 c2 5f c2 db c3 58 c3 d4 c4 51 c4 ce c5 4b c5 c8 c6 46 c6 c3 c7 41 c7 bf c8 3d c8 bc c9 3a c9 b9 ca 38 ca b7 cb 36 cb b6 cc 35 cc b5 cd 35 cd b5 ce 36 ce b6 cf 37 cf b8 d0 39 d0 ba d1 3c d1 be d2 3f d2 Data Ascii: L$hBd@iG&vV8nR7u\D-u`K8%yhYJ;.!zpg_XQKFA=:8655679<?
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 22 44 a6 95 0e 92 a9 24 a8 4c 95 10 49 7a 7f ff c4 00 22 10 00 01 04 03 01 01 01 01 01 01 01 00 00 00 00 00 11 01 02 03 04 00 05 06 07 10 12 20 13 08 16 ff da 00 08 01 01 00 01 02 00 03 00 00 00 00 00 2a 00 06 00 00 c0 00 00 0c 03 06 00 06 00 30 60 00 00 07 c1 80 00 00 00 60 c0 00 c0 00 00 00 00 00 01 83 00 c1 f0 00 00 00 00 00 00 0c 03 00 18 c8 63 d7 4b 41 5a 00 00 00 00 18 00 c0 1a c8 68 31 9f 24 82 6d 73 e3 00 00 00 03 06 0c 7b fa 1f 53 e6 bd 5a 29 7f 8d 96 d7 7b de eb bb 7a 1b 60 00 00 0c 18 3a 2f 46 df 75 29 12 45 a4 e8 74 3e bf 43 69 6a ee e7 bf b3 32 b1 58 8d d7 75 fa de 98 00 00 c1 9e 8d db d4 9d b1 b6 24 89 22 6d 6d 16 a3 6d 1c b5 d5 8a d5 62 b6 cd cb 56 63 40 00 18 07 a1 62 c3 5f 65 4b 63 1d 7d 77 2b 5b 53 f8 45 57 4d 4d f0 5a b3 6b 62 f9 1c b1 Data Ascii: "D$LIz" *0``cKAZh1$ms{SZ){z`:/Fu)Et>Cij2Xu$"mmmbVc@b_eKc}w+[SEWMMZkb
2025-03-27 14:32:51 UTC	1379	IN	Data Raw: 4c 53 23 09 78 a5 31 95 fc f9 57 74 ed 1b 44 60 06 80 55 ae 21 25 a4 1d 8c ad 7b 9f 25 86 f8 a9 a8 25 28 93 99 97 e7 58 6b 9e 03 74 33 31 66 72 cc 76 b3 1b 93 17 a9 11 79 27 b3 f2 e8 77 a9 7e a8 ea 7e 5c 63 7f 6e 3d c1 d0 09 85 d5 0f fb 07 dd 10 09 6c 97 80 1e 68 00 0d fd b9 2d be 33 aa 04 77 83 fd 3f 96 56 77 54 40 4b 31 00 01 e5 30 44 b4 1e 45 1d 4e 3f 41 f0 a1 ca 40 29 29 ea a9 16 a1 02 cb 4b ca 9c a0 4a 5b 9b 92 55 c9 3c 23 03 c4 e6 09 52 ea 0c aa 8d f4 d3 c7 37 37 b0 1d bc 46 5e 66 8e 72 df 6c e2 7f 01 05 89 d3 1a 36 c5 c9 8e ff 00 33 d5 c8 60 f3 e2 f1 7a 7e c5 fc b2 55 d5 11 ab 9a be 58 a5 a7 00 91 9c d1 aa bc 07 40 f4 7f 69 7c a5 f6 a5 fe da c5 25 5c bc c9 f2 52 60 da 2e 36 1f 28 8e 51 e1 76 14 95 bd d3 24 7f c7 ab 25 fb 16 67 84 3b 6f 18 4c d7 59 Data Ascii: LS#x1WtD`U!%{%%(Xkt31frvy'w~~\cn=lh-3w?VwT@K10DEN?A@))KJ[U<#R77F^frl63`z~UX@i\|%\R`.6(Qv$%g;oLY
2025-03-27 14:32:51 UTC	571	IN	Data Raw: cc 8c 00 ed 27 01 15 1a 6d 4a 41 dd 9c cc b2 da 3c ae 30 3d 87 23 e1 a9 57 a9 f4 f4 f9 67 2e ae 48 4e 2a 31 4d af 52 e7 c0 0c be 35 fd 1a b8 55 bf 41 f7 3d 4a a5 98 9b 9e 5e ba 1c 42 56 96 db 38 59 42 e3 59 51 2e dc b4 ab 29 69 96 90 da 13 92 52 2c 22 63 60 fb 4a 6d d6 d2 e2 0e 69 50 04 1e e3 1a 45 a2 94 26 db 53 ac bf e2 aa cc 23 e3 24 f6 0c e3 48 e6 74 81 8b a5 a6 76 6c fa 54 f1 13 ff 00 30 b6 96 a5 12 a2 4a 89 c4 9c e3 62 44 53 34 a2 b1 2c a0 80 af 18 40 c0 85 9c bf 76 f5 0d c2 28 f4 eb 1f aa b3 ec 08 7a 5d 87 79 6a 9e a9 ff 00 51 a4 15 ea 8b 13 6f cb 4b b7 f2 66 ca 73 33 dc 21 f9 b7 9c 52 94 e3 8a 52 8e 64 98 71 60 88 a9 d0 a4 5d 6d 4e 16 75 0f 54 8b 43 b2 97 75 69 27 85 2a 22 dd 9d 61 0d 25 20 00 20 65 bb 45 73 e0 8a 7f e9 99 f6 44 6b c5 45 24 d7 e7 Data Ascii: 'mJA<0=#Wg.HN1MR5UA=J^BV8YBYQ.)iR,"c`JmiPE&S#$HtvlT0JbDS4,@v(z]yjQoKfs3!RRdq`]mNuTCui'"a% eEsDkE$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49720	208.80.154.240	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	773	OUT	GET /wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:51 UTC	1097	IN	HTTP/1.1 200 OK date: Thu, 27 Mar 2025 14:32:01 GMT etag: 056d663d8bdc5341c8746ea98ae457f5 server: ATS/9.2.9 content-type: image/png content-disposition: inline;filename=UTF-8''Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png last-modified: Sun, 09 Feb 2025 19:43:03 GMT content-length: 56818 age: 49 x-cache: cp1109 miss, cp1109 hit/1 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp1109" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 45.92.229.138 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2025-03-27 14:32:51 UTC	13798	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 4d 00 00 04 01 08 06 00 00 00 df 05 74 36 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e9 02 09 13 2b 01 e5 40 2c d6 00 00 80 00 49 44 41 54 78 da ec dd 77 9c 1f 57 7d ef ff f7 cc b7 6e 6f d2 4a 5a f5 2e 77 1b e3 82 6d 5c 68 c6 60 4c 07 43 30 1d db b4 10 12 6e 92 7b ef 2f 89 6f 02 c9 4d 02 b9 09 09 3d a1 57 83 21 a6 77 4c 71 ef c6 dd 96 64 75 69 7b df fd b6 39 bf 3f 24 19 59 fe 4a da 32 e5 cc cc eb f9 78 f0 cb fd d9 de 9d ef 39 73 66 be 67 de 7b ce 67 1c 01 00 82 73 e5 cf da b2 35 73 a2 Data Ascii: PNGIHDRMt6gAMAa cHRMz&u0`:pQ<bKGDtIME+@,IDATxwW}noJZ.wm\h`LC0n{/oM=W!wLqdui{9?$YJ2x9sfg{gs5s
2025-03-27 14:32:51 UTC	15296	IN	Data Raw: 00 00 00 84 cd dd 3f 21 49 e8 a4 c4 c2 a6 59 d9 db 21 7e a0 8b d6 36 e9 2d 67 74 70 e5 f9 ac e6 49 df b8 67 44 67 7f 74 b3 fe e2 07 7b 13 1f 98 f8 71 1d 55 6a 46 df bc 77 44 17 7e 7c ab de 75 dd 6e ed 1e ad 30 90 7c 74 d2 92 a2 fe f8 d9 5d d6 8f a5 78 dc fc 7d 18 f1 73 fc 15 26 b2 f6 27 78 6e 02 00 00 62 25 99 1b fb 09 4b ac fc 50 4d 79 57 1f b9 6c b1 1c 76 e5 f8 77 0a 8d f4 c3 87 c6 74 fe c7 b7 e8 5d df de ad 6d 43 95 44 8f a5 20 0e e3 19 e9 eb f7 8c e8 8c 7f dd a2 7f f8 45 9f 26 ca 1e 03 cb 27 1f b8 70 a1 36 75 17 12 70 b3 f4 61 e0 46 39 e2 4d c4 d7 1a ab 4b 00 00 40 8c 25 2f 34 21 2c b1 f6 43 fd af e7 2e d4 0a 6a 48 f8 e6 de dd d3 ba f8 33 4f e8 8a af ed d4 c3 bd a5 44 8f a5 30 0e 33 55 f1 f4 cf 37 f4 eb 99 ff ba 59 5f b9 6b 58 1e cf 6d f3 56 c8 3a fa Data Ascii: ?!IY!~6-gtpIgDgt{qUjFwD~\|un0\|t]x}s&'xnb%KPMyWlvwt]mCD E&'p6upaF9MK@%/4!,C.jH3OD03U7Y_kXmV:
2025-03-27 14:32:51 UTC	15296	IN	Data Raw: e3 48 2f 3d a5 4d 7f 7d c9 22 ad 5d 50 60 40 f9 e4 03 d7 ed 52 df 78 75 c6 27 98 57 08 47 70 60 5e 21 0c 00 88 db a3 4b a5 a2 d2 13 4f a8 b4 7b 67 32 be 47 5c 57 a6 73 b1 6a 5d 3d 32 0e 2b 9c 6d 96 65 75 49 ac 9b 16 41 9b e6 de 19 7f fd a3 bd 7a ee fa 66 b6 e9 f8 7d bf 75 a4 97 9d dc a6 17 1e d7 a2 4f dd 34 a8 8f ff b6 5f fb c6 aa 3e 9c c2 e4 6e c5 c9 ba 8e 5e 7c 52 ab fe fc 79 dd 3a b1 a7 c8 20 f2 d1 77 ef 1b d1 b7 ef 19 9e d1 09 26 2c 89 e0 e0 84 25 00 80 b8 3d b6 78 35 55 76 ec d4 f4 f6 6d 32 b5 5a 02 5a e4 48 6d 1d aa 2d 5c 21 2f cb 0a e7 38 f0 a1 b2 0c 61 49 bc ee 3a d1 75 c6 78 c9 d3 1f 5f b7 4b df 79 1b db 74 82 50 cc b9 7a df 05 0b f4 ce f3 ba f4 ed 7b 47 f4 c9 df 0d e8 9e 5d 53 73 38 8d c9 5d 5d d2 d5 98 d5 9b ce ea d0 db cf e9 d2 d2 76 c2 3b bf Data Ascii: H/=M}"]P`@Rxu'WGp`^!KO{g2G\Wsj]=2+meuIAzf}uO4_>n^\|Ry: w&,%=x5Uvm2ZZHm-\!/8aI:ux_KytPz{G]Ss8]]v;
2025-03-27 14:32:51 UTC	12428	IN	Data Raw: 6b af 06 be 7e df 4a f9 c9 4f 58 09 96 4c b2 7d 82 25 29 34 4e b0 24 63 0b e6 4b 36 32 cb c1 92 4c 5e ff f4 f2 96 a4 d7 7f 3b b6 5f 0d ce 3f aa a0 f9 c9 27 be 4c 30 7f 65 ec 89 60 fd 7c 59 85 57 bf 71 ec b7 64 e6 8e e7 5c 70 dd db 6f dc d4 c1 bf fd 88 3a 67 f5 89 35 9b 5f ae c9 5f bd 22 1b c7 23 bc 60 9e 4c 54 94 09 73 ee 5f 17 63 06 47 76 48 16 0b 00 6f 7d 3c 3e ed 0f ce fd d8 6b 7f cb 4a 1f 9c dc dc 92 60 c9 24 db 27 6f 49 0a 8d 73 14 27 63 8b e5 4b 36 c2 51 9c 8c 5d 7f 8e e2 8c fa 57 fd ce 17 14 9e fc ce 53 fd 70 58 5b 7d 72 3e 8a e7 e4 17 e6 54 78 c7 d7 8f fd d6 9c 89 a0 c9 bd db a0 d7 53 e3 33 7f a6 83 8f bc a6 a4 37 9e 52 d2 7e 60 14 5f 5d 91 b7 58 93 0d c2 31 de 20 81 bc b8 9c 8d dd 1a 94 28 06 80 b7 3e e2 9f f6 07 db 1f fe d9 3f 8a de f3 43 91 91 Data Ascii: k~JOXL}%)4N$cK62L^;_?'L0e`\|YWqd\po:g5__"#`LTs_cGvHo}<>kJ`$'oIs'cK6Q]WSpX[}r>TxS37R~`_]X1 (>?C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49722	13.226.94.59	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:51 UTC	434	OUT	GET /assets.00/godaddy-v2-icon-2048x2048-fnx09smt.png HTTP/1.1 Host: static-00.iconduck.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:52 UTC	471	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 122003 Connection: close Last-Modified: Fri, 03 Sep 2021 10:04:10 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 27 Mar 2025 14:32:52 GMT ETag: "a1afaac960a0d145df512e3384bf8324" X-Cache: Hit from cloudfront Via: 1.1 de64f4ad73b175abdd31603ba9fb0aae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: 1t-8bxUFes06T4uwLhk2JBjCyl0Dnu2lE_b7z0FI6zZE4eTsiaHpig== Age: 1 Vary: Origin
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 00 00 00 08 00 08 06 00 00 00 b2 a7 d3 30 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 07 74 49 4d 45 07 e5 01 1f 14 19 0e d8 d0 c1 5b 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 01 db 97 49 44 41 54 78 da ec dd 09 b4 65 65 79 e0 7d a8 a2 98 0a f4 32 9f f3 6e 14 13 50 10 15 87 56 89 43 a2 26 46 4d 3b 74 d4 60 b7 5f 1c a2 ad c1 39 1d 93 68 2b 9d 18 41 5a 4d b4 35 1d 63 1c d0 c4 a8 2d 1d b5 31 9f 51 a3 d1 38 25 48 34 8a 02 71 78 9f 7d d9 2d 62 98 04 19 8b aa a2 6e f5 f7 bc b7 36 7e 84 46 29 8a 5b b7 ee f0 fb af f5 5b a7 c4 95 64 85 ba f7 ec f7 79 Data Ascii: PNGIHDR0gAMAa cHRMz&u0`:pQ<tIME[bKGDCIDATxeey}2nPVC&FM;t`_9h+AZM5c-1Q8%H4qx}-bn6~F)[[dy
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: 13 fa 76 b2 cf 86 0c 00 00 00 00 00 70 c8 f2 cc e5 1b 45 8c 4f ee 8d f1 70 13 29 49 d2 5a 0c ff 0f 4f 1e 99 36 a0 2f da 88 01 00 00 00 00 00 56 dc a7 fb 62 3c bd a7 aa 0c a6 24 49 ab db 03 63 3c a1 11 c2 87 d2 e6 33 6f 03 06 00 00 00 00 00 58 71 f3 45 8c 97 25 c7 98 4c 49 92 56 b5 22 84 d7 a6 8d 67 cc e6 0b 00 00 00 00 00 b0 6a 76 34 ca f2 95 26 53 92 a4 55 ab 11 c2 79 69 c3 d9 64 d3 05 00 00 00 00 00 58 75 fd 45 59 9e 6b 42 25 49 5a d1 f2 37 66 1a 21 9c 91 36 9a eb 92 7d 36 5c 00 00 00 00 00 80 55 b7 94 5c db d7 df df 67 5a 25 49 5a b1 7a 63 7c 40 11 c2 87 d3 26 33 63 b3 05 00 00 00 00 00 58 33 33 45 08 1f 68 94 e5 fd 4c ac 24 49 87 5c 23 84 63 93 4b d3 06 33 6a 93 05 00 00 00 00 00 58 73 43 8d b2 fc b5 a2 2c 8f 36 b9 92 24 1d ca f0 7f 43 da 54 9e 93 7c Data Ascii: vpEOp)IZO6/Vb<$Ic<3oXqE%LIV"gjv4&SUyidXuEYkB%IZ7f!6}6\U\gZ%IZzc\|@&3cX33EhL$I\#cK3jXsC,6$CT\|
