Edit tour

Windows Analysis Report
https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf

Overview

General Information

Sample URL:	https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf
Analysis ID:	1428803
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Drops files with a non-matching file extension (content does not match file extension)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2024,i,11191498385787339962,9289795739749909594,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

String found in binary or memory: <a href="https://www.youtube.com/user/AICPAMultiMedia" rel="noopener noreferrer nofollow" target="_blank" data-socialiconname="youtube"> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: us.aicpa.org

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 14:30:38 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeServer: ApacheContent-Security-Policy: base-uri 'self';default-src 'none'; connect-src 'self' inline-only: *; font-src 'self' data: *; img-src 'self' *;script-src 'self' 'unsafe-hashes' 'sha256-H2tlmRuSoiM440uTQK7H3mt3L74Xvy3HDbFQqhasmLM=' 'sha256-F31Z235J4JoHiQd4pwhlVGhZAo9TL1xXkr998POEVGk=' 'sha256-dg9STQouzRiKJUO3yike1CtjTb8JY3xoFiB0syjsclM=' 'sha256-npzn7ujSOdyjMmFgVUD96cEc+e4ADPr6/G36kMw42xg=' 'sha256-5TFWe/7xA1mUO7yvl+1rrgKnK4IkLgDeImwowoNtSio=' 'sha256-0ris5gmMUJMPIW5+I0NnEuFoC0HsIyvgUblcUKRj8DU=' 'sha256-2YCB6Lhue7C9r6969mhdpe1UfjRUR3HR4A0E0by9Kgg=' 'sha256-dPdAVNwRUBOO9U/2jj9+7Wrv56B40z2Jv1G60xrq99k=' 'sha256-1v5J2KvQP4Gbm3K2rHEJwOXTbrRded9lfuiMfmyrgLQ=' 'sha256-zjjpOAlgWBBa3LGAToXGdQdBJ74Nk1FbPuXvyyNud+c=' 'sha256-6Vxqk2EtHXjiJTfzUejPw5pYIuKocUwpWnj5ceUldH4=' 'sha256-jWeJInrhgp2bhmYq4ENjpiKhX8vgbI25wEHe7xZmntk=' 'sha256-MkZksky8RCDrddFfcsZvpoIOBWi+U4WdS/AUDSRoFWc=' 'sha256-JgUlUrFxfMASKHj7b/5oFO6lurjlitmjXKYNNDMUD+Y=' 'sha256-jwKtf7qtuAMIgLD43eyvgH971eEPHz3iVd6yMxfeA9A=' 'sha256-D/PRixJhLrpI1HflSDVH9owyKK3PGUoiNKrmyLvd3tM=' 'sha256-HSqFHC4bxSGLtwIKYvWNU/qQ4Q0oBveduu1wZdFXO+M=' 'sha256-nFFbE/gfqIA03gqrxwtcaywPXAg1nnX0YRI/RaMK8Lo=' 'sha256-k0FSIbTuVFHaoQGas062MT8MxUolKkiZqbpYaF929+c=' 'sha256-rqmm25uujCmwRm3UkPUpq2WM1jbmHLDuEQGkdF9+470=' 'sha256-U7ve//F4t99wIgL0aTmqx7pcSv+0E36f4XP+HwqZU30=' 'sha256-zZ15axXrbdoSqrE42O5dT3pilUPZCKObwx+aitQeT78=' 'sha256-C76Klxj0BnbMe8uaGS7kU+98MDherr94oIyjKlkWxTk=' 'sha256-244y469+HkRw3VOen69J4OuOZPA1f+0QrXS6/KOHJg0=' 'sha256-DNpb+AMfC5A+CyVJTBZTmmAK5kjYiOPpCYonuCoNUDc=' 'sha256-4xvwiEnvCWO3LygP+6rATbySh1+ealhANaQTvdaQaxk=' 'sha256-ClkLV8HfXoqqJ9Kl5sJglafxsF9F9ogSxHZxhR07bq4=' 'sha256-4TpZ3Tx5SLybDXPQaSHGuP1RU4D+pzck+02JLVY61BY=' 'sha256-osjxnKEPL/pQJbFk1dKsF7PYFmTyMWGmVSiL9inhxJY=' 'unsafe-inline' 'unsafe-eval' https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000054.js https://cdn.mouseflow.com/projects/79d6f783-d04b-41b1-8cd4-ff5b0aef991b.js https://connect.facebook.net/en_US/fbevents.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://siteintercept.qualtrics.com/dxjsmodule/11.94e7d7f0c6a48ca94c06.chunk.js https://snap.licdn.com/li.lms-analytics/insight.beta.min.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.google-analytics.com/analytics.js https://www.google.com

Source: chromecache_62.1.dr	String found in binary or memory: http://account.aicpa.org/eWeb
Source: chromecache_62.1.dr	String found in binary or memory: http://blog.aicpa.org/
Source: chromecache_62.1.dr	String found in binary or memory: http://ogp.me/ns#
Source: chromecache_62.1.dr	String found in binary or memory: http://ogp.me/ns/article#
Source: chromecache_62.1.dr	String found in binary or memory: http://www.aicpa.org/
Source: chromecache_62.1.dr	String found in binary or memory: http://www.aicpa.org/BecomeACPA/CPAExam
Source: chromecache_62.1.dr	String found in binary or memory: http://www.aicpa.org/InterestAreas/FRC
Source: chromecache_62.1.dr	String found in binary or memory: http://www.aicpa.org/InterestAreas/Tax
Source: chromecache_62.1.dr	String found in binary or memory: http://www.aicpa.org/Membership
Source: chromecache_62.1.dr	String found in binary or memory: https://account.aicpa.org/eWeb
Source: chromecache_62.1.dr	String found in binary or memory: https://account.aicpa.org/eweb/dynamicpage.aspx?webcode=CreateAccountCheck&RedirectURL=https://us.ai
Source: chromecache_62.1.dr	String found in binary or memory: https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js"
Source: chromecache_62.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_62.1.dr	String found in binary or memory: https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/accounting-and-auditing
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/forensic-and-valuation-services
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/risk-management-and-internal-control
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/tax-and-life-planning
Source: chromecache_62.1.dr	String found in binary or memory: https://certificates.aicpastore.com/technology
Source: chromecache_62.1.dr	String found in binary or memory: https://competency.aicpa.org/
Source: chromecache_62.1.dr	String found in binary or memory: https://cpapowered.org/
Source: chromecache_62.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_62.1.dr	String found in binary or memory: https://future.aicpa.org/about/help
Source: chromecache_62.1.dr	String found in binary or memory: https://future.aicpa.org/about/refund-policy
Source: chromecache_62.1.dr	String found in binary or memory: https://future.aicpa.org/cpe-learning
Source: chromecache_62.1.dr	String found in binary or memory: https://future.aicpa.org/cpe-learning/course/cpexpress
Source: chromecache_62.1.dr	String found in binary or memory: https://future.aicpa.org/cpe-learning/webcast/annual-webcast-pass
Source: chromecache_62.1.dr	String found in binary or memory: https://login.aicpa.org/ForgotPassword
Source: chromecache_62.1.dr	String found in binary or memory: https://mycareer.aicpa-cima.com/jobs/north-america/?utm_source=aicpa&utm_medium=website&utm_campaign
Source: chromecache_62.1.dr	String found in binary or memory: https://prima.aicpa.org/
Source: chromecache_62.1.dr	String found in binary or memory: https://salary.aicpaglobal.com/
Source: chromecache_62.1.dr	String found in binary or memory: https://secureaicpa.okta.com
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://strgnfibcom.blob.core.windows.net/nfibcom/Banking-Survey-2023-Part-II.pdf)
Source: chromecache_62.1.dr	String found in binary or memory: https://us-content.vergic.com
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2013.04.11-report-on-civil
Source: downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/tax-policy-concept-stateme
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/disruption.html
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/resources/download/aicpa-ssarss-currently-effective
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effec
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/resources/landing/asb-auditing-standards-board
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/resources/landing/press-center
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/search?category=news&sortBy=newest-first
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa-cima.com/topic/technology
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/404.html
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/account/cart
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/account/purchases
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/category/cpe-learning/financial-planning
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/accounting-reporting
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/audit-assurance
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/certificate-program
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/conference
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/course
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/ethics
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/forensic-services
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/government
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/not-for-profit
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/publication
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/tax
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/cpe-learning/webcast-conference
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/membership/join.html
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/resources/landing/press-center
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/search/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/search/?category=cpe-learning
Source: chromecache_62.1.dr	String found in binary or memory: https://www.aicpa.org/search/webcast
Source: chromecache_62.1.dr	String found in binary or memory: https://www.cgma.org
Source: chromecache_62.1.dr	String found in binary or memory: https://www.evolutionofcpa.org/
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://www.federalregister.gov/documents/2023/09/28/2023-21226/beneficial-ownership-information-rep
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://www.fincen.gov/beneficial-ownership-information-reporting-rule-fact-sheet)
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://www.fincen.gov/boi-faqs)
Source: chromecache_62.1.dr	String found in binary or memory: https://www.fm-magazine.com/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-1072239920
Source: chromecache_62.1.dr	String found in binary or memory: https://www.journalofaccountancy.com/
Source: chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	String found in binary or memory: https://www.justice.gov/archives/jm/criminal-resource-manual-910-knowingly-and-willfully#:~:text=An%
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thetaxadviser.com/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thiswaytocpa.com/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thiswaytocpa.com/education/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thiswaytocpa.com/segmented-landing/distinguished-achievement-in-accounting/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thiswaytocpa.com/segmented-landing/recruitment/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.thiswaytocpa.com/work-experience/plan-career/
Source: chromecache_62.1.dr	String found in binary or memory: https://www.youtube.com/user/AICPAMultiMedia

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.15:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.21.200:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49715 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@19/13@4/4

Source: chromecache_61.1.dr	Initial sample: https://strgnfibcom.blob.core.windows.net/nfibcom/Banking-Survey-2023-Part-II.pdf
Source: chromecache_61.1.dr	Initial sample: https://strgnfibcom.blob.core.windows.net/nfibcom/banking-survey-2023-part-ii.pdf
Source: chromecache_61.1.dr	Initial sample: https://www.justice.gov/archives/jm/criminal-resource-manual-910-knowingly-and-willfully#:~:text=An%20act%20is%20done%20%22willfully,Gregg%2C%20612%20F
Source: chromecache_61.1.dr	Initial sample: https://www.justice.gov/archives/jm/criminal-resource-manual-910-knowingly-and-willfully#:~:text=an%20act%20is%20done%20%22willfully,gregg%2c%20612%20f
Source: chromecache_61.1.dr	Initial sample: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2013.04.11-report-on-civil-tax-penalties-the-need-for-reform.pdf
Source: chromecache_61.1.dr	Initial sample: mailto:Melanie.Lauridsen@aicpa-cima.com
Source: chromecache_61.1.dr	Initial sample: https://www.fincen.gov/boi-faqs
Source: chromecache_61.1.dr	Initial sample: https://www.fincen.gov/beneficial-ownership-information-reporting-rule-fact-sheet
Source: chromecache_61.1.dr	Initial sample: mailto:Kate.Kiley@aicpa-cima.com
Source: chromecache_61.1.dr	Initial sample: https://www.federalregister.gov/documents/2023/09/28/2023-21226/beneficial-ownership-information-reporting-deadline-extension-for-reporting-companies-created-or#print
Source: chromecache_61.1.dr	Initial sample: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/tax-policy-concept-statement-no-1-global.pdf

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\9c0d67a3-6f07-4025-aeff-2f08c8df9164.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2024,i,11191498385787339962,9289795739749909594,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2024,i,11191498385787339962,9289795739749909594,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 61
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 61			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
www.google.com	172.253.124.103	true	false	high
aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com	23.21.70.52	true	false	high
us.aicpa.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://us.aicpa.org/favicon.ico	false	high
https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf	false	high
file:///C:/Users/user/Downloads/downloaded.pdf	false	low