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: 06 dc 7c 84 90 2d 8e 3e 4b f4 99 a2 cf 96 57 24 12 b2 b3 e9 c3 96 f3 dc c5 3c ef b6 b5 97 e9 c3 8e 4f a7 e5 e2 4a 45 1e e9 f5 f8 ed 4d b6 28 da 7e f4 48 92 03 d9 99 04 00 00 6c 9a c9 9c 6d 9f 4d 45 7d 86 b2 95 eb fe 2f 73 e1 ee a6 f1 02 00 80 8d b5 43 24 22 9f af 54 a4 c7 0b 48 b2 05 85 ff eb 1b 0d 79 53 26 e3 15 67 57 b2 da 1f 8b b1 33 80 69 67 fa fc 3a 20 16 f3 da 9e ee 38 91 1b 0e b9 21 09 21 1b 1d 7d 66 e8 b3 e3 9d d9 ac 57 40 d3 67 ca 0a fa 30 2c 82 ed 4c 5b 7b b1 f9 cd f4 76 d3 f6 7e d8 6a f1 3b 9c 6c 76 b4 ed e8 58 6e 07 8e d9 02 00 00 9b e6 6e ad 29 53 59 9f 9d ed ff 5f 66 2e 5a 9a 86 0b 00 00 36 86 6e cb 7e 4e a1 c0 56 da 64 93 a2 27 d8 d6 c6 63 79 a4 df 97 0b 4a 25 d9 c3 75 b9 9f e0 9b 6d 96 8f 4b a7 e5 aa 7a 5d dc c1 40 ca a3 11 ab 2b 09 21 bf Data Ascii: \|->KW$<OJEM(~HlmME}/sC$"THyS&gW3ig: 8!!}fW@g0,L[{v~j;lvXnn)SY_f.Z6n~NVd'cyJ%umKz]@+!
2025-03-27 14:32:52 UTC	14808	IN	Data Raw: b5 9a ec ce ea 33 00 00 a0 fc 96 06 74 63 d1 ef fa fa 9d 9f ba 03 00 c0 53 d6 0e 75 f2 ff bd 81 c0 5f a8 3f b4 cb 85 05 00 c0 3b 8e 8f c5 38 3f db 60 2e 4c a7 a9 3b 60 9e 16 2a 57 e7 72 c2 e6 b1 e3 91 80 fa 1d a3 7f d7 2c a4 76 01 00 80 f2 50 b9 cc 03 92 c1 e7 30 8e 60 02 00 c0 73 ba 7a ce 7e 68 0d 00 7f ef f3 6d a4 fe d0 3e 17 16 00 00 ef b8 20 9d 96 02 5b 30 1a cb 69 89 04 75 07 cc d3 1e c1 a0 24 3b 1d 06 94 31 88 3e a2 e1 0b d9 ac ac 60 eb 7f 00 00 f0 a6 9b 0a 05 1e 92 0c 25 a3 de f5 cf 4d a5 a8 3b 00 00 bc a5 af e7 ec 87 b9 fd ff de 5c 54 00 00 bc e5 a2 74 9a 33 b4 0d e6 c3 91 08 75 07 cc c3 12 db 96 5b 0b 05 61 d4 72 7f ba fd be 3c 5c a9 c8 36 81 00 b5 0b 00 00 fe e4 f2 4c 86 07 25 43 d1 cd fe 17 b0 0b 1d 00 00 9e a3 e7 ec 87 d7 00 60 59 27 72 51 01 Data Ascii: 3tcSu_?;8?`.L;`*Wr,vP0`sz~hm> [0iu$;1>`%M;\Tt3u[ar<\6L%C`Y'rQ
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: 03 00 00 34 00 00 00 80 61 db 33 14 12 bb d5 e2 eb 8b 03 ab 8f b7 64 db 55 28 b7 16 0a dc 10 0e e4 66 75 dd 39 fb 18 4e d8 25 18 1c ec 02 d0 e7 36 24 ef 92 8e 7a 4e 98 56 cf 67 e7 a5 d3 b2 da ef f7 f4 04 91 1e 8b 6f e1 77 a1 23 39 2b 99 64 5c 86 6c 1f 08 0c 9a 8d 88 d9 e8 77 f0 3d d9 8d 0a 00 00 cc dc b3 ba 01 e0 29 2e 04 00 00 98 89 ad fd 7e b9 bf 5c e6 0b 8c e1 e8 b5 9f ff cc 47 57 b0 e2 ca b1 89 b5 7f 8a c5 58 71 05 c7 7c 3c 1e 97 3c 47 7f 90 f5 24 da e9 c8 ed c5 a2 ec 3e 21 13 43 7a 2c 3e 59 dd 13 1d 26 20 8d e7 ee 52 89 31 19 72 4e 2a 25 ec 4b 63 3e fa 1d 5c bf 8b 53 83 00 00 60 26 a6 2c eb c7 ba 01 e0 5b 5c 0c 00 00 30 13 7a db 55 7d a6 2c 31 1b fd 89 fb ce 62 91 1a 9c 70 5b f8 7c 6c 05 ee 40 02 ed f6 e0 1c 6d 6a 10 4e d1 47 01 dc 55 2a 71 33 92 3f Data Ascii: 4a3dU(fu9N%6$zNVgow#9+d\lw=).~\GWXq\|<<G$>!Cz,>Y& R1rN%Kc>\S`&,[\0zU},1bp[\|l@mjNGUq3?
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: 71 a4 cb 55 7e b6 5c 96 16 4b 8d fa 26 ba fc fe bf 9b 73 b6 29 1c 76 a5 cd ec 1f 8b 31 3b cd 62 52 dd ae 6c ef d2 b9 06 00 b8 47 af fd 29 0a ee ac e5 d7 2e 16 dc e9 0c f2 2f cf cc 48 93 e7 71 df 44 cf 95 3e 8f b3 f4 3f 00 00 18 63 03 1d 63 f7 6c 01 c0 f2 70 78 07 0a 00 00 00 c0 38 db 37 16 93 07 da 6d de e4 f9 28 ba 4f ed e9 2e ed 37 ba 5d 38 2c 8f 31 23 d1 5a f2 bd 9e 1c 99 48 70 ad 02 80 31 a3 d7 fe 3c 5b ee 58 89 0e bb df 58 ab b9 72 9e b7 36 cf 72 ef cf e7 d9 5e c9 67 f9 bd e9 3b ed e9 e2 8a 5c 00 00 00 5e 28 00 d0 31 76 cf 16 00 2c 8b 46 ff d6 fc 90 0d 4e 14 00 00 18 67 67 e5 72 bc c9 f3 e1 b2 a3 07 b9 b4 57 ad 2e 4b 4f ec a4 d2 eb c9 a9 99 0c d7 29 00 18 33 7a ed af 30 28 6c ad 00 e0 b2 52 c9 95 f3 ac 4b c8 87 58 59 c9 77 d1 be 13 d7 29 00 00 30 ce Data Ascii: qU~\K&s)v1;bRlG)./HqD>?cclpx87m(O.7]8,1#ZHp1<[XXr6r^g;\^(1v,FNggrW.KO)3z0(lRKXYw)0
2025-03-27 14:32:52 UTC	16384	IN	Data Raw: fb 0d 0c c4 07 17 17 63 dc b5 00 22 22 b2 cf 93 8f fb 7f cf c2 42 dc dd 71 ff 00 00 70 bd 7a 8a e2 79 3a cb d2 15 e9 29 cb db a5 41 3b 6c e2 02 00 c0 f7 3b b7 5e 6f bf 09 f9 d9 d5 d5 58 73 2d 80 88 88 ec b3 2c b7 5a ed e3 fe 9f 31 36 d6 3e 01 c7 b3 1f 00 00 ae ff ed ff 9e b2 3c 5f 67 59 ba 22 07 8b e2 27 7b 8a e2 0d 26 2e 00 00 5c bf d3 ca 32 ee df df 1f 7f 3e 33 13 13 cd a6 6e 91 88 88 ec 8b 8c 6d 6e c6 ab a7 a7 e3 de e9 19 77 aa 23 ff 01 00 e0 c6 de fe 7f dd c1 5a ed 27 74 96 a5 2b 72 a0 28 6e 91 06 ed c3 d3 e0 5d 30 81 01 00 e0 86 9d 5d af c7 23 86 86 da a7 01 88 88 88 74 73 ae 4e cf b2 07 0d 0c c4 6d bd f5 0f 00 00 37 65 f2 50 ad f6 90 dc 53 d5 59 96 ae 49 1a b4 87 d2 e0 7d 77 b2 65 12 03 00 c0 8d 3b b3 2c e3 b2 f1 f1 f8 e6 fa ba 6b 01 44 44 a4 6b 92 Data Ascii: c""Bqpzy:)A;l;^oXs-,Z16><_gY"'{&.\2>3nmnw#Z't+r(n]0]#tsNm7ePSYI}we;,kDDk
2025-03-27 14:32:52 UTC	8891	IN	Data Raw: 45 f9 b0 f6 95 7c 68 db e7 e1 15 00 00 00 80 7b 51 ff 98 e4 8a 26 e2 79 6d 29 1b dd b0 49 92 24 49 d2 18 35 e8 fb 75 a3 88 27 e6 83 db fb d2 ed 1e 62 01 00 00 00 b8 1b 37 a7 df 69 ba ee ec 7a a7 e4 66 4d 92 24 49 92 c6 b4 7c 70 6b 9a 88 57 e4 43 dc f5 1e 66 01 00 00 00 f8 36 db 46 11 e7 0f 23 b6 ba 49 93 24 49 92 a4 09 68 eb fc fc 86 7c 98 fb c9 26 e2 13 7e 12 00 00 00 00 80 43 77 44 97 34 11 3f bc 65 7e 7e 83 1b 34 49 92 24 49 9a a0 46 11 73 a3 ae bb 7f 3e d8 bd 3e dd 98 0e 7a d0 05 00 00 00 98 39 f5 4e 68 7b 13 f1 aa 61 d7 dd b7 e9 ba b5 6e ce 24 49 92 24 69 b2 5f 06 78 7c 3e e8 7d 32 ed f1 d0 0b 00 00 00 30 33 76 a5 8f d7 bb 21 37 64 92 24 49 92 34 45 b5 a5 3c 30 fd 76 3e f4 5d eb e1 17 00 fe 7f 7b 77 03 ad 59 5d 17 7a 7c 66 60 06 70 18 3c 38 bc ec 67 Data Ascii: E\|h{Q&ym)I$I5u'b7izfM$I\|pkWCf6F#I$Ih\|&~CwD4?e~~4I$IFs>>z9Nh{an$I$i_x\|>}203v!7d$I4E<0v>]{wY]z\|f`p<8g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	199.232.89.91	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:52 UTC	681	OUT	GET /jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg HTTP/1.1 Host: t4.ftcdn.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:52 UTC	472	IN	HTTP/1.1 200 OK Connection: close Content-Length: 21030 Last-Modified: Sat, 28 Mar 2020 15:21:32 GMT ETag: "0a58e051f792bbd11b87245f415121a3" Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000 Content-Type: image/jpeg Accept-Ranges: bytes Age: 1144729 Date: Thu, 27 Mar 2025 14:32:52 GMT X-Served-By: cache-iad-kcgs7200104-IAD, cache-ewr-kewr1740094-EWR X-Cache: HIT, HIT X-Cache-Hits: 9, 0 Strict-Transport-Security: max-age=31536000
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 56 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 02 13 00 03 00 00 00 01 00 01 00 00 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00 01 ff ed 00 2c 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 0f 1c 01 5a 00 03 1b 25 47 1c 01 00 00 02 00 04 00 ff e1 0c 81 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c Data Ascii: JFIF,,VExifMM*>F(,,,Photoshop 3.08BIMZ%Ghttp://ns.adobe.com/xap/1.0/<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xml
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 27 a5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 0e db 97 e2 09 e9 7f 61 fa 5f f2 dc 3a 54 bb 2d fe c3 b6 e5 f8 82 7a 5f d8 7e 97 fc b7 0e 95 2e cb 7f b0 ed b9 7e 20 9e 97 f6 1f a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 27 a5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 0e db 97 e2 09 e9 7f 61 fa 5f f2 dc 3a 54 bb 2d fe c3 b6 e5 f8 82 7a 5f d8 7e 97 fc b7 0e 95 2e cb 7f b0 ed b9 7e 20 9e 97 f6 1f a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 7f f5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 1e 90 f3 74 15 5f 74 92 88 df 9a f4 5e 83 c2 e1 6e ea 71 f5 66 55 53 5f fd 53 54 f1 4f 63 ee 96 cc 98 54 65 a3 a2 be 0a ff 00 d4 62 a7 de 9a 8f 83 f0 fa cd ea 9e e3 61 47 28 6c aa 66 57 2b 7b d0 ca 40 8d 06 3b 2f 83 15 91 1b bd ae aa 18 8e 63 9a b0 e4 83 6f 4a b5 Data Ascii: -K;n_'pRa_:T-z_~.~ -K;n_'pRa_:T-z_~.~ -K;n_pRt_t^nqfUS_STOcTebaG(lfW+{@;/coJ
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 01 50 05 40 15 00 54 01 50 05 40 15 00 54 03 67 c8 38 92 c2 9c 7e 1d 11 dd c4 6e ea 1f 07 26 d4 f2 a7 e0 6a b1 4a 1c a6 25 54 d2 9a 7b 8b 3e 4d 5e fc 3a ab 6e e5 cc ec e9 df ee 9e 86 f0 68 4b b9 e7 35 19 92 f2 d1 63 c4 5a 32 1b 15 ee e6 44 a9 e9 8c 57 b9 1a 9d 67 ce b5 54 a5 4d cf 76 84 49 22 49 98 ef 98 98 89 31 11 6a f8 8e 57 bb 9d 4b 83 18 8c 6a 35 3a 8e 51 56 ab ab 3d 6a 3b 4a ac 9e 75 3d 9e 05 40 15 00 54 01 50 05 40 15 00 54 01 50 05 40 15 00 54 01 50 05 40 15 00 54 01 5e 20 0a 90 05 49 02 a0 0a 80 2a 40 15 24 0a 80 2a 00 a9 00 54 90 2a 00 a8 02 a0 0a 80 2a 00 a8 02 a0 0a 80 2a 40 15 24 0a 80 2a 00 a8 02 a0 1e 92 d1 df 2f 31 0e 62 1a d1 f0 dc 8f 6f 3a 1e 1e c4 7b 55 ab d6 7b a5 55 d4 9e 95 1b a5 16 49 6e 56 33 26 25 a1 4c 43 5a b2 23 11 e9 cc a9 52 Data Ascii: P@TP@Tg8~n&jJ%T{>M^:nhK5cZ2DWgTMvI"I1jWKj5:QV=j;Ju=@TP@TP@TP@T^ I@$T**@$/1bo:{U{UInV3&%LCZ#R