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://future.aicpa.org/cpe-learning	chromecache_62.1.dr	false	high
https://cpapowered.org/	chromecache_62.1.dr	false	unknown
https://www.aicpa.org/category/cpe-learning/financial-planning	chromecache_62.1.dr	false	high
http://account.aicpa.org/eWeb	chromecache_62.1.dr	false	high
https://www.thiswaytocpa.com/segmented-landing/distinguished-achievement-in-accounting/	chromecache_62.1.dr	false	high
https://secureaicpa.okta.com	chromecache_62.1.dr	false	high
https://www.fincen.gov/beneficial-ownership-information-reporting-rule-fact-sheet)	chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	false	high
https://www.aicpa.org/cpe-learning	chromecache_62.1.dr	false	high
https://certificates.aicpastore.com/	chromecache_62.1.dr	false	high
https://www.aicpa.org/404.html	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/ethics	chromecache_62.1.dr	false	high
https://certificates.aicpastore.com/risk-management-and-internal-control	chromecache_62.1.dr	false	high
https://www.aicpa-cima.com/disruption.html	chromecache_62.1.dr	false	unknown
https://www.aicpa.org/membership/join.html	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/audit-assurance	chromecache_62.1.dr	false	high
https://www.evolutionofcpa.org/	chromecache_62.1.dr	false	unknown
https://certificates.aicpastore.com/accounting-and-auditing	chromecache_62.1.dr	false	high
https://certificates.aicpastore.com/technology	chromecache_62.1.dr	false	high
https://prima.aicpa.org/	chromecache_62.1.dr	false	high
http://www.aicpa.org/BecomeACPA/CPAExam	chromecache_62.1.dr	false	high
https://future.aicpa.org/about/refund-policy	chromecache_62.1.dr	false	high
https://www.fm-magazine.com/	chromecache_62.1.dr	false	unknown
https://mycareer.aicpa-cima.com/jobs/north-america/?utm_source=aicpa&utm_medium=website&utm_campaign	chromecache_62.1.dr	false	unknown
https://www.aicpa.org/cpe-learning/tax	chromecache_62.1.dr	false	high
https://www.aicpa.org/resources/landing/press-center	chromecache_62.1.dr	false	high
https://www.thiswaytocpa.com/	chromecache_62.1.dr	false	high
http://ogp.me/ns/article#	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/course	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/publication	chromecache_62.1.dr	false	high
https://www.fincen.gov/boi-faqs)	chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	false	high
https://www.thiswaytocpa.com/segmented-landing/recruitment/	chromecache_62.1.dr	false	high
https://www.aicpa-cima.com/resources/landing/asb-auditing-standards-board	chromecache_62.1.dr	false	unknown
https://www.aicpa-cima.com/resources/landing/press-center	chromecache_62.1.dr	false	unknown
http://www.aicpa.org/InterestAreas/FRC	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/conference	chromecache_62.1.dr	false	high
https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js	chromecache_62.1.dr	false	high
https://future.aicpa.org/about/help	chromecache_62.1.dr	false	high
https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective	chromecache_62.1.dr	false	unknown
https://www.aicpa.org/cpe-learning/forensic-services	chromecache_62.1.dr	false	high
https://competency.aicpa.org/	chromecache_62.1.dr	false	high
https://us-content.vergic.com	chromecache_62.1.dr	false	unknown
https://www.aicpa-cima.com/resources/download/aicpa-ssarss-currently-effective	chromecache_62.1.dr	false	unknown
https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js"	chromecache_62.1.dr	false	high
https://www.aicpa.org/account/cart	chromecache_62.1.dr	false	high
https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/tax-policy-concept-stateme	downloaded.pdf.crdownload.0.dr	false	high
https://www.aicpa.org/cpe-learning/certificate-program	chromecache_62.1.dr	false	high
https://www.youtube.com/user/AICPAMultiMedia	chromecache_62.1.dr	false	high
http://www.aicpa.org/InterestAreas/Tax	chromecache_62.1.dr	false	high
https://login.aicpa.org/ForgotPassword	chromecache_62.1.dr	false	high
https://www.aicpa.org/search/?category=cpe-learning	chromecache_62.1.dr	false	high
https://www.thiswaytocpa.com/education/	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/government	chromecache_62.1.dr	false	high
http://www.aicpa.org/Membership	chromecache_62.1.dr	false	high
https://certificates.aicpastore.com/forensic-and-valuation-services	chromecache_62.1.dr	false	high
https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2013.04.11-report-on-civil	chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	false	high
https://www.aicpa.org/cpe-learning/not-for-profit	chromecache_62.1.dr	false	high
https://www.aicpa-cima.com/resources/download/aicpa-statements-on-auditing-standards-currently-effec	chromecache_62.1.dr	false	unknown
https://certificates.aicpastore.com/tax-and-life-planning	chromecache_62.1.dr	false	high
https://www.aicpa-cima.com/search?category=news&sortBy=newest-first	chromecache_62.1.dr	false	unknown
https://www.aicpa-cima.com/topic/technology	chromecache_62.1.dr	false	unknown
https://account.aicpa.org/eWeb	chromecache_62.1.dr	false	high
https://www.thetaxadviser.com/	chromecache_62.1.dr	false	high
https://www.aicpa.org/search/webcast	chromecache_62.1.dr	false	high
http://blog.aicpa.org/	chromecache_62.1.dr	false	high
https://www.aicpa.org/account/purchases	chromecache_62.1.dr	false	high
https://www.journalofaccountancy.com/	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/accounting-reporting	chromecache_62.1.dr	false	high
https://www.aicpa.org/cpe-learning/webcast-conference	chromecache_62.1.dr	false	high
https://www.cgma.org	chromecache_62.1.dr	false	high
http://ogp.me/ns#	chromecache_62.1.dr	false	high
https://www.federalregister.gov/documents/2023/09/28/2023-21226/beneficial-ownership-information-rep	chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	false	high
https://account.aicpa.org/eweb/dynamicpage.aspx?webcode=CreateAccountCheck&RedirectURL=https://us.ai	chromecache_62.1.dr	false	high
https://www.aicpa.org/search/	chromecache_62.1.dr	false	high
https://www.justice.gov/archives/jm/criminal-resource-manual-910-knowingly-and-willfully#:~:text=An%	chromecache_61.1.dr, downloaded.pdf.crdownload.0.dr	false	high
https://salary.aicpaglobal.com/	chromecache_62.1.dr	false	unknown
http://www.aicpa.org/	chromecache_62.1.dr	false	high
https://future.aicpa.org/cpe-learning/webcast/annual-webcast-pass	chromecache_62.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.21.70.52	aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.124.103	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428803
Start date and time:	2024-04-19 16:30:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@19/13@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.177.94, 142.251.15.113, 142.251.15.102, 142.251.15.138, 142.251.15.100, 142.251.15.101, 142.251.15.139, 64.233.185.84, 34.104.35.123, 23.40.205.59, 64.233.185.94, 74.125.138.100, 74.125.138.139, 74.125.138.101, 74.125.138.113, 74.125.138.138, 74.125.138.102
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 13:30:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9837361734756054
Encrypted:	false
SSDEEP:	48:8Xd/T3zjhdHzidAKZdA1FehwiZUklqeh0y+3:8VXjhjry
MD5:	0C09B9714460FC9BB6A5F942133FD23E
SHA1:	02387888F558BAC15861A0D6E1DA45926EF16984
SHA-256:	F1B54E098E312C48280B5EF1814293FF8FDB5C2CB5614E08305A2C3743692EEC
SHA-512:	41C833FCE4CE1D8AC7370A4CD03564C7A5D3A5557016F805B956AD880752F7F257A4D9FA8D80623A00ACB909A100070AC19161608FC14F4DF277A9C2938801A7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....s..&f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 13:30:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.000154240047926
Encrypted:	false
SSDEEP:	48:8H5d/T3zjhdHzidAKZdA1seh/iZUkAQkqehby+2:8HLXjht9QKy
MD5:	9A90C1CC6045A33E839527EE2E03C14C
SHA1:	CA235CD74286D7AC078D5960C06425C2F2938DD9
SHA-256:	FFC420612A5B5C3500B742C3D2E777AA35005643579116E9F6C0163CAE221C2C
SHA-512:	139B34AC410E0A941EBFC9A0430E7DF12F81236C9716263691FD7FEA7D4F10C72F4DAEF388C9A8752FC7EAE7F28908D21ABC60E05DC11C19E472858FEFABF3EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......&f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010861836920029
Encrypted:	false
SSDEEP:	48:8ad/T3zjAHzidAKZdA14meh7sFiZUkmgqeh7sBy+BX:8qXjWn/y
MD5:	0094F4AA414D5D6CF3A40F202DC070C1
SHA1:	54977C9B8C066BF02812A1351638BF0606F73936
SHA-256:	3100EAD068175C87FF6458E80C957F51746D2B748EE1496D73C87840087A1560
SHA-512:	C7526841AB6559F3BF3A9C31DCD60C15A24C3E6D24F01CEEDEF8D24440CC8559D22189C95C6ABB0D31C18624C5FD737EC95D1AA29E922A5D8F5D0DAFD44C4283
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 13:30:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.998016843950935
Encrypted:	false
SSDEEP:	48:8vd/T3zjhdHzidAKZdA1TehDiZUkwqehny+R:8NXjhepy
MD5:	C03F8713A9759B93A32F983E8B61FFA3
SHA1:	01B4DB00C8E318CB3954810F0DC4CCCEFC4A85DA
SHA-256:	1288556522E7D87FE3454AEE1C0EEA579C2EE8CABB7C5ADA1B200790F6269663
SHA-512:	8AD177498D30527C6B187BFA95ACF3C1E0CA72CCC0BEE4B9CED9AF5EF00DBABCCFE32D7AB34D10DB91E4DD76687388779FF8835A3CE7564D949A2982091230A3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....7.&f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 13:30:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987026104951076
Encrypted:	false
SSDEEP:	48:81d/T3zjhdHzidAKZdA1dehBiZUk1W1qehVy+C:8HXjhO91y
MD5:	348CCD18F41FB4A04939EA8276819BC5
SHA1:	01FF9AC355DE3EA8681F616CC6BCAE542483D39D
SHA-256:	464CEB42DFCE92E3C3D57745A570C49CF4FDAC921375C2B9C74D08C0124615F1
SHA-512:	4425039D591160BA05E1994B85D2E9E0B321203885839133FD61B1A3131561A9A907B73DCC14E446565983CF2B2AE6928268C45E02083028A76F78EB4293B0E3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....8".&f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 13:30:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9986287956571154
Encrypted:	false
SSDEEP:	48:8qd/T3zjhdHzidAKZdA1duTeehOuTbbiZUk5OjqehOuTb/y+yT+:86XjhkTfTbxWOvTb/y7T
MD5:	C9FF2F09E44CB1361BD75A9F983C291C
SHA1:	15041EC4AC9CFFC51DE9F89C457FB496EEB9D603
SHA-256:	39D3B2DE94B7FAEC8A79F3F4B0E953023C58BB5B54E93A5B4F4D8807A26C04AE
SHA-512:	C9F04DBE76EFB77CB071E372270A44F14135C9B75AEF0873A0BE2A387763E9CE93B62DE003CAE25F2ECB63CBFFA13689B58D727A68BFA6B36EF98687B8FDBA6F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....p..%f...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X.s....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............T.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\9c0d67a3-6f07-4025-aeff-2f08c8df9164.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	17894
Entropy (8bit):	7.9297258072368555
Encrypted:	false
SSDEEP:	384:yZML7/L5jTGWRgqiikhho7CCqx5MW/khnWxCeHTHCTyrcxd29t26ZRnxz:y23VXGWRgdHZXseHT0LxRkRnxz
MD5:	F14A2E7B734B9D2A56B5D992C4330745
SHA1:	18E603C291E272D47CBEC7149A1790F90C9B4541
SHA-256:	CD5FD596C06A8C4FABF4516B364D51793A0E360E97EE0FD0B11E570251B236E1
SHA-512:	47F74148B3A6459D0038BF7BE212F426BECFF1EF0FC926D8FA5E29B722DFED43351178E2B9D624AF93D4620043CDB8E520A8F26A8A331EBC38C4E8F1AE595680
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R/Image8 8 0 R>>/ExtGState<</GS7 7 0 R/GS11 11 0 R>>/Font<</F1 9 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 21 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 4913>>..stream..x..]Qw..~.9..\|.z".........I...&{...M.d...H.JR........;..m{bI$..................o...$8{{....%.V..W.z..b...L....$aI.....M.....).^...E1....\ER........._m^.:..Y.......y.x..y..........T<.+.<b.`.XF.Q..y0gb#.l...vQ....o.j..E5..l6..4"..x....*....q.\|.J...).....#....{.YA.0F...>....oa0.Gp....A.S....I.....8.Tk.O.Ty.Ijl......J.B.(}

C:\Users\user\Downloads\downloaded.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	204117
Entropy (8bit):	7.748587799807999
Encrypted:	false
SSDEEP:	3072:iVeMqzwYlLB63jO/GspemQTrA7PYlU+h1VfKhIIqC0rAD7d7+sdz:Uf+lN63i/NpemwZh1VihdZ71nz
MD5:	63BC21B1BC3AF1851B4DDCB319A8C328
SHA1:	9CD6DD57D2CA92EF0219D48AC33AFDA1070CCD12
SHA-256:	4D839ED23E041F99086705673780A68F174AF55EF759880F5B14C71C70245297
SHA-512:	1C379E00ED3F6E00AF27C02B8A71C2FA6E744E6733F6DA91135DDA28B772A332C61E840CB653FBBBEDDD33ECD425092A0F95F4547F44EDDDE24A060F6A0FB549
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R/Image8 8 0 R>>/ExtGState<</GS7 7 0 R/GS11 11 0 R>>/Font<</F1 9 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 21 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 4913>>..stream..x..]Qw..~.9..\|.z".........I...&{...M.d...H.JR........;..m{bI$..................o...$8{{....%.V..W.z..b...L....$aI.....M.....).^...E1....\ER........._m^.:..Y.......y.x..y..........T<.+.<b.`.XF.Q..y0gb#.l...vQ....o.j..E5..l6..4"..x....*....q.\|.J...).....#....{.YA.0F...>....oa0.Gp....A.S....I.....8.Tk.O.Ty.Ijl......J.B.(}