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 6f 41 02 4a dc 20 92 97 08 02 e1 00 ad c2 01 4a 88 05 6e 10 0d fb 43 eb 57 62 7c d0 bd 62 bd 8f 68 67 8f 02 dd 92 ba 6a f8 71 2d d3 1a d1 f8 67 34 5f 54 9c 03 45 4f 0e 23 2a b4 d2 f1 e0 47 d7 16 28 2a 22 e1 00 5c 20 0b 84 01 70 80 2e 10 0c be 5e c6 fb 17 1a d8 f2 32 b3 b2 ca b5 74 38 b0 da ae 4e 2d 72 a6 af c0 c3 ba b3 f8 e9 f2 b9 5a bd 8b ea 86 c2 c6 ff 00 9a ba 1c c4 73 75 2a 26 e5 24 dc 06 36 59 c6 a5 fa ec 94 9c 8a b9 a9 dd c2 74 bb 51 ec e7 4a 7d fb 0a b5 d3 6e ed 9d 15 1c bd f2 b0 5d ec 9f 87 de 37 95 49 8d ed 48 49 43 27 d8 8c 2b c5 92 5e 81 bd 06 37 39 ad fb d7 cd 4c de 65 6d b3 6f 92 0e c4 61 5e 2c 92 f4 0d e8 1c e6 b7 ef 5f 35 1c ca db 66 df 24 1d 88 c2 bc 59 25 e8 1b d0 39 cd 6f de be 6a 39 95 b6 cd be 48 3b 11 85 78 b2 4b d0 37 a0 73 9a df bd Data Ascii: oAJ JnCWb\|bhgjq-g4_TEO#G("\ p.^2t8N-rZsu*&$6YtQJ}n]7IHIC'+^79Lemoa^,_5f$Y%9oj9H;xK7s
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 1a 4d 43 b2 3a 25 19 1d 9a 9e de 94 e0 a4 5a 5f d5 b5 5f 91 73 6a ea 26 ff 00 0b a1 7a df 9d 33 f5 2a 69 22 8c d1 96 31 3c 02 22 ba 3b 3a f4 aa ad 1b 31 0d 3b 9f f9 78 2b cf e7 2d b6 58 85 1b b4 86 e6 76 af cd 25 17 10 c2 6b d9 2c b9 25 ba d3 8e a2 b9 5f 35 e2 58 0b d1 90 dd d7 e5 2b dd 4b c4 5d 5f f1 5e f5 7e ee 04 5e e1 b4 6e 92 57 33 b5 fd f5 93 87 e2 f5 ec 96 1b 9d ba 97 86 a2 57 cb 79 8f 0c c7 a0 5d 27 1a 91 9a 95 89 01 fa 9e df 27 2a 71 42 a5 77 63 5a d5 61 e9 9b 5f 51 7a b1 c4 a8 5e b6 69 ae 7e b4 eb 43 30 61 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 59 8b 30 61 98 14 bf 5c 9d 8f dd b9 3d ce 0b 35 bd fc c9 fe d7 51 97 6b 65 56 e9 d1 4d 33 6b ea 43 06 f7 11 a1 64 d9 a8 b9 fa 93 ad 48 a3 34 e6 fc 4b 1d 73 a0 ab bd 8d Data Ascii: MC:%Z__sj&z3i"1<";:1;x+-Xv%k,%_5X+K]_^~^nW3Wy]''qBwcZa_Qz^i~C0a1Y0a\=5QkeVM3kCdH4Ks
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 89 51 b4 48 5c ee d5 f7 d4 4e 1f 84 d7 bd 59 6a 43 75 af 0d 64 bd 96 72 d6 17 80 40 b6 4e 15 d1 9c 94 89 1d fa de ff 00 2f 22 70 42 9f 79 7f 5a ed d2 f5 cd ab a8 bd 58 e1 94 2c 9b 14 d3 3f 5a ae 93 32 61 1b 00 00 00 c4 67 5f 82 58 b7 d1 22 7e 55 33 30 ff 00 aa a7 de 86 06 29 f4 75 7f aa fa 1c ff 00 71 d0 a0 e6 02 e1 00 5c 20 0b 84 01 70 80 2e 10 09 2b 41 cb 57 e2 dc d0 bd 72 b3 94 7a 29 f8 f0 2d d9 2b a6 af 87 12 dd 3a ad 1f 84 73 45 f5 09 c9 bd 15 3c 38 8c aa d3 4b c7 81 19 5c 59 e0 a8 0b 89 82 45 c2 00 b8 82 05 c2 09 08 ed 60 1d 01 90 7e 06 61 3f 45 67 e0 73 dc 4f ea ea 77 a9 d3 70 8f a2 a5 dc 86 70 c1 36 20 00 00 00 a3 9a d7 b5 5a e4 47 22 a5 15 15 36 a0 45 8c e8 42 a2 2a 42 91 f6 70 d1 cc bc dd f3 78 15 92 d1 d7 5b a5 d7 54 27 f3 78 2b f7 73 16 2b 0c Data Ascii: QH\NYjCudr@N/"pByZX,?Z2ag_X"~U30)uq\ p.+AWrz)-+:sE<8K\YE`~a?EgsOwpp6 ZG"6EB*Bpx[T'x+s+
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: bb 51 78 2f 2a 1b 58 47 4a 1a 84 96 c2 e8 24 4c 99 a4 d9 89 5b 24 f3 05 f3 30 36 24 d3 52 b1 1b f3 93 be 4e 29 af 9c ae 62 19 3e d7 cb ed f3 2e ae af 0d 5e 85 9f 0d ca 37 d3 8a 77 39 d3 5f 5f 8e bf 5e f2 57 c3 e7 65 31 09 46 4d c9 4c 43 98 81 11 2a d7 b1 d5 45 2a 55 69 3e 93 95 8f 48 54 2e 54 ab 32 b3 11 f4 d6 51 4f a0 f9 9f 40 00 00 00 00 3c 67 66 a5 a4 a5 9f 33 37 1e 1c 08 30 d2 af 7b dd 44 44 e7 3d d3 a6 ea 8e 46 b1 25 54 f9 d4 aa ca 4d 57 bd 61 10 8a b3 9e 93 a2 c7 be 4f 2e a3 a1 43 d8 e9 b7 b7 ba 77 cc 45 d9 ce ba f8 21 6b c3 f2 7d 1b 0f b9 ce ba be e5 43 12 ca 37 3e 69 da e6 4d 7f 6f b9 1b bd f1 a3 c4 89 15 eb 12 2b fd fc 47 ad 5c bb 76 aa ff 00 b5 2c c8 88 c4 44 4c da 8a aa ab 9e aa e5 ce bd 66 c5 a3 b8 b9 79 99 82 1b 73 04 1b e1 ba 89 05 ef 5f 72 Data Ascii: Qx/XGJ$L[$06$RN)b>.^7w9__^We1FMLCE*Ui>HT.T2QO@<gf370{DD=F%TMWaO.CwE!k}C7>iMo+G\v,DLfys_r
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 57 39 65 54 e8 34 e9 b6 9b 51 ad 48 44 3d 4f 27 b0 01 a1 e7 7d 1b e1 d8 ca c4 9c c2 ec 90 9f 5d 6b 44 f7 28 ab fe 48 9b 17 8a 79 51 4d f6 1d 8e d5 b6 86 55 f9 9b bd 3b be c5 7f 12 c0 29 5c cb e9 7c ae dc bd ff 00 74 21 ac 6f 0a c4 f0 39 f5 94 c4 a5 a2 4b 46 4d 6d 55 d8 ee 2d 72 6a 54 e2 85 d2 de e6 95 d3 39 74 96 53 f3 49 48 b9 b5 ad 6a fe 45 54 85 fc d0 6e b9 27 49 d3 b8 75 92 58 ea 44 9d 94 4d 4d 8e 9a e3 43 4e 3e 1a 7d fc e6 93 11 c9 fa 75 a5 f4 3e 57 6a ea 5f b7 a1 bd c3 b2 86 a5 18 65 c7 cc dd 7d 69 f7 f5 25 86 66 1c 15 f8 37 66 1b 89 cb 7b 05 12 ab 1a fd 49 c3 7d 78 6d 2a 4b 65 70 95 7e 0f 21 79 5a bf 3d 4b 7a 5f 5b ad 1f 8e 8f 4e 4e bf cf 42 2c ce da 50 9a 9d be 4f 2f 5f 29 2f b1 d3 2e 4a 45 7f cd 4e f1 38 ed e6 2d 58 76 4f 32 9c 3e e3 3a ea ea f1 Data Ascii: W9eT4QHD=O'}]kD(HyQMU;)\\|t!o9KFMmU-rjT9tSIHjETn'IuXDMMCN>}u>Wj_e}i%f7f{I}xm*Kep~!yZ=Kz_[NNB,PO/_)/.JEN8-XvO2>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49724	208.80.154.240	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:52 UTC	535	OUT	GET /wikipedia/commons/thumb/d/df/Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg/1101px-Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:52 UTC	1097	IN	HTTP/1.1 200 OK date: Thu, 27 Mar 2025 14:32:01 GMT etag: 056d663d8bdc5341c8746ea98ae457f5 server: ATS/9.2.9 content-type: image/png content-disposition: inline;filename=UTF-8''Microsoft_Office_Outlook_%282018%E2%80%93present%29.svg.png last-modified: Sun, 09 Feb 2025 19:43:03 GMT content-length: 56818 age: 50 x-cache: cp1109 miss, cp1109 hit/2 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp1109" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 45.92.229.138 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2025-03-27 14:32:52 UTC	13798	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 4d 00 00 04 01 08 06 00 00 00 df 05 74 36 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e9 02 09 13 2b 01 e5 40 2c d6 00 00 80 00 49 44 41 54 78 da ec dd 77 9c 1f 57 7d ef ff f7 cc b7 6e 6f d2 4a 5a f5 2e 77 1b e3 82 6d 5c 68 c6 60 4c 07 43 30 1d db b4 10 12 6e 92 7b ef 2f 89 6f 02 c9 4d 02 b9 09 09 3d a1 57 83 21 a6 77 4c 71 ef c6 dd 96 64 75 69 7b df fd b6 39 bf 3f 24 19 59 fe 4a da 32 e5 cc cc eb f9 78 f0 cb fd d9 de 9d ef 39 73 66 be 67 de 7b ce 67 1c 01 00 82 73 e5 cf da b2 35 73 a2 Data Ascii: PNGIHDRMt6gAMAa cHRMz&u0`:pQ<bKGDtIME+@,IDATxwW}noJZ.wm\h`LC0n{/oM=W!wLqdui{9?$YJ2x9sfg{gs5s
2025-03-27 14:32:52 UTC	15296	IN	Data Raw: 00 00 00 84 cd dd 3f 21 49 e8 a4 c4 c2 a6 59 d9 db 21 7e a0 8b d6 36 e9 2d 67 74 70 e5 f9 ac e6 49 df b8 67 44 67 7f 74 b3 fe e2 07 7b 13 1f 98 f8 71 1d 55 6a 46 df bc 77 44 17 7e 7c ab de 75 dd 6e ed 1e ad 30 90 7c 74 d2 92 a2 fe f8 d9 5d d6 8f a5 78 dc fc 7d 18 f1 73 fc 15 26 b2 f6 27 78 6e 02 00 00 62 25 99 1b fb 09 4b ac fc 50 4d 79 57 1f b9 6c b1 1c 76 e5 f8 77 0a 8d f4 c3 87 c6 74 fe c7 b7 e8 5d df de ad 6d 43 95 44 8f a5 20 0e e3 19 e9 eb f7 8c e8 8c 7f dd a2 7f f8 45 9f 26 ca 1e 03 cb 27 1f b8 70 a1 36 75 17 12 70 b3 f4 61 e0 46 39 e2 4d c4 d7 1a ab 4b 00 00 40 8c 25 2f 34 21 2c b1 f6 43 fd af e7 2e d4 0a 6a 48 f8 e6 de dd d3 ba f8 33 4f e8 8a af ed d4 c3 bd a5 44 8f a5 30 0e 33 55 f1 f4 cf 37 f4 eb 99 ff ba 59 5f b9 6b 58 1e cf 6d f3 56 c8 3a fa Data Ascii: ?!IY!~6-gtpIgDgt{qUjFwD~\|un0\|t]x}s&'xnb%KPMyWlvwt]mCD E&'p6upaF9MK@%/4!,C.jH3OD03U7Y_kXmV:
2025-03-27 14:32:52 UTC	15296	IN	Data Raw: e3 48 2f 3d a5 4d 7f 7d c9 22 ad 5d 50 60 40 f9 e4 03 d7 ed 52 df 78 75 c6 27 98 57 08 47 70 60 5e 21 0c 00 88 db a3 4b a5 a2 d2 13 4f a8 b4 7b 67 32 be 47 5c 57 a6 73 b1 6a 5d 3d 32 0e 2b 9c 6d 96 65 75 49 ac 9b 16 41 9b e6 de 19 7f fd a3 bd 7a ee fa 66 b6 e9 f8 7d bf 75 a4 97 9d dc a6 17 1e d7 a2 4f dd 34 a8 8f ff b6 5f fb c6 aa 3e 9c c2 e4 6e c5 c9 ba 8e 5e 7c 52 ab fe fc 79 dd 3a b1 a7 c8 20 f2 d1 77 ef 1b d1 b7 ef 19 9e d1 09 26 2c 89 e0 e0 84 25 00 80 b8 3d b6 78 35 55 76 ec d4 f4 f6 6d 32 b5 5a 02 5a e4 48 6d 1d aa 2d 5c 21 2f cb 0a e7 38 f0 a1 b2 0c 61 49 bc ee 3a d1 75 c6 78 c9 d3 1f 5f b7 4b df 79 1b db 74 82 50 cc b9 7a df 05 0b f4 ce f3 ba f4 ed 7b 47 f4 c9 df 0d e8 9e 5d 53 73 38 8d c9 5d 5d d2 d5 98 d5 9b ce ea d0 db cf e9 d2 d2 76 c2 3b bf Data Ascii: H/=M}"]P`@Rxu'WGp`^!KO{g2G\Wsj]=2+meuIAzf}uO4_>n^\|Ry: w&,%=x5Uvm2ZZHm-\!/8aI:ux_KytPz{G]Ss8]]v;
2025-03-27 14:32:52 UTC	12428	IN	Data Raw: 6b af 06 be 7e df 4a f9 c9 4f 58 09 96 4c b2 7d 82 25 29 34 4e b0 24 63 0b e6 4b 36 32 cb c1 92 4c 5e ff f4 f2 96 a4 d7 7f 3b b6 5f 0d ce 3f aa a0 f9 c9 27 be 4c 30 7f 65 ec 89 60 fd 7c 59 85 57 bf 71 ec b7 64 e6 8e e7 5c 70 dd db 6f dc d4 c1 bf fd 88 3a 67 f5 89 35 9b 5f ae c9 5f bd 22 1b c7 23 bc 60 9e 4c 54 94 09 73 ee 5f 17 63 06 47 76 48 16 0b 00 6f 7d 3c 3e ed 0f ce fd d8 6b 7f cb 4a 1f 9c dc dc 92 60 c9 24 db 27 6f 49 0a 8d 73 14 27 63 8b e5 4b 36 c2 51 9c 8c 5d 7f 8e e2 8c fa 57 fd ce 17 14 9e fc ce 53 fd 70 58 5b 7d 72 3e 8a e7 e4 17 e6 54 78 c7 d7 8f fd d6 9c 89 a0 c9 bd db a0 d7 53 e3 33 7f a6 83 8f bc a6 a4 37 9e 52 d2 7e 60 14 5f 5d 91 b7 58 93 0d c2 31 de 20 81 bc b8 9c 8d dd 1a 94 28 06 80 b7 3e e2 9f f6 07 db 1f fe d9 3f 8a de f3 43 91 91 Data Ascii: k~JOXL}%)4N$cK62L^;_?'L0e`\|YWqd\po:g5__"#`LTs_cGvHo}<>kJ`$'oIs'cK6Q]WSpX[}r>TxS37R~`_]X1 (>?C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49726	34.110.143.245	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:52 UTC	703	OUT	GET /wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg HTTP/1.1 Host: images.sampletemplates.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:52 UTC	728	IN	HTTP/1.1 200 OK x-amz-id-2: HXAK1mkrBEL2dDRbyO+SlgMM8oEN83C2tHW51GVN7I8scqpPOCmylDNEM94m/8hebNpsVnGyGeE= x-amz-request-id: 4E29SSP0S17MVVPH Access-Control-Allow-Origin: * access-control-allow-methods: GET, HEAD access-control-max-age: 3000 x-amz-version-id: J91KmTW76aXW9xaw8_pg_akVoBgRCJkS Content-Length: 71173 server: AmazonS3 via: 1.1 google Date: Thu, 27 Mar 2025 09:14:51 GMT Last-Modified: Wed, 22 Feb 2017 21:27:02 GMT ETag: Content-Type: image/jpeg Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method Age: 19081 Cache-Control: public, max-age=31536000 X-Cache-Status: hit X-Cached-from: Cloud CDN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 14:32:52 UTC	269	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff fe 00 13 43 72 65 61 74 65 64 20 77 69 74 68 20 47 49 4d 50 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c2 00 11 08 02 da 02 58 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 06 07 03 04 05 02 01 08 09 ff c4 00 1a 01 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 Data Ascii: JFIFHHCreated with GIMPCCX