C:\Users\user\Downloads\downloaded.pdf.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	dropped
Size (bytes):	204117
Entropy (8bit):	7.748587799807999
Encrypted:	false
SSDEEP:	3072:iVeMqzwYlLB63jO/GspemQTrA7PYlU+h1VfKhIIqC0rAD7d7+sdz:Uf+lN63i/NpemwZh1VihdZ71nz
MD5:	63BC21B1BC3AF1851B4DDCB319A8C328
SHA1:	9CD6DD57D2CA92EF0219D48AC33AFDA1070CCD12
SHA-256:	4D839ED23E041F99086705673780A68F174AF55EF759880F5B14C71C70245297
SHA-512:	1C379E00ED3F6E00AF27C02B8A71C2FA6E744E6733F6DA91135DDA28B772A332C61E840CB653FBBBEDDD33ECD425092A0F95F4547F44EDDDE24A060F6A0FB549
Malicious:	false
Reputation:	low
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R/Image8 8 0 R>>/ExtGState<</GS7 7 0 R/GS11 11 0 R>>/Font<</F1 9 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 21 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 4913>>..stream..x..]Qw..~.9..\|.z".........I...&{...M.d...H.JR........;..m{bI$..................o...$8{{....%.V..W.z..b...L....$aI.....M.....).^...E1....\ER........._m^.:..Y.......y.x..y..........T<.+.<b.`.XF.Q..y0gb#.l...vQ....o.j..E5..l6..4"..x....*....q.\|.J...).....#....{.YA.0F...>....oa0.Gp....A.S....I.....8.Tk.O.Ty.Ijl......J.B.(}

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7, 6 pages
Category:	downloaded
Size (bytes):	204117
Entropy (8bit):	7.748587799807999
Encrypted:	false
SSDEEP:	3072:iVeMqzwYlLB63jO/GspemQTrA7PYlU+h1VfKhIIqC0rAD7d7+sdz:Uf+lN63i/NpemwZh1VihdZ71nz
MD5:	63BC21B1BC3AF1851B4DDCB319A8C328
SHA1:	9CD6DD57D2CA92EF0219D48AC33AFDA1070CCD12
SHA-256:	4D839ED23E041F99086705673780A68F174AF55EF759880F5B14C71C70245297
SHA-512:	1C379E00ED3F6E00AF27C02B8A71C2FA6E744E6733F6DA91135DDA28B772A332C61E840CB653FBBBEDDD33ECD425092A0F95F4547F44EDDDE24A060F6A0FB549
Malicious:	false
Reputation:	low
URL:	https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R/Image8 8 0 R>>/ExtGState<</GS7 7 0 R/GS11 11 0 R>>/Font<</F1 9 0 R/F2 12 0 R/F3 14 0 R/F4 19 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/Annots[ 21 0 R] /MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 4913>>..stream..x..]Qw..~.9..\|.z".........I...&{...M.d...H.JR........;..m{bI$..................o...$8{{....%.V..W.z..b...L....$aI.....M.....).^...E1....\ER........._m^.:..Y.......y.x..y..........T<.+.<b.`.XF.Q..y0gb#.l...vQ....o.j..E5..l6..4"..x....*....q.\|.J...).....#....{.YA.0F...>....oa0.Gp....A.S....I.....8.Tk.O.Ty.Ijl......J.B.(}

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2163), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	83484
Entropy (8bit):	4.882265041157803
Encrypted:	false
SSDEEP:	1536:azw7pDpGl+zRpGFxoyOAozbBnWpdJjPY2Fx:azw7pDpGl+zRpGrb+bhWpdJTY2Fx
MD5:	1843DFCF1E93582F6F2049E17C39B718
SHA1:	E06B3B554F8F4D1081F824436D6FEC0EDCA0160C
SHA-256:	92722F26F2687D8DFC088659BC36FA3130697A8838D766508C191AD9F349DFE3
SHA-512:	D2AE64045E0821BA8A23F8F5BF249F4FD9123F848450F28519CAA6FDF9A26A9A21328139975C57070EE3CD665FC66794AF1CDB1BF1906261DD5B9BF3BF97BC4C
Malicious:	false
Reputation:	low
URL:	https://us.aicpa.org/favicon.ico
Preview:	<!doctype html>..<html prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#" lang="en">.. <head>.. <title>Page not found</title>.. <link rel="shortcut icon" href="/content/dam/aicpanas/favicon.ico"/>.<link rel="apple-touch-icon-precomposed" sizes="57x57" href="/content/dam/aicpa/favicons/aicpa-favicon-57x572.png"/>.<meta http-equiv="X-UA-Compatible" content="IE=edge">..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1">..<meta name="msapplication-tap-highlight" content="no">.. GSC for Prod-->..<meta name="google-site-verification" content="GBiq6UfFcHJEWvMfI4s-UyZpATXH0a4qMwqP8hexyj0">......<meta property="og:title" content="Page not found"/>..<meta property="og:type" content="website"/>..<meta property="og:url" content="https://www.aicpa.org/404.html"/>..<meta property="og:site_name" content="AICPA"/>..<link href="https://fonts.googleapis.com/css?family=Roboto:400,400i,500,500i,700,700i" rel="stylesheet">..<script type="t

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 16:30:36.745630980 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:36.745692968 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:36.745769978 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:36.746691942 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:36.746711016 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.114340067 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.114717007 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.114744902 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.116413116 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.116501093 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.117618084 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.117705107 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.117928028 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.117935896 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.172281027 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353136063 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353169918 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353188992 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353215933 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353245974 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353266954 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353266954 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353296041 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353311062 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353331089 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353347063 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353401899 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353446007 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353472948 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353485107 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.353502035 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353523016 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.353538990 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.394320011 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.469845057 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.469909906 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.469961882 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.469986916 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.470015049 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.470033884 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.470052958 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.470094919 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.470123053 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.470129013 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.470154047 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.470176935 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.470204115 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.470269918 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587136030 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587203026 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587336063 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587335110 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587369919 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587403059 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587414026 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587440014 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587447882 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587471962 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587491035 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587557077 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587603092 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587625980 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587631941 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587656021 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587671995 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587726116 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587778091 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587800980 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587809086 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587829113 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587893963 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587934971 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587939978 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.587960005 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.587971926 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.588013887 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.588036060 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.588067055 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.588141918 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.588144064 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.588164091 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.588215113 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.593540907 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.593578100 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.593662977 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.593919039 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.593936920 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.597045898 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.597096920 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.597183943 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.597666979 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.597695112 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.703790903 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.703864098 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.703915119 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.703948975 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.703969955 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.703991890 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.703996897 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704026937 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704058886 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704081059 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704090118 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704132080 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704147100 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704178095 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704271078 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704327106 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704340935 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704348087 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704391956 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.704473019 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.704525948 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.705878973 CEST	49696	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.705894947 CEST	443	49696	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.832740068 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.833046913 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.833070993 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.834208012 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.834537983 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.834688902 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.834697962 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.834717989 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.836801052 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.837105989 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.837141037 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.838287115 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.838603973 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.838777065 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.839241028 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:37.880196095 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:37.886375904 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.187477112 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187511921 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187570095 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187665939 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.187701941 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187732935 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.187757015 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.187819958 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187871933 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187921047 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.187938929 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.187999964 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242563963 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242595911 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242726088 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242726088 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242758989 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242785931 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242805004 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242831945 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242832899 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242856979 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242862940 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242887020 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242897034 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.242945910 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.242957115 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.284358025 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.304825068 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.304884911 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.304956913 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.304987907 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305018902 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305047989 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305164099 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305212975 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305268049 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305279016 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305315971 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305336952 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305409908 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305480003 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305493116 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305527925 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305561066 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305617094 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305675030 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305699110 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.305716038 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.305775881 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.346193075 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.346371889 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.359474897 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359534979 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359625101 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.359673977 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359690905 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.359724045 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.359743118 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359792948 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359986067 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.359992027 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.360017061 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.360028028 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.360050917 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.360078096 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.360150099 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.360158920 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.402328968 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.402544975 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.402586937 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.422482967 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.422601938 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.422854900 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.422854900 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.422902107 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423044920 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423073053 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423098087 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423271894 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423284054 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423357010 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423367977 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423455000 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423482895 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423523903 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423548937 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423566103 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.423587084 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.423614025 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.456429958 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.463316917 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.463381052 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.463586092 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.463617086 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.463696003 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477010012 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477051973 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477108955 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477153063 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477166891 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477186918 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477247000 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477256060 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477423906 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.477477074 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477675915 CEST	49699	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.477698088 CEST	443	49699	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540261030 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540323019 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540393114 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540420055 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540438890 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540468931 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540477037 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540502071 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540534019 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540549994 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540554047 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540579081 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540612936 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540627003 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540674925 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540728092 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540736914 CEST	443	49701	23.21.70.52	192.168.2.16
Apr 19, 2024 16:30:38.540798903 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:38.540815115 CEST	49701	443	192.168.2.16	23.21.70.52
Apr 19, 2024 16:30:41.508138895 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.508166075 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.508255005 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.508541107 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.508554935 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.736176014 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.736494064 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.736505032 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.738198996 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.738284111 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.739487886 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.739573956 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.785284042 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:41.785291910 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:41.833281040 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:43.808828115 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:44.113310099 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:44.720352888 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:45.925338984 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:48.330323935 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:50.184454918 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.184535027 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.184909105 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.186892986 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.186937094 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.409120083 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.409233093 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.414741039 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.414757967 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.415153027 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.464287996 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.476286888 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.524116039 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.609941006 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.610079050 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.610156059 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.610156059 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.610189915 CEST	49706	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.610207081 CEST	443	49706	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.647005081 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.647033930 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.647123098 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.647521019 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.647536993 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.867686987 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.867800951 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.869365931 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.869378090 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.869704962 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:50.871069908 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:50.916136980 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:51.051508904 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.051584005 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.051724911 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.053261042 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.053297043 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.073057890 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:51.073195934 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:51.073312044 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:51.074347019 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:51.074363947 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:51.074378014 CEST	49707	443	192.168.2.16	184.31.62.93
Apr 19, 2024 16:30:51.074383974 CEST	443	49707	184.31.62.93	192.168.2.16
Apr 19, 2024 16:30:51.563406944 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.563597918 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.567759991 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.567774057 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.568065882 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.613367081 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.648715973 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:51.696114063 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:51.730381966 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:51.730602026 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:51.730906010 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:51.964787006 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:30:52.054666996 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054730892 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054753065 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054791927 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054817915 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.054837942 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054848909 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.054873943 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.054915905 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.054948092 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.055028915 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.055036068 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.055144072 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.055202007 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.073066950 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.073085070 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.073096037 CEST	49708	443	192.168.2.16	20.114.59.183
Apr 19, 2024 16:30:52.073101044 CEST	443	49708	20.114.59.183	192.168.2.16
Apr 19, 2024 16:30:52.268373966 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:30:52.875399113 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:30:52.893192053 CEST	49702	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:30:52.893229008 CEST	443	49702	172.253.124.103	192.168.2.16
Apr 19, 2024 16:30:53.131325960 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:30:54.089334011 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:30:56.442604065 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:30:56.490355968 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:30:56.746393919 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:30:57.353372097 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:30:58.567550898 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:31:00.977360964 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:31:01.297487020 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:31:02.736329079 CEST	49673	443	192.168.2.16	204.79.197.203
Apr 19, 2024 16:31:05.787364960 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:31:10.909466982 CEST	49678	443	192.168.2.16	20.189.173.10
Apr 19, 2024 16:31:11.342302084 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.342390060 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:11.342494011 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.343807936 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.343842983 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:11.746272087 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:11.746531963 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.800697088 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.800750017 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:11.801775932 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:11.803092003 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.803144932 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:11.803268909 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088820934 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088850975 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088896036 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088938951 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.088952065 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088964939 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.088990927 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.089021921 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.089507103 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.089524031 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.089534998 CEST	49710	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.089541912 CEST	443	49710	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.182720900 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.182771921 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.182866096 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.183033943 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.183046103 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.586231947 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.587012053 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.587085962 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.588068962 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.588085890 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.588145971 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.588164091 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.866641998 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.866730928 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.866807938 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.866873026 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.866909027 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.866938114 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.866956949 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.867017984 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.867227077 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.867261887 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.867285967 CEST	49711	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.867300987 CEST	443	49711	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.919673920 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.919718027 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:12.919821978 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.919948101 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:12.919962883 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.318430901 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.319371939 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.319446087 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.320234060 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.320246935 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.320331097 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.320347071 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584655046 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584707022 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584775925 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584821939 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.584855080 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584979057 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.584981918 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.585035086 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.585202932 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.585223913 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.585237026 CEST	49712	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.585244894 CEST	443	49712	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.632139921 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.632220984 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:13.632328033 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.632479906 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:13.632502079 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.035633087 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.036396980 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.036451101 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.037131071 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.037143946 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.037188053 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.037220001 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323518991 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323574066 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323674917 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323745012 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.323776960 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323803902 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.323827982 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.323854923 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.324085951 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.324132919 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.324166059 CEST	49713	443	192.168.2.16	40.126.29.15
Apr 19, 2024 16:31:14.324179888 CEST	443	49713	40.126.29.15	192.168.2.16
Apr 19, 2024 16:31:14.511734009 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.511768103 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.511955976 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.513966084 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.513988018 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.851052999 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.851180077 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.852155924 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.852231979 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.896183968 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.896195889 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.896979094 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:14.897058964 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.898828030 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:14.898890018 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.155963898 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.156037092 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.156043053 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.156069994 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.156117916 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.156137943 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.158642054 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.158693075 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.158755064 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.158803940 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.161153078 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.161171913 CEST	443	49714	13.107.21.200	192.168.2.16
Apr 19, 2024 16:31:15.161185980 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.161223888 CEST	49714	443	192.168.2.16	13.107.21.200
Apr 19, 2024 16:31:15.395128012 CEST	49680	80	192.168.2.16	192.229.211.108
Apr 19, 2024 16:31:28.498543024 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:28.498622894 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:28.498770952 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:28.499300957 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:28.499327898 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.100969076 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.101241112 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.103673935 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.103693008 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.104024887 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.110763073 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.156116962 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.684830904 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.684889078 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.684931993 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.685280085 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.685280085 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.685352087 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.685396910 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.685718060 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.687972069 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.687973022 CEST	49715	443	192.168.2.16	40.127.169.103
Apr 19, 2024 16:31:29.688038111 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:29.688071966 CEST	443	49715	40.127.169.103	192.168.2.16
Apr 19, 2024 16:31:41.468453884 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:41.468540907 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.468739033 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:41.468954086 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:41.468993902 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.685344934 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.685659885 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:41.685686111 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.686374903 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.686645031 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:41.686902046 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:41.739391088 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:51.727114916 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:51.727314949 CEST	443	49717	172.253.124.103	192.168.2.16
Apr 19, 2024 16:31:51.727576017 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:52.890486956 CEST	49717	443	192.168.2.16	172.253.124.103
Apr 19, 2024 16:31:52.890552044 CEST	443	49717	172.253.124.103	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 16:30:36.622204065 CEST	51215	53	192.168.2.16	1.1.1.1
Apr 19, 2024 16:30:36.622615099 CEST	54313	53	192.168.2.16	1.1.1.1
Apr 19, 2024 16:30:36.728398085 CEST	53	52700	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:36.742471933 CEST	53	51215	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:36.744199991 CEST	53	54313	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:36.783061028 CEST	53	62481	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:37.382291079 CEST	53	59062	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:41.402441978 CEST	59493	53	192.168.2.16	1.1.1.1
Apr 19, 2024 16:30:41.402539968 CEST	62235	53	192.168.2.16	1.1.1.1
Apr 19, 2024 16:30:41.506859064 CEST	53	62235	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:41.507059097 CEST	53	59493	1.1.1.1	192.168.2.16
Apr 19, 2024 16:30:54.371704102 CEST	53	62457	1.1.1.1	192.168.2.16
Apr 19, 2024 16:31:13.098824024 CEST	53	53874	1.1.1.1	192.168.2.16
Apr 19, 2024 16:31:35.594511032 CEST	53	54900	1.1.1.1	192.168.2.16
Apr 19, 2024 16:31:36.709883928 CEST	53	65377	1.1.1.1	192.168.2.16
Apr 19, 2024 16:31:48.134888887 CEST	138	138	192.168.2.16	192.168.2.255
Apr 19, 2024 16:32:04.787498951 CEST	53	59877	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 16:30:36.622204065 CEST	192.168.2.16	1.1.1.1	0x45b9	Standard query (0)	us.aicpa.org	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:36.622615099 CEST	192.168.2.16	1.1.1.1	0xac38	Standard query (0)	us.aicpa.org	65	IN (0x0001)	false
Apr 19, 2024 16:30:41.402441978 CEST	192.168.2.16	1.1.1.1	0xcb5a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.402539968 CEST	192.168.2.16	1.1.1.1	0xe659	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 16:30:36.742471933 CEST	1.1.1.1	192.168.2.16	0x45b9	No error (0)	us.aicpa.org	aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 16:30:36.742471933 CEST	1.1.1.1	192.168.2.16	0x45b9	No error (0)	aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com		23.21.70.52	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:36.742471933 CEST	1.1.1.1	192.168.2.16	0x45b9	No error (0)	aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com		34.228.88.187	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:36.744199991 CEST	1.1.1.1	192.168.2.16	0xac38	No error (0)	us.aicpa.org	aicpa-prod65-b70-832114268.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 16:30:41.506859064 CEST	1.1.1.1	192.168.2.16	0xe659	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 16:30:41.507059097 CEST	1.1.1.1	192.168.2.16	0xcb5a	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