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 00 01 fd 3c 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 19 4c c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 10 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 83 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 84 19 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 20 cc 60 9a d2 1e d7 91 d0 cf 4b 7b c9 f4 f6 22 c0 00 07 c2 b5 ef e1 b2 f8 3b 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 48 c1 f4 00 00 00 00 72 cf d0 46 30 66 31 cc 7e 3b fa cf 96 b2 fc ef 42 d9 f2 bd 3e 5e b9 f7 f9 f6 e9 52 f1 2e 9e 79 a7 2f 56 8d a9 18 e9 c3 b3 8e 9f 96 be 97 e7 ff 00 41 f8 3e d4 Data Ascii: <e1Lf00 `K{";HrF0f1~;B>^R.y/VA>
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 31 e2 62 2d bf 3c 93 0d e2 7d 3c f3 4e 4e a8 97 57 2e 6a db 1d a3 1d 6d 2e c3 68 87 4f 34 8f 0d e1 bd 5c dd 4a 5a 57 cd d4 00 1c 5c 75 ac ba 39 77 f2 ea d5 8a fb 57 67 6a 68 e5 6d d8 e8 e7 db 98 6f 65 d1 87 5c 7b b9 de 2b be 5d 1b d7 ad cb ac 73 a7 39 44 2b ae 6d 6d 3e bc 6b 5c 37 ee 6f 8c 87 9e d1 6b 6f e6 d9 4c 22 bc 1c 74 d0 eb e2 96 73 75 44 6d bc 9f 6e 68 9f 27 5e d7 57 26 bd a2 ec ce 49 00 52 d9 6d c1 ea e4 fd 0f 96 be 4a 76 b3 5e 56 f6 4f 5f 2d bd 86 d1 32 58 00 06 10 66 04 6f 7c 31 4c 76 f1 d6 31 d1 cf 2d e6 e9 8f f4 61 b3 5b 22 75 af 4e f7 3e f1 4e ae 69 37 37 47 0f a3 0e d6 1b f4 69 70 07 98 73 a6 32 45 be 4c 7c 86 79 6b a3 24 5b ca 3c cc 7c ad b2 5a 33 98 61 a6 9c d6 af a3 62 27 42 1d 29 73 62 72 1b 17 cf 15 34 f7 31 b4 6a d6 56 aa 5e eb 3f 0f Data Ascii: 1b-<}<NNW.jm.hO4\JZW\u9wWgjhmoe\{+]s9D+mm>k\7okoL"tsuDmnh'^W&IRmJv^VO_-2Xfo\|1Lv1-a["uN>Ni77Gips2EL\|yk$[<\|Z3ab'B)sbr41jV^?
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a1 0b e4 c6 0c c5 2a 5b 70 cf 21 ee 18 e5 ed 1e 13 e4 f4 8d 94 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 42 f9 31 83 31 4a 96 b7 3d ff 00 29 59 b9 d1 94 a2 26 1f 48 94 eb 9f 67 1d 3a 56 43 f0 ea ba fd 0f 3a 5d cf d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 08 5f 26 30 66 29 52 d9 a4 c5 35 8d ec ad af be 5c 7e 7d 71 5e 9b d7 a4 9a 96 88 c5 e6 97 cf b1 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 84 2f a3 18 33 14 a9 6d 9b e0 00 00 35 88 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 3c 7e 97 31 83 31 4a 96 d9 be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 42 f9 31 Data Ascii: *[p!(B11J=)Y&Hg:VC:]_&0f)R5\~}q^/3m5<~11J(B1
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 78 fa 7f 37 fa be 7c 93 93 a7 0c c6 75 f7 61 e6 72 c9 ab 8f 59 b5 22 3d c4 ce c1 14 25 60 00 00 00 00 00 22 a4 a8 00 00 00 00 00 04 48 96 98 41 98 82 11 b3 09 f0 e5 c4 ec 4c 61 98 e2 44 cc cf a0 e7 d6 71 5a bf 22 d9 ad 55 67 ca 70 cc 66 98 e6 c4 e0 25 60 c7 13 cc b5 72 c4 e3 87 c9 7a 89 f7 6a f8 89 fa 69 a3 51 32 b0 72 4e b0 00 00 00 00 1f 0f a0 e4 9d 60 00 07 c3 e8 00 00 01 c8 2f 53 10 33 15 d9 27 23 19 df 9f be 3c ec 74 98 d9 0e 94 eb 4c f4 f3 bc a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 12 70 00 00 02 30 49 c0 00 00 0a d4 b5 cc 60 cc 57 44 d8 88 65 78 a6 b4 e8 c2 40 98 75 a2 d2 be 7c bc f4 95 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 42 56 00 00 00 45 49 50 00 00 01 56 96 81 8c 19 8a e8 97 52 da 9a e7 e7 3b a6 bd 1b 4e 85 27 cd eb 82 26 Data Ascii: x7\|uarY"=%`"HALaDqZ"Ugpf%`rzjiQ2rN`/S3'#<tLp0I`WDex@u\|BVEIPVR;N'&
2025-03-27 14:32:52 UTC	997	IN	Data Raw: d1 36 37 c0 00 11 42 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 09 58 00 00 01 15 25 40 00 00 05 5a 5a 06 30 66 2b a2 6c 6f 80 00 22 84 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8a 12 b0 00 00 02 2a 4a 80 00 00 0a b4 b4 0c 60 cc 57 44 d8 df 00 00 45 09 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 14 25 60 00 00 04 54 95 00 00 00 15 69 68 18 c1 98 ae 89 b1 be 00 00 8a 12 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 28 4a c0 00 00 08 a9 2a 00 00 00 2a d2 d0 31 83 31 5d 13 63 7c 00 01 14 25 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 50 95 80 00 00 11 52 54 00 00 00 55 a5 a0 63 06 62 ba 26 c6 f8 00 02 28 4a c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 a1 2b 00 00 00 22 a4 a8 00 00 00 ab 4b 40 c6 0c c5 74 4d 8d f0 00 04 50 95 80 00 Data Ascii: 67BVEX%@ZZ0f+lo"J`WDEX%`Tih(J*11]c\|%`PRTUcb&(J+"K@tMP
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 08 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 41 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c2 0c c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 12 34 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 1f ff c4 00 33 10 00 00 05 02 04 03 07 05 01 01 00 03 01 00 00 00 00 03 04 05 06 01 02 13 15 16 33 07 11 14 17 20 30 32 34 35 50 10 12 31 36 60 40 21 22 24 37 25 ff da 00 08 01 01 00 01 05 02 28 ab 30 b0 6c 18 36 0c 1b 06 0d 83 06 c1 83 60 c1 b0 60 d8 30 6c 18 36 0c 1b 06 0d 83 06 c1 83 60 c1 b0 60 d8 30 6c 18 36 0c 1b 06 0d 83 Data Ascii: 3A4{<33 0245P16`@!"$7%(0l6``0l6``0l6
2025-03-27 14:32:52 UTC	997	IN	Data Raw: d6 30 f0 de f2 92 1c 42 67 45 6c 69 d6 ba a9 e1 ea 15 2b 54 c2 91 ad 70 63 86 a3 63 ab 7f 0f 90 37 28 6b 84 23 69 72 22 00 80 92 92 70 f1 bd 2a 77 e8 d5 f8 4e 6c a5 3b 21 ba 1e 8e fb 0c e1 ea 0b d5 5b 4f b6 9f 59 bd 69 68 2e 62 d7 42 f5 93 58 d6 4d 63 59 35 8d 64 d6 35 93 58 d6 4d 63 59 35 8d 64 d6 35 93 58 d6 4d 63 59 35 8d 64 d6 24 2f 49 1d 8f b7 ca 76 d1 3b 40 fb e8 59 31 a4 cb 1a 5e a4 ef 8b 9e 9b f4 3a d2 e2 10 57 55 4d a6 42 d2 29 6b 91 b6 26 53 64 cb 89 69 0f b1 e9 e1 f1 c2 51 1b 8f 47 ce 73 89 46 24 26 43 14 95 27 55 27 71 65 48 7d 93 3e 26 10 6a a4 5c 39 26 f4 cc 3d f5 ab d3 b7 12 9d 49 4a 89 07 9d 42 09 29 55 86 a5 44 e6 95 ca d5 6f 25 23 53 cc 73 fa 12 ee 49 95 4c b6 c5 46 73 04 3e 20 54 09 3c b3 cb bd 51 45 df 43 ac b8 a2 cc b4 db 39 83 54 94 Data Ascii: 0BgEli+Tpcc7(k#ir"p*wNl;![OYih.bBXMcY5d5XMcY5d5XMcY5d$/Iv;@Y1^:WUMB)k&SdiQGsF$&C'U'qeH}>&j\9&=IJB)UDo%#SsILFs> T<QEC9T
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 4c b1 2d 53 55 b5 25 6b 62 52 4b be f6 54 06 54 a2 0b 20 bc 99 07 23 5a d2 1a 0a 46 49 25 5c da 92 fb 2a 81 35 6e 30 ab 0d a7 40 9a 87 18 85 39 b6 12 88 92 08 a2 32 29 62 94 49 d6 db 73 7a 6b ce a3 5a 3b 48 b1 b1 21 77 f7 4e 6a 44 a1 4b bb 5f 4c 93 39 76 15 79 76 e5 1c 66 a2 14 14 8e b5 d2 d5 d6 2b 6f 76 ce 5d 82 c5 0e 8e 75 ee 9d b4 4e d0 7e 7d 4d 1d 41 4e 2c 32 72 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b Data Ascii: L-SU%kbRKTT #ZFI%\*5n0@92)bIszkZ;H!wNjDK_L9vyvf+ov]uN~}MAN,2rav;Xc1kc1av;Xc1kc1av;Xc1kc1av;Xc1kc1av;Xc1kc1av;
2025-03-27 14:32:52 UTC	997	IN	Data Raw: 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 04 30 ae 6a 71 b7 f0 76 d1 3b 43 8b 9f a9 2c 56 6a 18 db 4c e8 e5 29 eb 39 73 b1 b9 54 e1 65 c7 d6 44 a9 3c 55 d2 54 ee cd 63 83 ca c2 d0 3a 4d 9c db c8 55 2d 5f 50 e5 2d 39 1c 91 ae 70 b9 49 86 3d bc a8 24 89 52 f7 17 1b 25 4e 68 59 4d 93 3d 37 92 c3 30 56 e9 5f 95 Data Ascii: x1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx0jqv;C,VjL)9sTeD<UTc:MU-_P-9pI=$R%NhYM=70V_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49728	199.232.89.91	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:52 UTC	443	OUT	GET /jpg/00/82/85/81/360_F_82858162_HjMozPsJzTh7ydwgCUCy9Afd1fSvZvKg.jpg HTTP/1.1 Host: t4.ftcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:52 UTC	472	IN	HTTP/1.1 200 OK Connection: close Content-Length: 21030 Last-Modified: Sat, 28 Mar 2020 15:21:32 GMT ETag: "0a58e051f792bbd11b87245f415121a3" Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000 Content-Type: image/jpeg Accept-Ranges: bytes Date: Thu, 27 Mar 2025 14:32:52 GMT Age: 1144729 X-Served-By: cache-iad-kcgs7200104-IAD, cache-ewr-kewr1740057-EWR X-Cache: HIT, HIT X-Cache-Hits: 9, 1 Strict-Transport-Security: max-age=31536000
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 56 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 02 13 00 03 00 00 00 01 00 01 00 00 00 00 00 00 00 00 01 2c 00 00 00 01 00 00 01 2c 00 00 00 01 ff ed 00 2c 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 0f 1c 01 5a 00 03 1b 25 47 1c 01 00 00 02 00 04 00 ff e1 0c 81 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c Data Ascii: JFIF,,VExifMM*>F(,,,Photoshop 3.08BIMZ%Ghttp://ns.adobe.com/xap/1.0/<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xml