us.aicpa.org

https:

fs.microsoft.com

slscr.update.microsoft.com

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49696	23.21.70.52	443	6152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:37 UTC	764	OUT	GET /content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf HTTP/1.1 Host: us.aicpa.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 14:30:37 UTC	8521	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 14:30:37 GMT Content-Type: application/pdf Content-Length: 204117 Connection: close Server: Apache Content-Security-Policy: base-uri 'self';default-src 'none'; connect-src 'self' inline-only: ; font-src 'self' data: ; img-src 'self' ;script-src 'self' 'unsafe-hashes' 'sha256-H2tlmRuSoiM440uTQK7H3mt3L74Xvy3HDbFQqhasmLM=' 'sha256-F31Z235J4JoHiQd4pwhlVGhZAo9TL1xXkr998POEVGk=' 'sha256-dg9STQouzRiKJUO3yike1CtjTb8JY3xoFiB0syjsclM=' 'sha256-npzn7ujSOdyjMmFgVUD96cEc+e4ADPr6/G36kMw42xg=' 'sha256-5TFWe/7xA1mUO7yvl+1rrgKnK4IkLgDeImwowoNtSio=' 'sha256-0ris5gmMUJMPIW5+I0NnEuFoC0HsIyvgUblcUKRj8DU=' 'sha256-2YCB6Lhue7C9r6969mhdpe1UfjRUR3HR4A0E0by9Kgg=' 'sha256-dPdAVNwRUBOO9U/2jj9+7Wrv56B40z2Jv1G60xrq99k=' 'sha256-1v5J2KvQP4Gbm3K2rHEJwOXTbrRded9lfuiMfmyrgLQ=' 'sha256-zjjpOAlgWBBa3LGAToXGdQdBJ74Nk1FbPuXvyyNud+c=' 'sha256-6Vxqk2EtHXjiJTfzUejPw5pYIuKocUwpWnj5ceUldH4=' 'sha256-jWeJInrhgp2bhmYq4ENjpiKhX8vgbI25wEHe7xZmntk=' 'sha256-MkZksky8RCDrddFfcsZvpoIOBWi+U4WdS/AUDSRoFWc=' 'sha256-JgUlUrFxfMASKHj7b/5oFO6lurjlitmjXKYNNDMUD+Y=' 'sha256-jwKtf7qtuAMIgLD43eyvgH971eEPHz3iVd6yMxfeA9A=' 'sha256-D/PRixJhLrpI1HflSDVH9owyKK3PGUoiNKrmyLvd3tM=' 'sha256-HSqFHC4bxSGLtwIKYvWNU/qQ4Q0oBveduu1wZdFXO+M=' 'sha256-nFFbE/gfqIA03gqrxwtcaywPXAg1nnX0YRI/RaMK8Lo=' 'sha256-k0FSIbTuVFHaoQGas062MT8MxUolKkiZqbpYaF929+c=' 'sha256-rqmm25uujCmwRm3UkPUpq2WM1jbmHLDuEQGkdF9+470=' 'sha256-U7ve//F4t99wIgL0aTmqx7pcSv+0E36f4XP+HwqZU30=' 'sha256-zZ15axXrbdoSqrE42O5dT3pilUPZCKObwx+aitQeT78=' 'sha256-C76Klxj0BnbMe8uaGS7kU+98MDherr94oIyjKlkWxTk=' 'sha256-244y469+HkRw3VOen69J4OuOZPA1f+0QrXS6/KOHJg0=' 'sha256-DNpb+AMfC5A+CyVJTBZTmmAK5kjYiOPpCYonuCoNUDc=' 'sha256-4xvwiEnvCWO3LygP+6rATbySh1+ealhANaQTvdaQaxk=' 'sha256-ClkLV8HfXoqqJ9Kl5sJglafxsF9F9ogSxHZxhR07bq4=' 'sha256-4TpZ3Tx5SLybDXPQaSHGuP1RU4D+pzck+02JLVY61BY=' 'sha256-osjxnKEPL/pQJbFk1dKsF7PYFmTyMWGmVSiL9inhxJY=' 'unsafe-inline' 'unsafe-eval' https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000054.js https://cdn.mouseflow.com/projects/79d6f783-d04b-41b1-8cd4-ff5b0aef991b.js https://connect.facebook.net/en_US/fbevents.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://siteintercept.qualtrics.com/dxjsmodule/11.94e7d7f0c6a48ca94c06.chunk.js https://snap.licdn.com/li.lms-analytics/insight.beta.min.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP4c3fcccffd524251ae198bf677f3b6e9/AppMeasurement.min.js https://assets.adobedtm.com/launch-ENbe9d56e701d340938e112682ad21519f.min.js https://d2qrdklrsxowl2.cloudfront.net/api/configuration.js https://d2qrdklrsxowl2.cloudfront.net/api/viewer/setup/ https://d2qrdklrsxowl2.cloudfront.net/js/generated/bootstrap.built.js https://d2qrdklrsxowl2.cloudfront.net/js/generated/brightcove.v2.built.js https://d2qrdklrsxowl2.cloudfront.net/js/hapyak.js https://d2qrdklrsxowl2.cloudfront.net/js/partners/brightcovePlugin/brightcovePlugin.js https://players.brightcove.net/1485859309/experience_59ca4a72f0534d000fe052ff/live.js https://players.brightcove.net/1485859309/rJBq047Xx_default/index.min.js https://vjs.zencdn.net/vttjs/0.12.5/vtt.global.min.js https://vjs.zencdn.net/vttjs/0.15.3/vtt.global.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.youtube.com/iframe_api https://a.quora.com/qevents.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/a620dac02c5d/launch-01674e2d033f.min.js https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000332.js https://cdn.mouseflow.com/projects/f51c3538-9092-4e2e-aae3-eff0161c955a.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.clarity.ms/tag/uet/135000332 https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://adservice.google.com.ph/adsid/integrator.js https://adservice.google.com/adsid/integrator.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement_Module_ActivityMap.min.js https://assets.adobedtm.com/launch-EN2c0e28c6709c4e27a936ae1de1381bd2.min.js https://cdn.mouseflow.com/projects/4ac367e9-d555-45b8-8c1c-21159c893c86.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2019.js https://tpc.googlesyndication.com/sodar/UFYwWwmt.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/activeview/js/current/rx_lidar.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/8b34a42b9048/94b1f86a0642/EX982a457aa31f49e98223c06cfedf70f2-libraryCode_source.min.js https://assets.adobedtm.com/launch-EN4ac663097b4c4c6483086c5b1a46bf23.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032104.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ ; script-src-elem 'unsafe-inline' ; style-src-elem 'unsafe-inline' ;frame-src 'unsafe-inline' ;worker-src 'unsafe-inline' blob: ;media-src 'unsafe-inline' blob: *; Strict-Transport-Security: max-age=15768000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Last-Modified: Fri, 19 Apr 2024 00:01:35 GMT ETag: "31d55-61667ca8090e5" Accept-Ranges: bytes X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
2024-04-19 14:30:37 UTC	7863	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 2d 55 53 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 34 36 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 32 36 32 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 32 36 33 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 36 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 32 32 20 30 20 52 20 32 38 20 30 20 52 20 33 34 20 30 20 52 20 33 37 20 30 20 52 20 34 33 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>endobj2 0 obj<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>endo
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 39 a1 76 ed da c5 45 07 00 57 95 95 95 ae 93 96 69 9c 68 fb f7 ef 77 bd f4 7c 00 02 a0 94 8d 1c 39 d2 75 c6 06 a1 ee 00 43 38 74 e8 90 eb 13 a0 aa aa 4a 1d 11 00 04 26 4c 98 e0 3a 5d 83 50 77 80 40 8e 1e 3d ea fa 34 e0 d0 07 00 a5 66 da b4 69 ae 73 35 08 75 07 28 c0 f1 e3 c7 5d 9f 0c b5 b5 b5 ea 88 00 10 1d d7 89 1a 84 ba 00 14 8c 8d 18 00 4c b8 ce d2 20 d4 05 20 24 ef 8d 98 63 10 01 a4 9e eb 14 0d 42 5d 00 8a 72 e4 c8 11 d7 a7 47 65 65 a5 3a 22 00 78 71 9d 9f 41 7c f8 e1 87 ea 0e 50 ac cf 3e fb cc f5 49 52 56 56 a6 8e 08 00 f6 5c 27 67 10 ea 02 60 66 cf 9e 3d 3c 55 00 20 38 d7 99 c9 5c 2d 41 3b 77 ee e4 09 03 00 41 b8 4e 4b 26 6a c9 da ba 75 2b 4f 1b 00 c8 cf 75 4e 32 4b 4b dc 96 2d 5b 78 f2 00 c0 60 5c 27 24 53 14 2f b0 11 03 c0 20 5c 67 63 10 dc ab bf Data Ascii: 9vEWihw\|9uC8tJ&L:]Pw@=4fis5u(]L $cB]rGee:"xqA\|P>IRVV\'g`f=<U 8\-A;wANK&ju+OuN2KK-[x`\'$S/ \gc
2024-04-19 14:30:37 UTC	19	IN	Data Raw: 38 9f 4e ad 0f 0c 41 58 b0 dc 5f c4 c4 bb 23 cf a5 d6 07 Data Ascii: 8NAX_#
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 86 20 2c b8 7f 6a 7d ce 10 bf 88 5f 4a ad 0f 0c 41 58 70 8f d4 fa 9c c1 7d c1 52 20 26 2a c0 52 32 2f 55 51 d6 69 a5 56 53 58 34 bc 04 c0 82 98 a8 4f 68 e7 7b 62 20 ee ea da 71 bb a0 b6 41 0c 2e 00 30 21 26 ea e3 ba d9 ee 8c e7 00 74 ca 94 02 31 51 aa 2d ab 9b c4 74 c0 09 b0 60 21 10 13 a5 d8 2f b8 55 5c 07 a0 65 b5 14 88 89 52 eb 17 bc ae 23 f0 aa 5a 81 4d e0 bb 60 21 2c 40 4c d4 81 3a 69 ae ee 0a bc b2 4e 60 33 e8 17 2c 04 6a 95 df 43 35 92 5c 59 13 78 45 8d c0 36 be 04 0b 96 c1 04 62 a2 14 fa 05 af aa 0d bc 94 7f 60 3b 07 db 0b c3 d3 91 5c 58 8a b0 e0 91 be 09 b6 35 04 5e 5c 43 bd 0d a2 30 3c 23 ce 85 a5 c3 5a 70 2b 63 60 1d f9 16 88 c2 d0 ac 95 0b 94 05 bd 16 77 ab bf 04 c3 82 a0 9d 89 c4 4c 1d e6 1e fa 5e 5b dc 57 f4 4a 30 40 14 86 7e c1 5c 58 92 98 Data Ascii: ,j}_JAXp}R &*R2/UQiVSX4Oh{b qA.0!&t1Q-t`!/U\eR#ZM`!,@L:iN`3,jC5\YxE6b`;\X5^\C0<#Zp+c`wL^[WJ0@~\X
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPE
2024-04-19 14:30:37 UTC	5605	IN	Data Raw: 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPE
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 88 cb 8f 94 39 9a 32 17 3e b8 04 d0 06 8e ad a9 5d da cb 6b 6d 65 60 d7 33 dc 31 01 98 95 8a 30 06 72 ee 01 c7 a0 e2 b1 3f e1 32 7f b3 a4 42 c5 7f b4 9b 51 fe ce 58 3c ef dd 99 36 96 2d bf 6f dd da 09 e9 9f 6a bd e2 9d 52 f7 4d b1 8d 74 eb 3b 89 ae 6e 1c 44 26 8e dd e6 58 17 bb b0 50 49 03 b0 ee 6b 9d 93 4c 8e 0b 1d 0e e7 4a b5 d4 27 1a 5e a5 f6 8b b3 3d b4 89 34 c1 d1 d5 e4 c3 28 2e 72 c0 f1 db f2 a0 0d 88 fc 55 79 24 f3 e9 cb a5 17 d5 a1 ba 5b 69 23 49 09 85 43 27 98 24 32 6d e1 36 fa 8c e7 8a d1 d1 75 99 b5 29 f5 0b 5b 9b 64 82 ee c6 61 14 ab 1c 9b d0 e5 43 02 a7 00 f4 3e 82 b9 91 75 aa 69 d3 78 87 5d b6 d2 ee de 5d 52 e6 18 ac a2 68 1c b2 aa 46 17 cd 74 50 59 57 39 38 c6 70 07 1c d6 9e 83 3d b6 93 a6 32 c1 6b ab 5e 5c 4b 3a b5 d4 cf 64 f1 bc 92 48 70 Data Ascii: 92>]kme`310r?2BQX<6-ojRMt;nD&XPIkLJ'^=4(.rUy$[i#IC'$2m6u)[daC>uix]]RhFtPYW98p=2k^\K:dHp
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 1d 01 ec bc 7c 82 99 9d 11 ef b3 9e 5e 94 f5 da 11 07 50 5f 0d 33 df 3d 14 56 13 6a 79 84 14 af 00 f2 a2 38 3b 67 17 b3 25 2e 74 e6 dc 3e 74 0b 29 ed 8b 6d e0 20 83 f6 ea ae b8 38 19 62 eb ce c7 1a a6 25 c5 b1 cb ba de 35 c1 1c 2f 25 24 19 f5 d1 b0 7e 0d 96 f1 13 18 2a 1b 13 38 50 64 b1 e4 b1 53 70 c1 b9 b5 08 aa 77 d4 ea f3 49 c0 01 ca e5 60 20 0a f9 85 01 ab 7c d6 2c bf ee 97 1e a2 23 0c 17 72 f6 70 5b d2 27 78 e0 ce 18 7d f9 0e 75 01 1a 33 18 83 c1 ec 2b 30 c2 4c b0 ae fb 4e 22 76 74 53 ec a8 14 80 ca 05 da c0 2a 5d 5a 7a f7 eb be b8 5e fb b1 5e 31 6b 7a a3 ef 59 52 fc 59 df 2d b7 5b 0c bc 92 ec 65 9d e8 05 73 87 95 ce 10 84 1d 0f 94 f2 b4 c0 00 4c 68 3d ac 83 c1 25 72 be c6 4c 0d 87 c7 74 6c c6 83 01 11 ac 6e 68 21 8e 83 98 81 bc 4b 25 30 5d 31 26 8c Data Ascii: \|^P_3=Vjy8;g%.t>t)m 8b%5/%$~8PdSpwI` \|,#rp['x}u3+0LN"vtS]Zz^^1kzYRY-[esLh=%rLtlnh!K%0]1&
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: d4 11 4f 4c c8 cd cd 65 e6 17 9d 3c 79 12 22 5d b9 72 85 7a 96 e1 c3 87 6f db b6 8d 41 5d 52 c0 39 b1 b4 b4 24 76 1f 16 4d 6d 7a 44 be e4 1e 06 e8 04 ea 53 85 76 76 76 f6 f6 f6 d2 9d d5 e7 ce 9d a3 75 a1 07 59 c1 ec dd bb 37 f5 2c 8d 4d fe 09 34 ed a8 51 a3 d4 9e 2a e5 89 09 a0 1f e3 a5 67 e8 67 5a a1 1c 86 73 4c 4c 0c b3 ba 08 1e 3e 7c f8 f6 db 6f 63 b8 a1 35 22 22 22 54 27 86 17 f1 fe fb ef 53 a7 0d 01 59 b2 9c 3e 7d ba f4 09 46 0a 9e 28 4e 88 cd 9b 37 6f c0 80 01 20 9b dc f3 80 80 00 a4 6f 4e b7 2b 05 82 9a e8 e8 e8 d0 d0 50 2a f6 8e 0f 26 40 05 a1 6b 18 9f 7f 81 f3 a6 af af 4f 45 78 02 34 dd 98 31 63 98 d5 45 80 e1 69 65 65 45 ae 0a 69 ee 24 1d c1 cd 9b 37 a1 e4 61 44 e0 24 20 31 ba 8c 62 15 d0 1e 48 bf 78 f1 62 e9 13 04 1d ad 5a b5 aa aa aa 92 4b d9 Data Ascii: OLe<y"]rzoA]R9$vMmzDSvvvuY7,M4QggZsLL>\|oc5"""T'SY>}F(N7o oN+P&@kOEx41cEieeEi$7aD$ 1bHxbZK
2024-04-19 14:30:37 UTC	16384	IN	Data Raw: 54 3a 27 0b 24 36 32 3a 95 d9 0d 20 f1 66 6b 2a 8d 33 81 d0 e9 7f c1 fa ea 6b f0 9c d3 b9 cb 09 21 64 1d d4 8a fd c6 77 f6 ad d2 72 42 ad c8 ec 5f 15 aa 08 55 89 d6 65 8a 9a 53 a9 67 72 c2 78 98 dc 6c 11 39 35 96 27 5c f8 c8 dd 86 69 cc 71 6a a3 95 51 33 3e 21 0d b1 81 b0 89 2f 29 96 bf 0a 91 99 c1 8a e3 cf d6 1b 75 83 53 6a b5 f7 44 ba 47 bc 75 62 ce 55 37 ef 5e df 7a 65 6b db e6 a6 92 d6 f8 a8 f4 38 5b 61 5a 71 91 5d dc 33 e9 ba 69 f7 ae 6d be a6 b5 f5 9a 49 85 5a 5e 7e 5a 61 7e 7a 61 a1 43 3d ef 8b 85 ea 9d 47 6e 78 e0 d1 79 f7 ad 58 31 38 af e2 a2 e1 cd cd e5 e3 a2 4b a7 ed 7b 74 5a c9 c9 f3 e7 df b7 6c f0 e1 f9 77 9f b7 e2 81 b9 65 e3 9b 7e 32 34 a9 a4 bc d9 f7 48 8b fc 2f 6a a9 25 f0 8e fa 25 62 a9 08 a7 81 66 76 8f 1e 47 19 d4 72 a4 85 5b 5a 98 21 Data Ascii: T:'$62: fk*3k!dwrB_UeSgrxl95'\iqjQ3>!/)uSjDGubU7^zek8[aZq]3imIZ^~Za~zaC=GnxyX18K{tZlwe~24H/j%%bfvGr[Z!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49699	23.21.70.52	443	6152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:37 UTC	689	OUT	GET /favicon.ico HTTP/1.1 Host: us.aicpa.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 14:30:38 UTC	8476	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 14:30:38 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Server: Apache Content-Security-Policy: base-uri 'self';default-src 'none'; connect-src 'self' inline-only: ; font-src 'self' data: ; img-src 'self' ;script-src 'self' 'unsafe-hashes' 'sha256-H2tlmRuSoiM440uTQK7H3mt3L74Xvy3HDbFQqhasmLM=' 'sha256-F31Z235J4JoHiQd4pwhlVGhZAo9TL1xXkr998POEVGk=' 'sha256-dg9STQouzRiKJUO3yike1CtjTb8JY3xoFiB0syjsclM=' 'sha256-npzn7ujSOdyjMmFgVUD96cEc+e4ADPr6/G36kMw42xg=' 'sha256-5TFWe/7xA1mUO7yvl+1rrgKnK4IkLgDeImwowoNtSio=' 'sha256-0ris5gmMUJMPIW5+I0NnEuFoC0HsIyvgUblcUKRj8DU=' 'sha256-2YCB6Lhue7C9r6969mhdpe1UfjRUR3HR4A0E0by9Kgg=' 'sha256-dPdAVNwRUBOO9U/2jj9+7Wrv56B40z2Jv1G60xrq99k=' 'sha256-1v5J2KvQP4Gbm3K2rHEJwOXTbrRded9lfuiMfmyrgLQ=' 'sha256-zjjpOAlgWBBa3LGAToXGdQdBJ74Nk1FbPuXvyyNud+c=' 'sha256-6Vxqk2EtHXjiJTfzUejPw5pYIuKocUwpWnj5ceUldH4=' 'sha256-jWeJInrhgp2bhmYq4ENjpiKhX8vgbI25wEHe7xZmntk=' 'sha256-MkZksky8RCDrddFfcsZvpoIOBWi+U4WdS/AUDSRoFWc=' 'sha256-JgUlUrFxfMASKHj7b/5oFO6lurjlitmjXKYNNDMUD+Y=' 'sha256-jwKtf7qtuAMIgLD43eyvgH971eEPHz3iVd6yMxfeA9A=' 'sha256-D/PRixJhLrpI1HflSDVH9owyKK3PGUoiNKrmyLvd3tM=' 'sha256-HSqFHC4bxSGLtwIKYvWNU/qQ4Q0oBveduu1wZdFXO+M=' 'sha256-nFFbE/gfqIA03gqrxwtcaywPXAg1nnX0YRI/RaMK8Lo=' 'sha256-k0FSIbTuVFHaoQGas062MT8MxUolKkiZqbpYaF929+c=' 'sha256-rqmm25uujCmwRm3UkPUpq2WM1jbmHLDuEQGkdF9+470=' 'sha256-U7ve//F4t99wIgL0aTmqx7pcSv+0E36f4XP+HwqZU30=' 'sha256-zZ15axXrbdoSqrE42O5dT3pilUPZCKObwx+aitQeT78=' 'sha256-C76Klxj0BnbMe8uaGS7kU+98MDherr94oIyjKlkWxTk=' 'sha256-244y469+HkRw3VOen69J4OuOZPA1f+0QrXS6/KOHJg0=' 'sha256-DNpb+AMfC5A+CyVJTBZTmmAK5kjYiOPpCYonuCoNUDc=' 'sha256-4xvwiEnvCWO3LygP+6rATbySh1+ealhANaQTvdaQaxk=' 'sha256-ClkLV8HfXoqqJ9Kl5sJglafxsF9F9ogSxHZxhR07bq4=' 'sha256-4TpZ3Tx5SLybDXPQaSHGuP1RU4D+pzck+02JLVY61BY=' 'sha256-osjxnKEPL/pQJbFk1dKsF7PYFmTyMWGmVSiL9inhxJY=' 'unsafe-inline' 'unsafe-eval' https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000054.js https://cdn.mouseflow.com/projects/79d6f783-d04b-41b1-8cd4-ff5b0aef991b.js https://connect.facebook.net/en_US/fbevents.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://siteintercept.qualtrics.com/dxjsmodule/11.94e7d7f0c6a48ca94c06.chunk.js https://snap.licdn.com/li.lms-analytics/insight.beta.min.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP4c3fcccffd524251ae198bf677f3b6e9/AppMeasurement.min.js https://assets.adobedtm.com/launch-ENbe9d56e701d340938e112682ad21519f.min.js https://d2qrdklrsxowl2.cloudfront.net/api/configuration.js https://d2qrdklrsxowl2.cloudfront.net/api/viewer/setup/ https://d2qrdklrsxowl2.cloudfront.net/js/generated/bootstrap.built.js https://d2qrdklrsxowl2.cloudfront.net/js/generated/brightcove.v2.built.js https://d2qrdklrsxowl2.cloudfront.net/js/hapyak.js https://d2qrdklrsxowl2.cloudfront.net/js/partners/brightcovePlugin/brightcovePlugin.js https://players.brightcove.net/1485859309/experience_59ca4a72f0534d000fe052ff/live.js https://players.brightcove.net/1485859309/rJBq047Xx_default/index.min.js https://vjs.zencdn.net/vttjs/0.12.5/vtt.global.min.js https://vjs.zencdn.net/vttjs/0.15.3/vtt.global.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.youtube.com/iframe_api https://a.quora.com/qevents.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/a620dac02c5d/launch-01674e2d033f.min.js https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000332.js https://cdn.mouseflow.com/projects/f51c3538-9092-4e2e-aae3-eff0161c955a.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.clarity.ms/tag/uet/135000332 https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://adservice.google.com.ph/adsid/integrator.js https://adservice.google.com/adsid/integrator.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement_Module_ActivityMap.min.js https://assets.adobedtm.com/launch-EN2c0e28c6709c4e27a936ae1de1381bd2.min.js https://cdn.mouseflow.com/projects/4ac367e9-d555-45b8-8c1c-21159c893c86.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2019.js https://tpc.googlesyndication.com/sodar/UFYwWwmt.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/activeview/js/current/rx_lidar.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/8b34a42b9048/94b1f86a0642/EX982a457aa31f49e98223c06cfedf70f2-libraryCode_source.min.js https://assets.adobedtm.com/launch-EN4ac663097b4c4c6483086c5b1a46bf23.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032104.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ ; script-src-elem 'unsafe-inline' ; style-src-elem 'unsafe-inline' ;frame-src 'unsafe-inline' ;worker-src 'unsafe-inline' blob: ;media-src 'unsafe-inline' blob: *; Strict-Transport-Security: max-age=15768000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
2024-04-19 14:30:38 UTC	7908	IN	Data Raw: 34 35 39 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 61 72 74 69 63 6c 65 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 61 72 74 69 63 6c 65 23 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 61 69 63 70 61 6e 61 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d Data Ascii: 4595<!doctype html><html prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#" lang="en"> <head> <title>Page not found</title> <link rel="shortcut icon" href="/content/dam/aicpanas/favicon.ico"/><link rel="apple-touch-icon-
2024-04-19 14:30:38 UTC	9913	IN	Data Raw: 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 74 61 2d 64 65 73 6b 74 6f 70 20 63 74 61 42 75 74 74 6f 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 2d 61 6c 69 67 6e 2d 6c 65 66 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 6d 65 6d 62 65 72 73 68 69 70 2e 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 2d 6d 61 69 6e 2d 70 75 72 70 6c 65 20 62 74 6e 2d 2d 61 72 72 6f 77 20 62 74 6e 2d 2d 63 74 61 20 74 65 78 74 5f 5f 63 6f 6c 6f 72 73 2d 2d 64 65 66 61 75 6c 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 42 65 63 6f 6d 65 20 61 20 4d 65 6d 62 65 72 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c Data Ascii: p"> <div class="cta-desktop ctaButton"><div class="button-align-left"> <a href="/membership.html" class="btn btn--main-purple btn--arrow btn--cta text__colors--default"> Become a Member</a> </div> <