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 27 a5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 0e db 97 e2 09 e9 7f 61 fa 5f f2 dc 3a 54 bb 2d fe c3 b6 e5 f8 82 7a 5f d8 7e 97 fc b7 0e 95 2e cb 7f b0 ed b9 7e 20 9e 97 f6 1f a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 27 a5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 0e db 97 e2 09 e9 7f 61 fa 5f f2 dc 3a 54 bb 2d fe c3 b6 e5 f8 82 7a 5f d8 7e 97 fc b7 0e 95 2e cb 7f b0 ed b9 7e 20 9e 97 f6 1f a5 ff 00 2d c3 a5 4b b2 df ec 3b 6e 5f 88 7f f5 fd 87 e9 7f cb 70 e9 52 ec b7 fb 1e 90 f3 74 15 5f 74 92 88 df 9a f4 5e 83 c2 e1 6e ea 71 f5 66 55 53 5f fd 53 54 f1 4f 63 ee 96 cc 98 54 65 a3 a2 be 0a ff 00 d4 62 a7 de 9a 8f 83 f0 fa cd ea 9e e3 61 47 28 6c aa 66 57 2b 7b d0 ca 40 8d 06 3b 2f 83 15 91 1b bd ae aa 18 8e 63 9a b0 e4 83 6f 4a b5 Data Ascii: -K;n_'pRa_:T-z_~.~ -K;n_'pRa_:T-z_~.~ -K;n_pRt_t^nqfUS_STOcTebaG(lfW+{@;/coJ
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 01 50 05 40 15 00 54 01 50 05 40 15 00 54 03 67 c8 38 92 c2 9c 7e 1d 11 dd c4 6e ea 1f 07 26 d4 f2 a7 e0 6a b1 4a 1c a6 25 54 d2 9a 7b 8b 3e 4d 5e fc 3a ab 6e e5 cc ec e9 df ee 9e 86 f0 68 4b b9 e7 35 19 92 f2 d1 63 c4 5a 32 1b 15 ee e6 44 a9 e9 8c 57 b9 1a 9d 67 ce b5 54 a5 4d cf 76 84 49 22 49 98 ef 98 98 89 31 11 6a f8 8e 57 bb 9d 4b 83 18 8c 6a 35 3a 8e 51 56 ab ab 3d 6a 3b 4a ac 9e 75 3d 9e 05 40 15 00 54 01 50 05 40 15 00 54 01 50 05 40 15 00 54 01 50 05 40 15 00 54 01 5e 20 0a 90 05 49 02 a0 0a 80 2a 40 15 24 0a 80 2a 00 a9 00 54 90 2a 00 a8 02 a0 0a 80 2a 00 a8 02 a0 0a 80 2a 40 15 24 0a 80 2a 00 a8 02 a0 1e 92 d1 df 2f 31 0e 62 1a d1 f0 dc 8f 6f 3a 1e 1e c4 7b 55 ab d6 7b a5 55 d4 9e 95 1b a5 16 49 6e 56 33 26 25 a1 4c 43 5a b2 23 11 e9 cc a9 52 Data Ascii: P@TP@Tg8~n&jJ%T{>M^:nhK5cZ2DWgTMvI"I1jWKj5:QV=j;Ju=@TP@TP@TP@T^ I@$T**@$/1bo:{U{UInV3&%LCZ#R
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 6f 41 02 4a dc 20 92 97 08 02 e1 00 ad c2 01 4a 88 05 6e 10 0d fb 43 eb 57 62 7c d0 bd 62 bd 8f 68 67 8f 02 dd 92 ba 6a f8 71 2d d3 1a d1 f8 67 34 5f 54 9c 03 45 4f 0e 23 2a b4 d2 f1 e0 47 d7 16 28 2a 22 e1 00 5c 20 0b 84 01 70 80 2e 10 0c be 5e c6 fb 17 1a d8 f2 32 b3 b2 ca b5 74 38 b0 da ae 4e 2d 72 a6 af c0 c3 ba b3 f8 e9 f2 b9 5a bd 8b ea 86 c2 c6 ff 00 9a ba 1c c4 73 75 2a 26 e5 24 dc 06 36 59 c6 a5 fa ec 94 9c 8a b9 a9 dd c2 74 bb 51 ec e7 4a 7d fb 0a b5 d3 6e ed 9d 15 1c bd f2 b0 5d ec 9f 87 de 37 95 49 8d ed 48 49 43 27 d8 8c 2b c5 92 5e 81 bd 06 37 39 ad fb d7 cd 4c de 65 6d b3 6f 92 0e c4 61 5e 2c 92 f4 0d e8 1c e6 b7 ef 5f 35 1c ca db 66 df 24 1d 88 c2 bc 59 25 e8 1b d0 39 cd 6f de be 6a 39 95 b6 cd be 48 3b 11 85 78 b2 4b d0 37 a0 73 9a df bd Data Ascii: oAJ JnCWb\|bhgjq-g4_TEO#G("\ p.^2t8N-rZsu*&$6YtQJ}n]7IHIC'+^79Lemoa^,_5f$Y%9oj9H;xK7s
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 1a 4d 43 b2 3a 25 19 1d 9a 9e de 94 e0 a4 5a 5f d5 b5 5f 91 73 6a ea 26 ff 00 0b a1 7a df 9d 33 f5 2a 69 22 8c d1 96 31 3c 02 22 ba 3b 3a f4 aa ad 1b 31 0d 3b 9f f9 78 2b cf e7 2d b6 58 85 1b b4 86 e6 76 af cd 25 17 10 c2 6b d9 2c b9 25 ba d3 8e a2 b9 5f 35 e2 58 0b d1 90 dd d7 e5 2b dd 4b c4 5d 5f f1 5e f5 7e ee 04 5e e1 b4 6e 92 57 33 b5 fd f5 93 87 e2 f5 ec 96 1b 9d ba 97 86 a2 57 cb 79 8f 0c c7 a0 5d 27 1a 91 9a 95 89 01 fa 9e df 27 2a 71 42 a5 77 63 5a d5 61 e9 9b 5f 51 7a b1 c4 a8 5e b6 69 ae 7e b4 eb 43 30 61 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 59 8b 30 61 98 14 bf 5c 9d 8f dd b9 3d ce 0b 35 bd fc c9 fe d7 51 97 6b 65 56 e9 d1 4d 33 6b ea 43 06 f7 11 a1 64 d9 a8 b9 fa 93 ad 48 a3 34 e6 fc 4b 1d 73 a0 ab bd 8d Data Ascii: MC:%Z__sj&z3i"1<";:1;x+-Xv%k,%_5X+K]_^~^nW3Wy]''qBwcZa_Qz^i~C0a1Y0a\=5QkeVM3kCdH4Ks
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 89 51 b4 48 5c ee d5 f7 d4 4e 1f 84 d7 bd 59 6a 43 75 af 0d 64 bd 96 72 d6 17 80 40 b6 4e 15 d1 9c 94 89 1d fa de ff 00 2f 22 70 42 9f 79 7f 5a ed d2 f5 cd ab a8 bd 58 e1 94 2c 9b 14 d3 3f 5a ae 93 32 61 1b 00 00 00 c4 67 5f 82 58 b7 d1 22 7e 55 33 30 ff 00 aa a7 de 86 06 29 f4 75 7f aa fa 1c ff 00 71 d0 a0 e6 02 e1 00 5c 20 0b 84 01 70 80 2e 10 09 2b 41 cb 57 e2 dc d0 bd 72 b3 94 7a 29 f8 f0 2d d9 2b a6 af 87 12 dd 3a ad 1f 84 73 45 f5 09 c9 bd 15 3c 38 8c aa d3 4b c7 81 19 5c 59 e0 a8 0b 89 82 45 c2 00 b8 82 05 c2 09 08 ed 60 1d 01 90 7e 06 61 3f 45 67 e0 73 dc 4f ea ea 77 a9 d3 70 8f a2 a5 dc 86 70 c1 36 20 00 00 00 a3 9a d7 b5 5a e4 47 22 a5 15 15 36 a0 45 8c e8 42 a2 2a 42 91 f6 70 d1 cc bc dd f3 78 15 92 d1 d7 5b a5 d7 54 27 f3 78 2b f7 73 16 2b 0c Data Ascii: QH\NYjCudr@N/"pByZX,?Z2ag_X"~U30)uq\ p.+AWrz)-+:sE<8K\YE`~a?EgsOwpp6 ZG"6EB*Bpx[T'x+s+
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: bb 51 78 2f 2a 1b 58 47 4a 1a 84 96 c2 e8 24 4c 99 a4 d9 89 5b 24 f3 05 f3 30 36 24 d3 52 b1 1b f3 93 be 4e 29 af 9c ae 62 19 3e d7 cb ed f3 2e ae af 0d 5e 85 9f 0d ca 37 d3 8a 77 39 d3 5f 5f 8e bf 5e f2 57 c3 e7 65 31 09 46 4d c9 4c 43 98 81 11 2a d7 b1 d5 45 2a 55 69 3e 93 95 8f 48 54 2e 54 ab 32 b3 11 f4 d6 51 4f a0 f9 9f 40 00 00 00 00 3c 67 66 a5 a4 a5 9f 33 37 1e 1c 08 30 d2 af 7b dd 44 44 e7 3d d3 a6 ea 8e 46 b1 25 54 f9 d4 aa ca 4d 57 bd 61 10 8a b3 9e 93 a2 c7 be 4f 2e a3 a1 43 d8 e9 b7 b7 ba 77 cc 45 d9 ce ba f8 21 6b c3 f2 7d 1b 0f b9 ce ba be e5 43 12 ca 37 3e 69 da e6 4d 7f 6f b9 1b bd f1 a3 c4 89 15 eb 12 2b fd fc 47 ad 5c bb 76 aa ff 00 b5 2c c8 88 c4 44 4c da 8a aa ab 9e aa e5 ce bd 66 c5 a3 b8 b9 79 99 82 1b 73 04 1b e1 ba 89 05 ef 5f 72 Data Ascii: Qx/XGJ$L[$06$RN)b>.^7w9__^We1FMLCE*Ui>HT.T2QO@<gf370{DD=F%TMWaO.CwE!k}C7>iMo+G\v,DLfys_r
2025-03-27 14:32:52 UTC	1378	IN	Data Raw: 57 39 65 54 e8 34 e9 b6 9b 51 ad 48 44 3d 4f 27 b0 01 a1 e7 7d 1b e1 d8 ca c4 9c c2 ec 90 9f 5d 6b 44 f7 28 ab fe 48 9b 17 8a 79 51 4d f6 1d 8e d5 b6 86 55 f9 9b bd 3b be c5 7f 12 c0 29 5c cb e9 7c ae dc bd ff 00 74 21 ac 6f 0a c4 f0 39 f5 94 c4 a5 a2 4b 46 4d 6d 55 d8 ee 2d 72 6a 54 e2 85 d2 de e6 95 d3 39 74 96 53 f3 49 48 b9 b5 ad 6a fe 45 54 85 fc d0 6e b9 27 49 d3 b8 75 92 58 ea 44 9d 94 4d 4d 8e 9a e3 43 4e 3e 1a 7d fc e6 93 11 c9 fa 75 a5 f4 3e 57 6a ea 5f b7 a1 bd c3 b2 86 a5 18 65 c7 cc dd 7d 69 f7 f5 25 86 66 1c 15 f8 37 66 1b 89 cb 7b 05 12 ab 1a fd 49 c3 7d 78 6d 2a 4b 65 70 95 7e 0f 21 79 5a bf 3d 4b 7a 5f 5b ad 1f 8e 8f 4e 4e bf cf 42 2c ce da 50 9a 9d be 4f 2f 5f 29 2f b1 d3 2e 4a 45 7f cd 4e f1 38 ed e6 2d 58 76 4f 32 9c 3e e3 3a ea ea f1 Data Ascii: W9eT4QHD=O'}]kD(HyQMU;)\\|t!o9KFMmU-rjT9tSIHjETn'IuXDMMCN>}u>Wj_e}i%f7f{I}xm*Kep~!yZ=Kz_[NNB,PO/_)/.JEN8-XvO2>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49727	35.195.5.115	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:52 UTC	672	OUT	GET /web/image/product.template/1782/image_1024?unique=0ec9ce8 HTTP/1.1 Host: www.dsaict.eu Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:53 UTC	472	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 14:32:52 GMT Content-Type: image/png Content-Length: 83561 Connection: close X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'none' ETag: "c72cb512cff34333e9f5f01f343423bc" Cache-Control: max-age=31536000 Set-Cookie: session_id=159d9148a7bcecaedc9433e232258d01f5de4da1; Expires=Wed, 25-Jun-2025 14:32:52 GMT; Max-Age=7776000; HttpOnly; Path=/ Server: Odoo.sh Access-Control-Allow-Credentials: true
2025-03-27 14:32:53 UTC	15912	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 b8 08 06 00 00 00 6b 40 b1 97 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 ff a5 49 44 41 54 78 5e ec bd 07 a0 2c 49 55 3e de 3d f7 be b7 81 85 25 c3 12 45 05 15 90 9f 84 9f 28 82 fc 14 94 b4 28 06 54 14 44 0c 8b 01 fc 83 82 08 b2 f0 10 03 41 01 11 91 9c 05 04 09 ba c0 2e b0 64 56 82 18 58 24 6e 7a bb cb ee b2 39 87 f7 de bd d3 ff f3 9d 50 75 aa ba aa a7 e7 be fb e2 f6 37 d3 75 ce f9 be af aa 27 f4 54 4d cf dc d0 36 13 26 1c c4 78 c0 53 be b4 65 eb da fc 26 f3 f9 fc 86 6d db de a0 6b 66 87 d3 41 7f ab a6 99 7f 6f db ce 6e df 35 dd 2d 28 de 8c ac 37 ed 68 6b bb f6 06 4d db ad 34 Data Ascii: PNGIHDRk@sRGBgAMAapHYsodIDATx^,IU>=%E((TDA.dVX$nz9Pu7u'TM6&xSe&mkfAon5-(7hkM4
2025-03-27 14:32:53 UTC	16384	IN	Data Raw: d1 c3 8d 1f d2 92 cf a3 e4 cb 6e 67 0a 22 e4 2a 48 74 57 78 9e 73 25 7a bc c2 ef 13 e8 f9 84 70 69 44 52 53 81 7a d0 43 c0 fe f2 7d 1a 2a 34 03 5a d0 ad a8 74 f0 b2 6c f7 a1 59 e3 a9 0f fd cc 55 e1 17 c2 17 61 f4 02 b2 3e eb 1e 44 e1 d1 c8 79 62 72 b3 53 69 a2 aa 4d 64 fd dc b7 82 31 b9 c7 32 7d 11 4b 39 90 e6 b1 aa 7b 22 86 f2 cd 3e 1b 01 e4 f6 09 5b f2 fa fa a0 85 bd 2e 2c c6 24 22 f7 e4 96 42 17 46 89 1f f4 d6 44 85 c9 d5 71 9d 30 34 94 79 7b f6 42 a7 02 15 60 5a c9 d3 d3 9c a9 c4 19 98 ca f8 82 3f 9d 17 b5 f0 1c e7 d4 24 3e 45 cf a7 58 e4 45 61 75 ad 5f 35 f7 05 a1 e7 13 c2 a5 11 49 4d 45 49 cf b9 1a 6a 5e e3 59 4b 8a 14 5e 2a c8 8a c7 af b6 f3 7b 6b be 10 a3 16 90 bf 7c d6 f6 1b d0 0e 9f 49 93 d2 0d 95 92 09 ca cd 52 96 fa 89 6b 7c ee 5b c1 a2 dc 73 Data Ascii: ng"HtWxs%zpiDRSzC}4ZtlYUa>DybrSiMd12}K9{">[.,$"BFDq04y{B`Z?$>EXEau_5IMEIj^YK^*{k\|IRk\|[s