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: 37 61 36 62 0d 0a 63 6b 2d 62 72 65 61 64 63 72 75 6d 62 3d 27 54 6f 70 69 63 73 3a 54 6f 70 69 63 73 20 6f 66 20 49 6e 74 65 72 65 73 74 3a 50 65 72 73 6f 6e 61 6c 20 46 69 6e 61 6e 63 69 61 6c 20 50 6c 61 6e 6e 69 6e 67 27 20 6e 61 76 2d 74 72 61 63 6b 3d 22 74 72 75 65 22 3e 0d 0a 09 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 50 65 72 73 6f 6e 61 6c 20 46 69 6e 61 6e 63 69 61 6c 20 50 6c 61 6e 6e 69 6e 67 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 61 72 72 6f 77 2d 72 69 67 68 74 2d 6c 6f 6e 67 22 3e 3c 2f 73 70 61 6e 3e 0d 0a 09 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 3c 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d Data Ascii: 7a6bck-breadcrumb='Topics:Topics of Interest:Personal Financial Planning' nav-track="true"> Personal Financial Planning<span class="icon-arrow-right-long"></span> </a> </li> <li> <a href=
2024-04-19 14:30:38 UTC	14963	IN	Data Raw: 75 69 6e 67 20 45 64 75 63 61 74 69 6f 6e 3a 43 50 45 20 53 65 6c 66 2d 53 74 75 64 79 3a 41 49 43 50 41 20 43 50 45 78 70 72 65 73 73 20 55 6e 6c 69 6d 69 74 65 64 20 6f 6e 6c 69 6e 65 20 61 63 63 65 73 73 20 74 6f 20 36 30 30 2b 20 43 50 45 20 63 72 65 64 69 74 20 68 6f 75 72 73 22 20 6e 61 76 2d 74 72 61 63 6b 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 63 70 65 5f 5f 74 69 74 6c 65 22 3e 41 49 43 50 41 20 43 50 45 78 70 72 65 73 73 3a 20 55 6e 6c 69 6d 69 74 65 64 20 6f 6e 6c 69 6e 65 20 61 63 63 65 73 73 20 74 6f 20 36 30 30 2b 20 43 50 45 20 63 72 65 64 69 74 20 68 6f 75 72 73 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 Data Ascii: uing Education:CPE Self-Study:AICPA CPExpress Unlimited online access to 600+ CPE credit hours" nav-track="true"> <h3 class="cpe__title">AICPA CPExpress: Unlimited online access to 600+ CPE credit hours</h3> </a>
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: 36 30 30 30 0d 0a 65 72 73 68 69 70 2f 6a 6f 69 6e 2f 63 72 65 64 65 6e 74 69 61 6c 73 2e 68 74 6d 6c 3f 74 61 62 2d 31 3d 34 22 20 6e 61 76 2d 74 72 61 63 6b 2d 62 72 65 61 64 63 72 75 6d 62 3d 27 43 65 72 74 69 66 69 63 61 74 69 6f 6e 73 3a 43 72 65 64 65 6e 74 69 61 6c 73 20 26 20 44 65 73 69 67 6e 61 74 69 6f 6e 73 3a 43 65 72 74 69 66 69 65 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 54 65 63 68 6e 6f 6c 6f 67 79 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 28 43 49 54 50 29 27 20 6e 61 76 2d 74 72 61 63 6b 3d 22 74 72 75 65 22 3e 0d 0a 09 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 65 64 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 54 65 63 68 6e 6f 6c 6f 67 79 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 28 43 49 54 50 29 3c 73 70 61 Data Ascii: 6000ership/join/credentials.html?tab-1=4" nav-track-breadcrumb='Certifications:Credentials & Designations:Certified Information Technology Professional (CITP)' nav-track="true"> Certified Information Technology Professional (CITP)<spa
2024-04-19 14:30:38 UTC	8200	IN	Data Raw: 74 73 27 20 6e 61 76 2d 74 72 61 63 6b 3d 22 74 72 75 65 22 3e 0d 0a 09 09 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 4d 65 6d 62 65 72 73 68 69 70 20 42 65 6e 65 66 69 74 73 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 61 72 72 6f 77 2d 72 69 67 68 74 2d 6c 6f 6e 67 22 3e 3c 2f 73 70 61 6e 3e 0d 0a 09 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 09 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 3c 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 6d 65 6d 62 65 72 73 68 69 70 2f 72 65 6e 65 77 72 65 69 6e 73 74 61 74 65 2e 68 74 6d 6c 22 20 6e 61 76 2d 74 72 61 63 6b 2d 62 72 65 61 64 63 72 75 6d 62 3d 27 4d 65 6d 62 65 72 73 68 69 70 3a 41 49 43 50 41 20 4d 65 6d 62 65 72 73 Data Ascii: ts' nav-track="true"> Membership Benefits<span class="icon-arrow-right-long"></span> </a> </li> <li> <a href="/membership/renewreinstate.html" nav-track-breadcrumb='Membership:AICPA Members
2024-04-19 14:30:38 UTC	8184	IN	Data Raw: 32 36 31 63 0d 0a 50 41 45 78 61 6d 22 3e 43 50 41 20 45 78 61 6d 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 69 63 70 61 2e 6f 72 67 2f 49 6e 74 65 72 65 73 74 41 72 65 61 73 2f 46 52 43 22 3e 46 69 6e 61 6e 63 69 61 6c 26 6e 62 73 70 3b 52 65 70 6f 72 74 69 6e 67 20 43 65 6e 74 65 72 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 69 63 70 61 2e 6f 72 67 2f 49 6e 74 65 72 65 73 74 41 72 65 61 73 2f 54 61 78 22 3e 54 61 78 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 69 63 70 61 2e 6f 72 67 2f 22 3e 41 49 43 50 41 2e 6f 72 67 20 48 6f 6d 65 20 50 61 67 65 3c 2f 61 3e 3c 2f 6c 69 Data Ascii: 261cPAExam">CPA Exam</a></li><li><a href="http://www.aicpa.org/InterestAreas/FRC">Financial Reporting Center</a></li><li><a href="http://www.aicpa.org/InterestAreas/Tax">Tax</a></li><li><a href="http://www.aicpa.org/">AICPA.org Home Page</a></li
2024-04-19 14:30:38 UTC	1580	IN	Data Raw: 63 6f 6e 74 65 6e 74 2f 64 61 6d 2f 61 69 63 70 61 2f 6e 65 77 68 6f 6d 65 70 61 67 65 2f 73 6f 63 69 61 6c 69 63 6f 6e 73 2f 41 73 73 65 74 34 2e 73 76 67 22 20 61 6c 74 3d 22 4c 69 6e 6b 65 64 49 6e 20 6c 6f 67 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 6e 65 77 73 2f 73 6f 63 69 61 6c 6d 65 64 69 61 2e 68 74 6d 6c 23 74 77 69 74 74 65 72 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 20 6e 6f 66 6f 6c 6c 6f 77 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 Data Ascii: content/dam/aicpa/newhomepage/socialicons/Asset4.svg" alt="LinkedIn logo"> </a> </li> <li> <a href="/news/socialmedia.html#twitter" rel="noopener noreferrer nofollow" target="_blank"
2024-04-19 14:30:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49701	23.21.70.52	443	6152	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:37 UTC	436	OUT	GET /content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf HTTP/1.1 Host: us.aicpa.org Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 14:30:38 UTC	8521	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 14:30:38 GMT Content-Type: application/pdf Content-Length: 204117 Connection: close Server: Apache Content-Security-Policy: base-uri 'self';default-src 'none'; connect-src 'self' inline-only: ; font-src 'self' data: ; img-src 'self' ;script-src 'self' 'unsafe-hashes' 'sha256-H2tlmRuSoiM440uTQK7H3mt3L74Xvy3HDbFQqhasmLM=' 'sha256-F31Z235J4JoHiQd4pwhlVGhZAo9TL1xXkr998POEVGk=' 'sha256-dg9STQouzRiKJUO3yike1CtjTb8JY3xoFiB0syjsclM=' 'sha256-npzn7ujSOdyjMmFgVUD96cEc+e4ADPr6/G36kMw42xg=' 'sha256-5TFWe/7xA1mUO7yvl+1rrgKnK4IkLgDeImwowoNtSio=' 'sha256-0ris5gmMUJMPIW5+I0NnEuFoC0HsIyvgUblcUKRj8DU=' 'sha256-2YCB6Lhue7C9r6969mhdpe1UfjRUR3HR4A0E0by9Kgg=' 'sha256-dPdAVNwRUBOO9U/2jj9+7Wrv56B40z2Jv1G60xrq99k=' 'sha256-1v5J2KvQP4Gbm3K2rHEJwOXTbrRded9lfuiMfmyrgLQ=' 'sha256-zjjpOAlgWBBa3LGAToXGdQdBJ74Nk1FbPuXvyyNud+c=' 'sha256-6Vxqk2EtHXjiJTfzUejPw5pYIuKocUwpWnj5ceUldH4=' 'sha256-jWeJInrhgp2bhmYq4ENjpiKhX8vgbI25wEHe7xZmntk=' 'sha256-MkZksky8RCDrddFfcsZvpoIOBWi+U4WdS/AUDSRoFWc=' 'sha256-JgUlUrFxfMASKHj7b/5oFO6lurjlitmjXKYNNDMUD+Y=' 'sha256-jwKtf7qtuAMIgLD43eyvgH971eEPHz3iVd6yMxfeA9A=' 'sha256-D/PRixJhLrpI1HflSDVH9owyKK3PGUoiNKrmyLvd3tM=' 'sha256-HSqFHC4bxSGLtwIKYvWNU/qQ4Q0oBveduu1wZdFXO+M=' 'sha256-nFFbE/gfqIA03gqrxwtcaywPXAg1nnX0YRI/RaMK8Lo=' 'sha256-k0FSIbTuVFHaoQGas062MT8MxUolKkiZqbpYaF929+c=' 'sha256-rqmm25uujCmwRm3UkPUpq2WM1jbmHLDuEQGkdF9+470=' 'sha256-U7ve//F4t99wIgL0aTmqx7pcSv+0E36f4XP+HwqZU30=' 'sha256-zZ15axXrbdoSqrE42O5dT3pilUPZCKObwx+aitQeT78=' 'sha256-C76Klxj0BnbMe8uaGS7kU+98MDherr94oIyjKlkWxTk=' 'sha256-244y469+HkRw3VOen69J4OuOZPA1f+0QrXS6/KOHJg0=' 'sha256-DNpb+AMfC5A+CyVJTBZTmmAK5kjYiOPpCYonuCoNUDc=' 'sha256-4xvwiEnvCWO3LygP+6rATbySh1+ealhANaQTvdaQaxk=' 'sha256-ClkLV8HfXoqqJ9Kl5sJglafxsF9F9ogSxHZxhR07bq4=' 'sha256-4TpZ3Tx5SLybDXPQaSHGuP1RU4D+pzck+02JLVY61BY=' 'sha256-osjxnKEPL/pQJbFk1dKsF7PYFmTyMWGmVSiL9inhxJY=' 'unsafe-inline' 'unsafe-eval' https://aicpa.ugc.bazaarvoice.com/static/8502-en_us/bvapi.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/04f604fda4ad/launch-4dd043aa3d36.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000054.js https://cdn.mouseflow.com/projects/79d6f783-d04b-41b1-8cd4-ff5b0aef991b.js https://connect.facebook.net/en_US/fbevents.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://siteintercept.qualtrics.com/dxjsmodule/11.94e7d7f0c6a48ca94c06.chunk.js https://snap.licdn.com/li.lms-analytics/insight.beta.min.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP4c3fcccffd524251ae198bf677f3b6e9/AppMeasurement.min.js https://assets.adobedtm.com/launch-ENbe9d56e701d340938e112682ad21519f.min.js https://d2qrdklrsxowl2.cloudfront.net/api/configuration.js https://d2qrdklrsxowl2.cloudfront.net/api/viewer/setup/ https://d2qrdklrsxowl2.cloudfront.net/js/generated/bootstrap.built.js https://d2qrdklrsxowl2.cloudfront.net/js/generated/brightcove.v2.built.js https://d2qrdklrsxowl2.cloudfront.net/js/hapyak.js https://d2qrdklrsxowl2.cloudfront.net/js/partners/brightcovePlugin/brightcovePlugin.js https://players.brightcove.net/1485859309/experience_59ca4a72f0534d000fe052ff/live.js https://players.brightcove.net/1485859309/rJBq047Xx_default/index.min.js https://vjs.zencdn.net/vttjs/0.12.5/vtt.global.min.js https://vjs.zencdn.net/vttjs/0.15.3/vtt.global.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.youtube.com/iframe_api https://a.quora.com/qevents.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/a620dac02c5d/launch-01674e2d033f.min.js https://assets.adobedtm.com/extensions/EP308220a2a4c4403f97fc1960100db40f/AppMeasurement.min.js https://bat.bing.com/bat.js https://bat.bing.com/p/action/135000332.js https://cdn.mouseflow.com/projects/f51c3538-9092-4e2e-aae3-eff0161c955a.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://static.ads-twitter.com/uwt.js https://us-content.vergic.com/C684836E-2833-4669-875F-C54261C28192/engage.js https://www.clarity.ms/tag/uet/135000332 https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtag/js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://adservice.google.com.ph/adsid/integrator.js https://adservice.google.com/adsid/integrator.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement_Module_ActivityMap.min.js https://assets.adobedtm.com/launch-EN2c0e28c6709c4e27a936ae1de1381bd2.min.js https://cdn.mouseflow.com/projects/4ac367e9-d555-45b8-8c1c-21159c893c86.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031501.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus_fy2019.js https://tpc.googlesyndication.com/sodar/UFYwWwmt.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/activeview/js/current/rx_lidar.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://assets.adobedtm.com/3e79a7f00488/8b34a42b9048/94b1f86a0642/EX982a457aa31f49e98223c06cfedf70f2-libraryCode_source.min.js https://assets.adobedtm.com/launch-EN4ac663097b4c4c6483086c5b1a46bf23.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032104.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://siteintercept.qualtrics.com/dxjsmodule/11.172e2d2f93de5974ae28.chunk.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js https://connect.facebook.net/en_US/fbevents.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031601.js https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022081101.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com/analytics.js https://www.google.com/pagead/conversion_async.js https://www.googletagmanager.com/gtm.js https://www.googletagservices.com/tag/js/gpt.js https://assets.adobedtm.com/extensions/EP7b1fa4581fb94dd0961a981af9997765/AppMeasurement.min.js; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ ; script-src-elem 'unsafe-inline' ; style-src-elem 'unsafe-inline' ;frame-src 'unsafe-inline' ;worker-src 'unsafe-inline' blob: ;media-src 'unsafe-inline' blob: *; Strict-Transport-Security: max-age=15768000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Last-Modified: Fri, 19 Apr 2024 00:01:35 GMT ETag: "31d55-61667ca8090e5" Accept-Ranges: bytes X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
2024-04-19 14:30:38 UTC	7863	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 2d 55 53 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 34 36 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 32 36 32 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 32 36 33 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 36 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 32 32 20 30 20 52 20 32 38 20 30 20 52 20 33 34 20 30 20 52 20 33 37 20 30 20 52 20 34 33 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 46 0 R/MarkInfo<</Marked true>>/Metadata 262 0 R/ViewerPreferences 263 0 R>>endobj2 0 obj<</Type/Pages/Count 6/Kids[ 3 0 R 22 0 R 28 0 R 34 0 R 37 0 R 43 0 R] >>endo
2024-04-19 14:30:38 UTC	10031	IN	Data Raw: 39 a1 76 ed da c5 45 07 00 57 95 95 95 ae 93 96 69 9c 68 fb f7 ef 77 bd f4 7c 00 02 a0 94 8d 1c 39 d2 75 c6 06 a1 ee 00 43 38 74 e8 90 eb 13 a0 aa aa 4a 1d 11 00 04 26 4c 98 e0 3a 5d 83 50 77 80 40 8e 1e 3d ea fa 34 e0 d0 07 00 a5 66 da b4 69 ae 73 35 08 75 07 28 c0 f1 e3 c7 5d 9f 0c b5 b5 b5 ea 88 00 10 1d d7 89 1a 84 ba 00 14 8c 8d 18 00 4c b8 ce d2 20 d4 05 20 24 ef 8d 98 63 10 01 a4 9e eb 14 0d 42 5d 00 8a 72 e4 c8 11 d7 a7 47 65 65 a5 3a 22 00 78 71 9d 9f 41 7c f8 e1 87 ea 0e 50 ac cf 3e fb cc f5 49 52 56 56 a6 8e 08 00 f6 5c 27 67 10 ea 02 60 66 cf 9e 3d 3c 55 00 20 38 d7 99 c9 5c 2d 41 3b 77 ee e4 09 03 00 41 b8 4e 4b 26 6a c9 da ba 75 2b 4f 1b 00 c8 cf 75 4e 32 4b 4b dc 96 2d 5b 78 f2 00 c0 60 5c 27 24 53 14 2f b0 11 03 c0 20 5c 67 63 10 dc ab bf Data Ascii: 9vEWihw\|9uC8tJ&L:]Pw@=4fis5u(]L $cB]rGee:"xqA\|P>IRVV\'g`f=<U 8\-A;wANK&ju+OuN2KK-[x`\'$S/ \gc
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: 6c bc 70 e1 82 76 9d dc bd 3a cd 6f c4 55 fa fc f3 cf e5 0a 58 ba 74 3a 6d 36 d7 ce 9d 3b 8b 7e a8 d9 4f 04 fc 22 7f 58 17 f1 ee bb ef 6a d7 a0 3c da 05 33 bf 4e 9a d2 d5 d5 25 97 3a c2 77 4d 2f 70 e7 a4 d8 ec 7b 2f b7 6e dd 5a e0 b3 0c 7e 10 e0 1d dd bd 72 e6 7d d8 b1 2e 2f f5 d5 d2 d9 ab d3 a2 af 46 99 9e 9e d6 ce 67 c3 a5 4b 97 e4 6a 58 96 73 e7 ce 99 0a f5 d4 53 4f 2d fd fb df 7d f7 9d a9 bf 0f f8 48 bd 05 bb 7f 15 ba 28 c5 07 8d 9d bd 5f eb d6 ad 5b 72 a9 67 67 67 b5 f3 d9 e0 ce 5d 5b f3 46 cf 55 57 ad 5a 95 fd 9b 9d 9d 9d 06 ff 2c e0 23 d5 c3 7a fe cc 99 33 da 05 30 29 95 4a 69 55 d2 cd 8b 09 77 ef de 15 4d ad 9d cf 1e f5 af ca 0b 32 27 b3 da c5 00 a2 43 f7 70 36 78 99 cb 1d 79 2f b8 d9 71 f2 e4 49 ed f4 79 74 77 77 8b a6 8e c0 85 94 d2 89 56 b2 74 Data Ascii: lpv:oUXt:m6;~O"Xj<3N%:wM/p{/nZ~r}./FgKjXsSO-}H(_[rggg][FUWZ,#z30)JiUwM2'Cp6xy/qIytwwVt
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
2024-04-19 14:30:38 UTC	11977	IN	Data Raw: 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPE
2024-04-19 14:30:38 UTC	8949	IN	Data Raw: 88 cb 8f 94 39 9a 32 17 3e b8 04 d0 06 8e ad a9 5d da cb 6b 6d 65 60 d7 33 dc 31 01 98 95 8a 30 06 72 ee 01 c7 a0 e2 b1 3f e1 32 7f b3 a4 42 c5 7f b4 9b 51 fe ce 58 3c ef dd 99 36 96 2d bf 6f dd da 09 e9 9f 6a bd e2 9d 52 f7 4d b1 8d 74 eb 3b 89 ae 6e 1c 44 26 8e dd e6 58 17 bb b0 50 49 03 b0 ee 6b 9d 93 4c 8e 0b 1d 0e e7 4a b5 d4 27 1a 5e a5 f6 8b b3 3d b4 89 34 c1 d1 d5 e4 c3 28 2e 72 c0 f1 db f2 a0 0d 88 fc 55 79 24 f3 e9 cb a5 17 d5 a1 ba 5b 69 23 49 09 85 43 27 98 24 32 6d e1 36 fa 8c e7 8a d1 d1 75 99 b5 29 f5 0b 5b 9b 64 82 ee c6 61 14 ab 1c 9b d0 e5 43 02 a7 00 f4 3e 82 b9 91 75 aa 69 d3 78 87 5d b6 d2 ee de 5d 52 e6 18 ac a2 68 1c b2 aa 46 17 cd 74 50 59 57 39 38 c6 70 07 1c d6 9e 83 3d b6 93 a6 32 c1 6b ab 5e 5c 4b 3a b5 d4 cf 64 f1 bc 92 48 70 Data Ascii: 92>]kme`310r?2BQX<6-ojRMt;nD&XPIkLJ'^=4(.rUy$[i#IC'$2m6u)[daC>uix]]RhFtPYW98p=2k^\K:dHp
2024-04-19 14:30:38 UTC	7435	IN	Data Raw: 65 43 0f a0 dc a7 6c 26 42 8b ae 79 e0 54 fe fd 52 31 86 c4 76 4c 45 d2 af 45 0a c0 71 19 99 98 ed eb 62 b7 04 61 ab 8b 2d ae 3e 63 9a d7 87 7d 55 1e e6 0b 08 9e 8b 6b 52 8f 5c 8b 47 6a c5 43 1f 93 16 01 65 49 8d 68 31 24 1f 70 87 44 3c 8b b5 9c 94 4d 5d 6d b7 48 42 2d 3f 99 25 1b 20 02 0a 07 17 f1 9e 79 70 8d bf 71 37 a0 65 e3 36 ff bc 04 c8 c4 f6 8c b7 72 40 58 6a 2e ea 1b d7 f7 68 6d 7c f9 3b 4b 4f c8 46 93 33 fe 8e cc 37 fa 9c f7 68 da d1 ac bf 45 eb ce b9 e7 68 02 d2 0f 19 c4 91 c2 98 e2 c5 f2 62 c1 50 0b dd cb 3e 25 ee 28 78 13 9e ea 4f 31 78 95 f3 4e 6b 04 5e 1a f0 76 16 4e 95 04 15 a7 21 a7 b8 73 3a ea 54 be 10 17 c2 65 64 df 81 84 f2 a4 67 3c f5 39 29 a3 10 b3 15 8a f1 ba 28 7d f1 30 8e c3 6c 12 17 84 85 e6 8a 67 da e5 20 0a cc ba 01 ae fd 5a 55 Data Ascii: eCl&ByTR1vLEEqba->c}UkR\GjCeIh1$pD<M]mHB-?% ypq7e6r@Xj.hm\|;KOF37hEhbP>%(xO1xNk^vN!s:Tedg<9)(}0lg ZU
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: 1d 01 ec bc 7c 82 99 9d 11 ef b3 9e 5e 94 f5 da 11 07 50 5f 0d 33 df 3d 14 56 13 6a 79 84 14 af 00 f2 a2 38 3b 67 17 b3 25 2e 74 e6 dc 3e 74 0b 29 ed 8b 6d e0 20 83 f6 ea ae b8 38 19 62 eb ce c7 1a a6 25 c5 b1 cb ba de 35 c1 1c 2f 25 24 19 f5 d1 b0 7e 0d 96 f1 13 18 2a 1b 13 38 50 64 b1 e4 b1 53 70 c1 b9 b5 08 aa 77 d4 ea f3 49 c0 01 ca e5 60 20 0a f9 85 01 ab 7c d6 2c bf ee 97 1e a2 23 0c 17 72 f6 70 5b d2 27 78 e0 ce 18 7d f9 0e 75 01 1a 33 18 83 c1 ec 2b 30 c2 4c b0 ae fb 4e 22 76 74 53 ec a8 14 80 ca 05 da c0 2a 5d 5a 7a f7 eb be b8 5e fb b1 5e 31 6b 7a a3 ef 59 52 fc 59 df 2d b7 5b 0c bc 92 ec 65 9d e8 05 73 87 95 ce 10 84 1d 0f 94 f2 b4 c0 00 4c 68 3d ac 83 c1 25 72 be c6 4c 0d 87 c7 74 6c c6 83 01 11 ac 6e 68 21 8e 83 98 81 bc 4b 25 30 5d 31 26 8c Data Ascii: \|^P_3=Vjy8;g%.t>t)m 8b%5/%$~8PdSpwI` \|,#rp['x}u3+0LN"vtS]Zz^^1kzYRY-[esLh=%rLtlnh!K%0]1&
2024-04-19 14:30:38 UTC	8949	IN	Data Raw: d4 11 4f 4c c8 cd cd 65 e6 17 9d 3c 79 12 22 5d b9 72 85 7a 96 e1 c3 87 6f db b6 8d 41 5d 52 c0 39 b1 b4 b4 24 76 1f 16 4d 6d 7a 44 be e4 1e 06 e8 04 ea 53 85 76 76 76 f6 f6 f6 d2 9d d5 e7 ce 9d a3 75 a1 07 59 c1 ec dd bb 37 f5 2c 8d 4d fe 09 34 ed a8 51 a3 d4 9e 2a e5 89 09 a0 1f e3 a5 67 e8 67 5a a1 1c 86 73 4c 4c 0c b3 ba 08 1e 3e 7c f8 f6 db 6f 63 b8 a1 35 22 22 22 54 27 86 17 f1 fe fb ef 53 a7 0d 01 59 b2 9c 3e 7d ba f4 09 46 0a 9e 28 4e 88 cd 9b 37 6f c0 80 01 20 9b dc f3 80 80 00 a4 6f 4e b7 2b 05 82 9a e8 e8 e8 d0 d0 50 2a f6 8e 0f 26 40 05 a1 6b 18 9f 7f 81 f3 a6 af af 4f 45 78 02 34 dd 98 31 63 98 d5 45 80 e1 69 65 65 45 ae 0a 69 ee 24 1d c1 cd 9b 37 a1 e4 61 44 e0 24 20 31 ba 8c 62 15 d0 1e 48 bf 78 f1 62 e9 13 04 1d ad 5a b5 aa aa aa 92 4b d9 Data Ascii: OLe<y"]rzoA]R9$vMmzDSvvvuY7,M4QggZsLL>\|oc5"""T'SY>}F(N7o oN+P&@kOEx41cEieeEi$7aD$ 1bHxbZK