2025-03-27 14:32:53 UTC	16384	IN	Data Raw: 43 b1 e8 36 d5 c0 63 f5 06 ec 0d 5f 84 e3 c3 2f 12 da 93 36 5c cb 32 52 d2 0d 7b ab 36 6e 91 0e f4 eb 78 91 aa e4 59 cc f9 da 38 60 90 73 a2 4b 79 03 4a 1c 90 f3 a6 2d e2 27 4c d8 57 90 79 06 6d 3a 11 4b 8d 40 8d 4e 80 ac 69 2d 67 09 ca 33 17 75 94 72 e6 60 35 14 e1 11 99 d3 0b 33 54 87 33 9a 64 13 bf ba 24 5a 83 08 2e 78 31 46 ba c0 54 b1 3e 6f ba 53 ce 6a d6 df f7 f1 66 ed 1d 1f 6e ba 33 ce a5 17 a2 fb 59 c8 52 57 cf e9 be 19 2e f0 6e 03 a8 00 91 70 0a 36 57 b6 12 98 77 62 d1 47 64 a5 7f f2 1d 48 3e e9 94 6a 81 28 e3 bc 82 52 9d fb 97 a9 81 31 7a c9 d3 e7 22 93 eb 80 71 9e 1f f2 79 18 e7 f9 c0 65 62 56 32 4a 9c 61 59 7e c2 84 bd 09 4c b8 34 ed ca 59 08 2e 88 d4 c8 5c e4 a2 08 f8 b0 4b 58 e4 08 fe c2 35 0c f2 71 15 fa b2 5f fb 62 b3 85 07 5a ff 8c 82 5b Data Ascii: C6c_/6\2R{6nxY8`sKyJ-'LWym:K@Ni-g3ur`53T3d$Z.x1FT>oSjfn3YRW.np6WwbGdH>j(R1z"qyebV2JaY~L4Y.\KX5q_bZ[
2025-03-27 14:32:53 UTC	16384	IN	Data Raw: 95 d9 6b 77 ef 5e fd e9 77 3c e3 cb f5 ab 3f 3f cf f0 fc 47 bc 79 f7 6c d7 ca 43 ed 9c 7c a7 9d 98 bb 5b 68 77 77 ce 78 ba c8 88 38 ff 8c 79 38 78 ea 0a 6f 39 79 95 c7 38 6c 9d f7 39 60 13 9d 35 51 81 84 33 a3 c9 14 b3 8b 4d 8b 2a b8 62 b8 c2 f4 83 5d d7 47 bd 2e 3d 71 6b 5b 5f ae 8b 6b 33 14 34 d6 b8 f5 c7 4e 5f c7 26 2a 00 e4 9d 22 ca 4d 01 d6 e5 1c 10 c3 04 f5 ad 21 57 04 31 78 55 86 44 ba be 60 dd 27 48 5b 04 9a 50 75 73 84 9b 9e b1 4c 00 cd c9 38 ee 3f c0 8c 98 48 e9 51 28 63 80 f9 a1 72 1e c1 d9 6a 1b d6 4f 3b 7e 6d f6 25 4f fe e0 a5 96 3d 91 39 07 c4 15 9b fb f2 c6 1a 60 7b fd 08 47 8c b9 73 54 b5 8e a9 98 4e 89 32 3a 51 8b c8 78 48 cd 2a 16 99 a8 4f a5 c1 85 d9 9a c5 3b 9b e1 88 aa 36 b5 30 ad d4 60 bd ba cf fe 3d af 37 17 37 a1 6b 18 f7 fc 08 e3 Data Ascii: kw^w<??GylC\|[hwwx8y8xo9y8l9`5Q3Mb]G.=qk[_k34N_&"M!W1xUD`'H[PusL8?HQ(crjO;~m%O=9`{GsTN2:QxH*O;60`=77k
2025-03-27 14:32:53 UTC	16384	IN	Data Raw: e7 82 68 f4 b5 d0 27 10 3c 03 46 ad 06 e7 81 1c fd d8 c2 0e 5a 75 74 9a 46 8d ed ce 65 14 ab 0f 8e 56 67 7b 84 3d 26 37 e2 8a c9 67 80 96 2a db f0 de e9 bc 85 66 18 76 da 55 7a c7 13 4f 1b be f9 16 5f 30 7c c7 2d ef b0 e1 2f 3d 44 45 b5 1b 63 4a d1 62 47 ae 37 6c 49 b4 01 26 6a 23 34 d9 ed 36 c6 6a d2 a9 a2 cd 46 d9 c6 20 23 b0 d2 9a 6d f5 b0 dd e1 aa be f0 a0 8b dd 4d 0d b0 99 7a 7b fa 63 81 bc fc b3 d9 06 8a 7e eb a5 a1 9c aa a8 31 f1 8c 14 02 aa f5 c7 a0 af a6 9d f2 ae 05 fd 03 bb 77 7f e8 c5 7f f4 d8 8f c3 39 56 38 e6 ff 83 eb 73 6f 7d c1 a5 fb ef f9 f0 bf b5 a9 7f 99 4d f8 cc 72 94 82 b9 3a 26 10 f9 ed c8 ab d6 96 2c d3 e8 49 2a 39 c0 87 50 57 63 88 45 0d c1 89 5c 0b 19 03 41 80 30 12 f3 08 97 dc 1f 4c 31 28 e0 fd 08 60 ee 99 c9 be 9b a0 a5 bd 8f 7c Data Ascii: h'<FZutFeVg{=&7gfvUzO_0\|-/=DEcJbG7lI&j#46jF #mMz{c~1w9V8so}Mr:&,I9PWcE\A0L1(`\|
2025-03-27 14:32:53 UTC	2113	IN	Data Raw: 6d e1 6c da f8 1d 37 36 55 17 f9 fe a1 10 f1 a8 29 4a 33 23 7e 85 b1 77 9b bd e4 03 d7 ac bd c8 3e 71 2c ff 17 f9 12 db c6 f2 01 b2 c4 51 e3 97 9f fc 81 d9 ea ec f0 05 f6 10 79 a0 2d 64 0f b7 d0 05 ca d8 02 55 16 b6 ba 70 c9 74 0b 99 b8 63 a1 ae 49 91 6c 1c 59 cf 91 3b 1b 6b 7c 13 47 4b e3 fa ca 01 23 c5 2b 73 69 fa e9 fc 88 b3 09 a5 b5 da c4 d1 d2 94 48 6a 0d b5 0e ad 04 ae eb 79 a9 32 5d 70 8b 3a cd 7c d5 d2 cc 3f 66 e6 45 46 7e ed d0 da ea df ff d4 2b ee b7 fc 7b e4 4b 1c 15 96 0f 90 25 ae 35 2e 79 f2 5f ed 59 99 cf ef 3d 1f 66 3f 62 8b 53 f9 bf 23 be 70 d5 b5 ab 38 d3 0b a0 2b dc cf 56 9b 38 5a 9a 12 59 f0 bb de 73 51 25 97 69 1c d8 82 3e 15 95 1b fa b9 33 e9 d9 11 47 5b b5 a4 ad a7 fa 10 f0 8d 9c d6 9b e0 d3 e3 5b d4 69 e6 ab 76 3e 3f 6c ed eb 6d 7f Data Ascii: ml76U)J3#~w>q,Qy-dUptcIlY;k\|GK#+siHjy2]p:\|?fEF~+{K%5.y_Y=f?bS#p8+V8ZYsQ%i>3G[[iv>?lm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49729	34.110.143.245	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:53 UTC	465	OUT	GET /wp-content/uploads/2017/02/23025701/Sample-Payment-Request-Voucher-Form.jpg HTTP/1.1 Host: images.sampletemplates.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:53 UTC	728	IN	HTTP/1.1 200 OK x-amz-id-2: HXAK1mkrBEL2dDRbyO+SlgMM8oEN83C2tHW51GVN7I8scqpPOCmylDNEM94m/8hebNpsVnGyGeE= x-amz-request-id: 4E29SSP0S17MVVPH Access-Control-Allow-Origin: * access-control-allow-methods: GET, HEAD access-control-max-age: 3000 x-amz-version-id: J91KmTW76aXW9xaw8_pg_akVoBgRCJkS Content-Length: 71173 server: AmazonS3 via: 1.1 google Date: Thu, 27 Mar 2025 09:14:51 GMT Last-Modified: Wed, 22 Feb 2017 21:27:02 GMT ETag: Content-Type: image/jpeg Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method Age: 19082 Cache-Control: public, max-age=31536000 X-Cache-Status: hit X-Cached-from: Cloud CDN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-27 14:32:53 UTC	269	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff fe 00 13 43 72 65 61 74 65 64 20 77 69 74 68 20 47 49 4d 50 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c2 00 11 08 02 da 02 58 03 01 11 00 02 11 01 03 11 01 ff c4 00 1d 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 06 07 03 04 05 02 01 08 09 ff c4 00 1a 01 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 Data Ascii: JFIFHHCreated with GIMPCCX
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 00 01 fd 3c 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 19 4c c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 10 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 83 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 84 19 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 20 cc 60 9a d2 1e d7 91 d0 cf 4b 7b c9 f4 f6 22 c0 00 07 c2 b5 ef e1 b2 f8 3b 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ad 48 c1 f4 00 00 00 00 72 cf d0 46 30 66 31 cc 7e 3b fa cf 96 b2 fc ef 42 d9 f2 bd 3e 5e b9 f7 f9 f6 e9 52 f1 2e 9e 79 a7 2f 56 8d a9 18 e9 c3 b3 8e 9f 96 be 97 e7 ff 00 41 f8 3e d4 Data Ascii: <e1Lf00 `K{";HrF0f1~;B>^R.y/VA>
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 31 e2 62 2d bf 3c 93 0d e2 7d 3c f3 4e 4e a8 97 57 2e 6a db 1d a3 1d 6d 2e c3 68 87 4f 34 8f 0d e1 bd 5c dd 4a 5a 57 cd d4 00 1c 5c 75 ac ba 39 77 f2 ea d5 8a fb 57 67 6a 68 e5 6d d8 e8 e7 db 98 6f 65 d1 87 5c 7b b9 de 2b be 5d 1b d7 ad cb ac 73 a7 39 44 2b ae 6d 6d 3e bc 6b 5c 37 ee 6f 8c 87 9e d1 6b 6f e6 d9 4c 22 bc 1c 74 d0 eb e2 96 73 75 44 6d bc 9f 6e 68 9f 27 5e d7 57 26 bd a2 ec ce 49 00 52 d9 6d c1 ea e4 fd 0f 96 be 4a 76 b3 5e 56 f6 4f 5f 2d bd 86 d1 32 58 00 06 10 66 04 6f 7c 31 4c 76 f1 d6 31 d1 cf 2d e6 e9 8f f4 61 b3 5b 22 75 af 4e f7 3e f1 4e ae 69 37 37 47 0f a3 0e d6 1b f4 69 70 07 98 73 a6 32 45 be 4c 7c 86 79 6b a3 24 5b ca 3c cc 7c ad b2 5a 33 98 61 a6 9c d6 af a3 62 27 42 1d 29 73 62 72 1b 17 cf 15 34 f7 31 b4 6a d6 56 aa 5e eb 3f 0f Data Ascii: 1b-<}<NNW.jm.hO4\JZW\u9wWgjhmoe\{+]s9D+mm>k\7okoL"tsuDmnh'^W&IRmJv^VO_-2Xfo\|1Lv1-a["uN>Ni77Gips2EL\|yk$[<\|Z3ab'B)sbr41jV^?
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a1 0b e4 c6 0c c5 2a 5b 70 cf 21 ee 18 e5 ed 1e 13 e4 f4 8d 94 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 42 f9 31 83 31 4a 96 b7 3d ff 00 29 59 b9 d1 94 a2 26 1f 48 94 eb 9f 67 1d 3a 56 43 f0 ea ba fd 0f 3a 5d cf d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 08 5f 26 30 66 29 52 d9 a4 c5 35 8d ec ad af be 5c 7e 7d 71 5e 9b d7 a4 9a 96 88 c5 e6 97 cf b1 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 84 2f a3 18 33 14 a9 6d 9b e0 00 00 35 88 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 3c 7e 97 31 83 31 4a 96 d9 be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 42 f9 31 Data Ascii: *[p!(B11J=)Y&Hg:VC:]_&0f)R5\~}q^/3m5<~11J(B1
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 78 fa 7f 37 fa be 7c 93 93 a7 0c c6 75 f7 61 e6 72 c9 ab 8f 59 b5 22 3d c4 ce c1 14 25 60 00 00 00 00 00 22 a4 a8 00 00 00 00 00 04 48 96 98 41 98 82 11 b3 09 f0 e5 c4 ec 4c 61 98 e2 44 cc cf a0 e7 d6 71 5a bf 22 d9 ad 55 67 ca 70 cc 66 98 e6 c4 e0 25 60 c7 13 cc b5 72 c4 e3 87 c9 7a 89 f7 6a f8 89 fa 69 a3 51 32 b0 72 4e b0 00 00 00 00 1f 0f a0 e4 9d 60 00 07 c3 e8 00 00 01 c8 2f 53 10 33 15 d9 27 23 19 df 9f be 3c ec 74 98 d9 0e 94 eb 4c f4 f3 bc a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 12 70 00 00 02 30 49 c0 00 00 0a d4 b5 cc 60 cc 57 44 d8 88 65 78 a6 b4 e8 c2 40 98 75 a2 d2 be 7c bc f4 95 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 42 56 00 00 00 45 49 50 00 00 01 56 96 81 8c 19 8a e8 97 52 da 9a e7 e7 3b a6 bd 1b 4e 85 27 cd eb 82 26 Data Ascii: x7\|uarY"=%`"HALaDqZ"Ugpf%`rzjiQ2rN`/S3'#<tLp0I`WDex@u\|BVEIPVR;N'&
2025-03-27 14:32:53 UTC	997	IN	Data Raw: d1 36 37 c0 00 11 42 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 09 58 00 00 01 15 25 40 00 00 05 5a 5a 06 30 66 2b a2 6c 6f 80 00 22 84 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8a 12 b0 00 00 02 2a 4a 80 00 00 0a b4 b4 0c 60 cc 57 44 d8 df 00 00 45 09 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 14 25 60 00 00 04 54 95 00 00 00 15 69 68 18 c1 98 ae 89 b1 be 00 00 8a 12 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 28 4a c0 00 00 08 a9 2a 00 00 00 2a d2 d0 31 83 31 5d 13 63 7c 00 01 14 25 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 50 95 80 00 00 11 52 54 00 00 00 55 a5 a0 63 06 62 ba 26 c6 f8 00 02 28 4a c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 a1 2b 00 00 00 22 a4 a8 00 00 00 ab 4b 40 c6 0c c5 74 4d 8d f0 00 04 50 95 80 00 Data Ascii: 67BVEX%@ZZ0f+lo"J`WDEX%`Tih(J*11]c\|%`PRTUcb&(J+"K@tMP