2024-04-19 14:30:38 UTC	16384	IN	Data Raw: 28 21 c7 39 29 74 04 e5 42 b2 23 67 a1 34 ca a0 1c 9a 48 f3 c8 43 97 d0 4e ba 9f 15 f1 72 fe 86 b8 cc e0 b6 87 d8 63 ed 49 f6 71 f6 02 7b 43 5a 9c f3 67 5f 2a f2 2f 43 a0 5e 3a 65 51 2e d5 a0 46 e7 df d5 88 b1 27 da 53 4e d7 a0 40 20 f0 ee 59 a9 1b e9 47 a6 d7 47 d8 89 9d 27 bc bf ff f9 91 db 8f fc 80 e8 f7 bb 8f 5c f8 f6 5d ef 9d 43 f4 b7 7f ff e2 6b 21 e2 74 2e 14 38 44 fb e8 09 f3 3a 3a 44 c3 e6 f5 e6 0b d1 84 e1 ab 66 18 06 ac ff d9 8a 33 01 4a a1 a8 64 34 85 50 58 b8 99 22 2d 51 d1 31 b1 71 f1 09 89 49 c9 d6 94 d4 71 b0 48 d3 d2 9d 19 99 59 d9 39 ae dc bc fc 82 c2 a2 e2 92 d2 b2 f1 e5 15 13 2a 4f ff de 7e 43 63 d3 a4 c9 cd 53 5a a6 4e 9b de da 36 63 e6 ac d9 73 e6 ce 6b f7 cc ff d6 82 85 ff af 4f ec bf 00 a1 d3 41 df d0 be 07 f7 cb 9c fc a3 27 87 86 Data Ascii: (!9)tB#g4HCNrcIq{CZg_/C^:eQ.F'SN@ YGG'\]Ck!t.8D::Df3Jd4PX"-Q1qIqHY9O~CcSZN6cskOA'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:50 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 14:30:50 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=145951 Date: Fri, 19 Apr 2024 14:30:50 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49707	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 14:30:51 UTC	805	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=145971 Date: Fri, 19 Apr 2024 14:30:51 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 14:30:51 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49708	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:30:51 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EgpEa1nOLXMftyt&MD=23EAllaZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 14:30:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d780552e-29e2-42a9-ba79-091676a9d7ca MS-RequestId: 637dda85-35e7-4e14-90e6-b6f50a493f3a MS-CV: Y2410esKZUioHSRq.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 14:30:51 GMT Connection: close Content-Length: 24490
2024-04-19 14:30:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 14:30:52 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49710	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-19 14:31:11 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 14:31:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 14:30:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 9f8ff8ee-b511-478f-82f1-7effb01e602d PPServer: PPV: 30 H: SN1PEPF0002F9C5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 14:31:11 GMT Connection: close Content-Length: 11390
2024-04-19 14:31:12 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49711	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 14:31:12 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 14:31:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 14:30:12 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 2b11ba2f-af8b-4fe4-ac53-e7d021e6c87f PPServer: PPV: 30 H: SN1PEPF0002FA6D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 14:31:12 GMT Connection: close Content-Length: 11370
2024-04-19 14:31:12 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49712	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-19 14:31:13 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 14:31:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 14:30:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 7c5b1f16-8792-4443-80d5-8a77133b6852 PPServer: PPV: 30 H: SN1PEPF0002FA7D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 14:31:13 GMT Connection: close Content-Length: 11370
2024-04-19 14:31:13 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49713	40.126.29.15	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:14 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-19 14:31:14 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-19 14:31:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 19 Apr 2024 14:30:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 99edd40f-c992-498e-89ec-49e4e7ee239d PPServer: PPV: 30 H: SN1PEPF0002F948 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 19 Apr 2024 14:31:13 GMT Connection: close Content-Length: 11153
2024-04-19 14:31:14 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49714	13.107.21.200	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:14 UTC	2678	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A4109009A83 X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75 X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASwbiLIRhcTqivhE4W2IlVuzCCjM23MwqbiQQgIgCojlC/myogB9Ado6ldZLbmAmY2A43xx8Pg95gCfRdnoQWuaYlWakEGPrXvE8wV/b%2BzcggQk5HhlVYWXWiG646BmGu8KP31Sq73l2Zy/LJBTTpNMK9F5Xf4dXx1%2B6yiMJT%2B2fAjuVQAgva7X6HcZ5RmLo%2BAHzYKLDPN89LGnUx1w9/B0WUjDltq/BAWbT4d4JqnkIr68k4WWgKPU2PlB%2Bh6ARccpPucLPO2pAyrOnsRmvaP2wv7BxHxmCTasAYOdYsQfpC/f9yJwgJi2igaGGwvm08bCsYKb6UKrb7tv%2BDSYokIMDZgAACKdUmeRmgbEWqAFDVntRyJWhvPJNQKZBmzpDBm/vGiB/ti10bEhS6cDLUsZ86xGZhlTzc/1jmQKofbj7uybinU8BqlVwxbnLmwMHQTGLwACEhT0KkImlAvPD0/nGr1Ac00KhaVDSx2aOHYImNRYN1DOnP6Kyis8T%2BEu8aeFKXTG72sjw3xWwmhknlHIjzG53oFEl8U4t7DbKg1MdGFP2J238QwH8LRDUzP2F9GkJ/lEG%2BGtJW5H1QRjGjk1jyIu3kO4op4rcgoPYBALewHxDtc6Q6KXaJ3DXNXvbwfEZesiuDwZYBEj2MT5UFNOjtzG/ycVklthWalu%2BLwA1ftYfPT3/mUmPBJ%2B6UgIa9IWgbJw1%2BQvfMSONw%2BM0UwaaYGC0X6LxwjLmTUG2VEHf7ZRXBMA5BOhDmdSE1uKmnkfJxYdwm67%2BgRLMno2H6AXFSChDH3JRbOTdyaUstzI6Q261bWy37fSnhPiZ1oFd/NYWS79qWLDhpjtPVwn0QOfIrtczfGglR/p%2BNwm%2BG9Xcenlg682OUCW2EXu0p3qBqjtXzAVsx2afTvPuZOBeEsf4W/8YcdGS2AE%3D%26p%3D X-Agent-DeviceId: 01000A4109009A83 X-BM-CBT: 1713537070 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 1FC2B3CE685A45789AC768071429B558 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
2024-04-19 14:31:15 UTC	1635	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2215 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=1E1CFF41CE59647B025BEB27CF4E650D&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=5047E5942BB2460EA35B53CCF78DDB3D; expires=Wed, 14-May-2025 14:31:15 GMT; path=/; HttpOnly Set-Cookie: SRCHHPGUSR=SRCHLANG=en&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; domain=.bing.com; expires=Wed, 14-May-2025 14:31:15 GMT; path=/; secure; SameSite=None Set-Cookie: ANON=A=6167974D1A7C78361D9CC53BFFFFFFFF; domain=.bing.com; expires=Wed, 14-May-2025 14:31:15 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1E1CFF41CE59647B025BEB27CF4E650D; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 6622803308c7412b983a97da8a5bc1a8 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 387CAA73EA31412190011FE3AE678A68 Ref B: ATL331000104047 Ref C: 2024-04-19T14:31:15Z Date: Fri, 19 Apr 2024 14:31:14 GMT Connection: close
2024-04-19 14:31:15 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49715	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 14:31:29 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EgpEa1nOLXMftyt&MD=23EAllaZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 14:31:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 4543f83e-d664-40a6-9c9a-4fe13281db28 MS-RequestId: 7e79f67e-a1d7-414d-80f4-12b0080e4c24 MS-CV: Wf1qnkoN40yxzcug.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 14:31:28 GMT Connection: close Content-Length: 25457
2024-04-19 14:31:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-19 14:31:29 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	16:30:35
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:30:35
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2024,i,11191498385787339962,9289795739749909594,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf HTTP/1.1Host: us.aicpa.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: us.aicpa.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdfAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf HTTP/1.1Host: us.aicpa.orgConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EgpEa1nOLXMftyt&MD=23EAllaZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A4109009A83X-BM-WindowsFlights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASwbiLIRhcTqivhE4W2IlVuzCCjM23MwqbiQQgIgCojlC/myogB9Ado6ldZLbmAmY2A43xx8Pg95gCfRdnoQWuaYlWakEGPrXvE8wV/b%2BzcggQk5HhlVYWXWiG646BmGu8KP31Sq73l2Zy/LJBTTpNMK9F5Xf4dXx1%2B6yiMJT%2B2fAjuVQAgva7X6HcZ5RmLo%2BAHzYKLDPN89LGnUx1w9/B0WUjDltq/BAWbT4d4JqnkIr68k4WWgKPU2PlB%2Bh6ARccpPucLPO2pAyrOnsRmvaP2wv7BxHxmCTasAYOdYsQfpC/f9yJwgJi2igaGGwvm08bCsYKb6UKrb7tv%2BDSYokIMDZgAACKdUmeRmgbEWqAFDVntRyJWhvPJNQKZBmzpDBm/vGiB/ti10bEhS6cDLUsZ86xGZhlTzc/1jmQKofbj7uybinU8BqlVwxbnLmwMHQTGLwACEhT0KkImlAvPD0/nGr1Ac00KhaVDSx2aOHYImNRYN1DOnP6Kyis8T%2BEu8aeFKXTG72sjw3xWwmhknlHIjzG53oFEl8U4t7DbKg1MdGFP2J238QwH8LRDUzP2F9GkJ/lEG%2BGtJW5H1QRjGjk1jyIu3kO4op4rcgoPYBALewHxDtc6Q6KXaJ3DXNXvbwfEZesiuDwZYBEj2MT5UFNOjtzG/ycVklthWalu%2BLwA1ftYfPT3/mUmPBJ%2B6UgIa9IWgbJw1%2BQvfMSONw%2BM0UwaaYGC0X6LxwjLmTUG2VEHf7ZRXBMA5BOhDmdSE1uKmnkfJxYdwm67%2BgRLMno2H6AXFSChDH3JRbOTdyaUstzI6Q261bWy37fSnhPiZ1oFd/NYWS79qWLDhpjtPVwn0QOfIrtczfGglR/p%2BNwm%2BG9Xcenlg682OUCW2EXu0p3qBqjtXzAVsx2afTvPuZOBeEsf4W/8YcdGS2AE%3D%26p%3DX-Agent-DeviceId: 01000A4109009A83X-BM-CBT: 1713537070User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 1FC2B3CE685A45789AC768071429B558X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=E0DD87A720F84B6F91D233EB006F66A1&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=de&HV=1707317784&IPMH=3a628620&IPMID=1707317755885; MUID=5047E5942BB2460EA35B53CCF78DDB3D; MUIDB=5047E5942BB2460EA35B53CCF78DDB3D
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=EgpEa1nOLXMftyt&MD=23EAllaZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\9c0d67a3-6f07-4025-aeff-2f08c8df9164.tmp

C:\Users\user\Downloads\downloaded.pdf (copy)

C:\Users\user\Downloads\downloaded.pdf.crdownload

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2088, Parent PID: 6108

General

Windows Analysis Report
https://us.aicpa.org/content/dam/aicpa/advocacy/tax/downloadabledocuments/2023/boi-comments-on-proposed-90-day-extension-final.pdf