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 08 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 41 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c2 0c c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 12 34 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 1f ff c4 00 33 10 00 00 05 02 04 03 07 05 01 01 00 03 01 00 00 00 00 03 04 05 06 01 02 13 15 16 33 07 11 14 17 20 30 32 34 35 50 10 12 31 36 60 40 21 22 24 37 25 ff da 00 08 01 01 00 01 05 02 28 ab 30 b0 6c 18 36 0c 1b 06 0d 83 06 c1 83 60 c1 b0 60 d8 30 6c 18 36 0c 1b 06 0d 83 06 c1 83 60 c1 b0 60 d8 30 6c 18 36 0c 1b 06 0d 83 Data Ascii: 3A4{<33 0245P16`@!"$7%(0l6``0l6``0l6
2025-03-27 14:32:53 UTC	997	IN	Data Raw: d6 30 f0 de f2 92 1c 42 67 45 6c 69 d6 ba a9 e1 ea 15 2b 54 c2 91 ad 70 63 86 a3 63 ab 7f 0f 90 37 28 6b 84 23 69 72 22 00 80 92 92 70 f1 bd 2a 77 e8 d5 f8 4e 6c a5 3b 21 ba 1e 8e fb 0c e1 ea 0b d5 5b 4f b6 9f 59 bd 69 68 2e 62 d7 42 f5 93 58 d6 4d 63 59 35 8d 64 d6 35 93 58 d6 4d 63 59 35 8d 64 d6 35 93 58 d6 4d 63 59 35 8d 64 d6 24 2f 49 1d 8f b7 ca 76 d1 3b 40 fb e8 59 31 a4 cb 1a 5e a4 ef 8b 9e 9b f4 3a d2 e2 10 57 55 4d a6 42 d2 29 6b 91 b6 26 53 64 cb 89 69 0f b1 e9 e1 f1 c2 51 1b 8f 47 ce 73 89 46 24 26 43 14 95 27 55 27 71 65 48 7d 93 3e 26 10 6a a4 5c 39 26 f4 cc 3d f5 ab d3 b7 12 9d 49 4a 89 07 9d 42 09 29 55 86 a5 44 e6 95 ca d5 6f 25 23 53 cc 73 fa 12 ee 49 95 4c b6 c5 46 73 04 3e 20 54 09 3c b3 cb bd 51 45 df 43 ac b8 a2 cc b4 db 39 83 54 94 Data Ascii: 0BgEli+Tpcc7(k#ir"p*wNl;![OYih.bBXMcY5d5XMcY5d5XMcY5d$/Iv;@Y1^:WUMB)k&SdiQGsF$&C'U'qeH}>&j\9&=IJB)UDo%#SsILFs> T<QEC9T
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 4c b1 2d 53 55 b5 25 6b 62 52 4b be f6 54 06 54 a2 0b 20 bc 99 07 23 5a d2 1a 0a 46 49 25 5c da 92 fb 2a 81 35 6e 30 ab 0d a7 40 9a 87 18 85 39 b6 12 88 92 08 a2 32 29 62 94 49 d6 db 73 7a 6b ce a3 5a 3b 48 b1 b1 21 77 f7 4e 6a 44 a1 4b bb 5f 4c 93 39 76 15 79 76 e5 1c 66 a2 14 14 8e b5 d2 d5 d6 2b 6f 76 ce 5d 82 c5 0e 8e 75 ee 9d b4 4e d0 7e 7d 4d 1d 41 4e 2c 32 72 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b 58 63 1d ac 31 8e d6 18 c7 6b 0c 63 b5 86 31 da c3 18 ed 61 8c 76 b0 c6 3b Data Ascii: L-SU%kbRKTT #ZFI%\*5n0@92)bIszkZ;H!wNjDK_L9vyvf+ov]uN~}MAN,2rav;Xc1kc1av;Xc1kc1av;Xc1kc1av;Xc1kc1av;Xc1kc1av;
2025-03-27 14:32:53 UTC	997	IN	Data Raw: 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 1a 31 e0 68 c7 81 a3 1e 06 8c 78 04 30 ae 6a 71 b7 f0 76 d1 3b 43 8b 9f a9 2c 56 6a 18 db 4c e8 e5 29 eb 39 73 b1 b9 54 e1 65 c7 d6 44 a9 3c 55 d2 54 ee cd 63 83 ca c2 d0 3a 4d 9c db c8 55 2d 5f 50 e5 2d 39 1c 91 ae 70 b9 49 86 3d bc a8 24 89 52 f7 17 1b 25 4e 68 59 4d 93 3d 37 92 c3 30 56 e9 5f 95 Data Ascii: x1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx1hx0jqv;C,VjL)9sTeD<UTc:MU-_P-9pI=$R%NhYM=70V_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49731	192.142.10.5	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:53 UTC	597	OUT	GET /favicon.ico HTTP/1.1 Host: shareddocview.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://shareddocview.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:54 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 27 Mar 2025 14:32:54 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-03-27 14:32:54 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2025-03-27 14:32:54 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49733	35.195.5.115	443	6440	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-27 14:32:53 UTC	434	OUT	GET /web/image/product.template/1782/image_1024?unique=0ec9ce8 HTTP/1.1 Host: www.dsaict.eu Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-27 14:32:54 UTC	472	IN	HTTP/1.1 200 OK Date: Thu, 27 Mar 2025 14:32:54 GMT Content-Type: image/png Content-Length: 83561 Connection: close X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'none' ETag: "c72cb512cff34333e9f5f01f343423bc" Cache-Control: max-age=31536000 Set-Cookie: session_id=a0c639e4d5dd5179f8602cf0ffbcfe9b8c685291; Expires=Wed, 25-Jun-2025 14:32:54 GMT; Max-Age=7776000; HttpOnly; Path=/ Server: Odoo.sh Access-Control-Allow-Credentials: true
2025-03-27 14:32:54 UTC	15912	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 b8 08 06 00 00 00 6b 40 b1 97 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 ff a5 49 44 41 54 78 5e ec bd 07 a0 2c 49 55 3e de 3d f7 be b7 81 85 25 c3 12 45 05 15 90 9f 84 9f 28 82 fc 14 94 b4 28 06 54 14 44 0c 8b 01 fc 83 82 08 b2 f0 10 03 41 01 11 91 9c 05 04 09 ba c0 2e b0 64 56 82 18 58 24 6e 7a bb cb ee b2 39 87 f7 de bd d3 ff f3 9d 50 75 aa ba aa a7 e7 be fb e2 f6 37 d3 75 ce f9 be af aa 27 f4 54 4d cf dc d0 36 13 26 1c c4 78 c0 53 be b4 65 eb da fc 26 f3 f9 fc 86 6d db de a0 6b 66 87 d3 41 7f ab a6 99 7f 6f db ce 6e df 35 dd 2d 28 de 8c ac 37 ed 68 6b bb f6 06 4d db ad 34 Data Ascii: PNGIHDRk@sRGBgAMAapHYsodIDATx^,IU>=%E((TDA.dVX$nz9Pu7u'TM6&xSe&mkfAon5-(7hkM4
2025-03-27 14:32:54 UTC	16384	IN	Data Raw: d1 c3 8d 1f d2 92 cf a3 e4 cb 6e 67 0a 22 e4 2a 48 74 57 78 9e 73 25 7a bc c2 ef 13 e8 f9 84 70 69 44 52 53 81 7a d0 43 c0 fe f2 7d 1a 2a 34 03 5a d0 ad a8 74 f0 b2 6c f7 a1 59 e3 a9 0f fd cc 55 e1 17 c2 17 61 f4 02 b2 3e eb 1e 44 e1 d1 c8 79 62 72 b3 53 69 a2 aa 4d 64 fd dc b7 82 31 b9 c7 32 7d 11 4b 39 90 e6 b1 aa 7b 22 86 f2 cd 3e 1b 01 e4 f6 09 5b f2 fa fa a0 85 bd 2e 2c c6 24 22 f7 e4 96 42 17 46 89 1f f4 d6 44 85 c9 d5 71 9d 30 34 94 79 7b f6 42 a7 02 15 60 5a c9 d3 d3 9c a9 c4 19 98 ca f8 82 3f 9d 17 b5 f0 1c e7 d4 24 3e 45 cf a7 58 e4 45 61 75 ad 5f 35 f7 05 a1 e7 13 c2 a5 11 49 4d 45 49 cf b9 1a 6a 5e e3 59 4b 8a 14 5e 2a c8 8a c7 af b6 f3 7b 6b be 10 a3 16 90 bf 7c d6 f6 1b d0 0e 9f 49 93 d2 0d 95 92 09 ca cd 52 96 fa 89 6b 7c ee 5b c1 a2 dc 73 Data Ascii: ng"HtWxs%zpiDRSzC}4ZtlYUa>DybrSiMd12}K9{">[.,$"BFDq04y{B`Z?$>EXEau_5IMEIj^YK^*{k\|IRk\|[s
2025-03-27 14:32:54 UTC	16384	IN	Data Raw: 43 b1 e8 36 d5 c0 63 f5 06 ec 0d 5f 84 e3 c3 2f 12 da 93 36 5c cb 32 52 d2 0d 7b ab 36 6e 91 0e f4 eb 78 91 aa e4 59 cc f9 da 38 60 90 73 a2 4b 79 03 4a 1c 90 f3 a6 2d e2 27 4c d8 57 90 79 06 6d 3a 11 4b 8d 40 8d 4e 80 ac 69 2d 67 09 ca 33 17 75 94 72 e6 60 35 14 e1 11 99 d3 0b 33 54 87 33 9a 64 13 bf ba 24 5a 83 08 2e 78 31 46 ba c0 54 b1 3e 6f ba 53 ce 6a d6 df f7 f1 66 ed 1d 1f 6e ba 33 ce a5 17 a2 fb 59 c8 52 57 cf e9 be 19 2e f0 6e 03 a8 00 91 70 0a 36 57 b6 12 98 77 62 d1 47 64 a5 7f f2 1d 48 3e e9 94 6a 81 28 e3 bc 82 52 9d fb 97 a9 81 31 7a c9 d3 e7 22 93 eb 80 71 9e 1f f2 79 18 e7 f9 c0 65 62 56 32 4a 9c 61 59 7e c2 84 bd 09 4c b8 34 ed ca 59 08 2e 88 d4 c8 5c e4 a2 08 f8 b0 4b 58 e4 08 fe c2 35 0c f2 71 15 fa b2 5f fb 62 b3 85 07 5a ff 8c 82 5b Data Ascii: C6c_/6\2R{6nxY8`sKyJ-'LWym:K@Ni-g3ur`53T3d$Z.x1FT>oSjfn3YRW.np6WwbGdH>j(R1z"qyebV2JaY~L4Y.\KX5q_bZ[
2025-03-27 14:32:54 UTC	16384	IN	Data Raw: 95 d9 6b 77 ef 5e fd e9 77 3c e3 cb f5 ab 3f 3f cf f0 fc 47 bc 79 f7 6c d7 ca 43 ed 9c 7c a7 9d 98 bb 5b 68 77 77 ce 78 ba c8 88 38 ff 8c 79 38 78 ea 0a 6f 39 79 95 c7 38 6c 9d f7 39 60 13 9d 35 51 81 84 33 a3 c9 14 b3 8b 4d 8b 2a b8 62 b8 c2 f4 83 5d d7 47 bd 2e 3d 71 6b 5b 5f ae 8b 6b 33 14 34 d6 b8 f5 c7 4e 5f c7 26 2a 00 e4 9d 22 ca 4d 01 d6 e5 1c 10 c3 04 f5 ad 21 57 04 31 78 55 86 44 ba be 60 dd 27 48 5b 04 9a 50 75 73 84 9b 9e b1 4c 00 cd c9 38 ee 3f c0 8c 98 48 e9 51 28 63 80 f9 a1 72 1e c1 d9 6a 1b d6 4f 3b 7e 6d f6 25 4f fe e0 a5 96 3d 91 39 07 c4 15 9b fb f2 c6 1a 60 7b fd 08 47 8c b9 73 54 b5 8e a9 98 4e 89 32 3a 51 8b c8 78 48 cd 2a 16 99 a8 4f a5 c1 85 d9 9a c5 3b 9b e1 88 aa 36 b5 30 ad d4 60 bd ba cf fe 3d af 37 17 37 a1 6b 18 f7 fc 08 e3 Data Ascii: kw^w<??GylC\|[hwwx8y8xo9y8l9`5Q3Mb]G.=qk[_k34N_&"M!W1xUD`'H[PusL8?HQ(crjO;~m%O=9`{GsTN2:QxH*O;60`=77k
2025-03-27 14:32:54 UTC	16384	IN	Data Raw: e7 82 68 f4 b5 d0 27 10 3c 03 46 ad 06 e7 81 1c fd d8 c2 0e 5a 75 74 9a 46 8d ed ce 65 14 ab 0f 8e 56 67 7b 84 3d 26 37 e2 8a c9 67 80 96 2a db f0 de e9 bc 85 66 18 76 da 55 7a c7 13 4f 1b be f9 16 5f 30 7c c7 2d ef b0 e1 2f 3d 44 45 b5 1b 63 4a d1 62 47 ae 37 6c 49 b4 01 26 6a 23 34 d9 ed 36 c6 6a d2 a9 a2 cd 46 d9 c6 20 23 b0 d2 9a 6d f5 b0 dd e1 aa be f0 a0 8b dd 4d 0d b0 99 7a 7b fa 63 81 bc fc b3 d9 06 8a 7e eb a5 a1 9c aa a8 31 f1 8c 14 02 aa f5 c7 a0 af a6 9d f2 ae 05 fd 03 bb 77 7f e8 c5 7f f4 d8 8f c3 39 56 38 e6 ff 83 eb 73 6f 7d c1 a5 fb ef f9 f0 bf b5 a9 7f 99 4d f8 cc 72 94 82 b9 3a 26 10 f9 ed c8 ab d6 96 2c d3 e8 49 2a 39 c0 87 50 57 63 88 45 0d c1 89 5c 0b 19 03 41 80 30 12 f3 08 97 dc 1f 4c 31 28 e0 fd 08 60 ee 99 c9 be 9b a0 a5 bd 8f 7c Data Ascii: h'<FZutFeVg{=&7gfvUzO_0\|-/=DEcJbG7lI&j#46jF #mMz{c~1w9V8so}Mr:&,I9PWcE\A0L1(`\|
2025-03-27 14:32:54 UTC	2113	IN	Data Raw: 6d e1 6c da f8 1d 37 36 55 17 f9 fe a1 10 f1 a8 29 4a 33 23 7e 85 b1 77 9b bd e4 03 d7 ac bd c8 3e 71 2c ff 17 f9 12 db c6 f2 01 b2 c4 51 e3 97 9f fc 81 d9 ea ec f0 05 f6 10 79 a0 2d 64 0f b7 d0 05 ca d8 02 55 16 b6 ba 70 c9 74 0b 99 b8 63 a1 ae 49 91 6c 1c 59 cf 91 3b 1b 6b 7c 13 47 4b e3 fa ca 01 23 c5 2b 73 69 fa e9 fc 88 b3 09 a5 b5 da c4 d1 d2 94 48 6a 0d b5 0e ad 04 ae eb 79 a9 32 5d 70 8b 3a cd 7c d5 d2 cc 3f 66 e6 45 46 7e ed d0 da ea df ff d4 2b ee b7 fc 7b e4 4b 1c 15 96 0f 90 25 ae 35 2e 79 f2 5f ed 59 99 cf ef 3d 1f 66 3f 62 8b 53 f9 bf 23 be 70 d5 b5 ab 38 d3 0b a0 2b dc cf 56 9b 38 5a 9a 12 59 f0 bb de 73 51 25 97 69 1c d8 82 3e 15 95 1b fa b9 33 e9 d9 11 47 5b b5 a4 ad a7 fa 10 f0 8d 9c d6 9b e0 d3 e3 5b d4 69 e6 ab 76 3e 3f 6c ed eb 6d 7f Data Ascii: ml76U)J3#~w>q,Qy-dUptcIlY;k\|GK#+siHjy2]p:\|?fEF~+{K%5.y_Y=f?bS#p8+V8ZYsQ%i>3G[[iv>?lm

Statistics

CPU Usage

• Acrobat.exe
• AcroCEF.exe
• AcroCEF.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• Acrobat.exe
• AcroCEF.exe
• AcroCEF.exe
• chrome.exe
• chrome.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• Acrobat.exe
• AcroCEF.exe
• AcroCEF.exe
• chrome.exe
• chrome.exe

Click to jump to process

System Behavior

Analysis Process: Acrobat.exePID: 6988, Parent PID: 4100

General

Target ID:	0
Start time:	10:32:42
Start date:	27/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\220-002-1.pdf"
Imagebase:	0x7ff676370000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

File Created

File Read

Other File Operations

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Created

Key Deleted

Key Value Created

Key Value Deleted

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Created

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread Execution Resumed

Thread Terminated

Thread Information Set

Show Windows behavior

Memory Activities

Memory Read

Memory Written

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window Created

Window UI Found

Window UI Enumerated

Show Windows behavior

Process Token Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Object Security Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 6216, Parent PID: 6988

General

Target ID:	1
Start time:	10:32:44
Start date:	27/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6af9b0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

File Read

Other File Operations

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Created

Process Information Set

Process Terminated

Show Windows behavior

Thread Activities

Thread Created

Thread Terminated

Thread Information Set

Show Windows behavior

Memory Activities

Memory Read

Memory Written

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Object Security Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: AcroCEF.exePID: 6432, Parent PID: 6216

General

Target ID:	2
Start time:	10:32:45
Start date:	27/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1616 --field-trial-handle=1576,i,4263026810805432233,14638029955789240584,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6af9b0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread Information Set

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Object Security Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3472, Parent PID: 604

General

Target ID:	3
Start time:	10:32:47
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://tinyurl.com/4dtdkpfn
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6440, Parent PID: 3472

General

Target ID:	4
Start time:	10:32:48
Start date:	27/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,3205591979190945793,5493423138147905923,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
Imagebase:	0x7ff77eaf0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly