Edit tour

Windows Analysis Report
ACRMNT.pdf

Overview

General Information

Sample name:	ACRMNT.pdf
Analysis ID:	1432278
MD5:	44159aca23f90b1cabf0005a7975f77c
SHA1:	8fe88115faaa0c3bda916d9e375588443fc10199
SHA256:	01109b3bc2fa06f9c6d47bda68d49ffed38556b9b18d978ef2fc576704df31ae
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Phishing site detected (based on OCR NLP Model)

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

No malicious behavior found, analyze the document also on other version of Office / Acrobat

Process Tree

System is w10x64

Acrobat.exe (PID: 7332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACRMNT.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7512 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1620,i,2245434487977849350,1117404074893898555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8684 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2224,i,14375637986676002986,8035494575245750603,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Adobe Acrobat PDF

ML Model on OCR Text: Matched 94.8% probability on "Jennifer Schoettler sent the document "Arcane Tinmen Storage Proposal" for your review in Microsoft OneDrive PDF View Documents In OneDrive This billing notification was sent to all owners, check your e-mail security settings to determine how attachments are handled. Thank You, Jeniffer Von Schoettler Trade Marketing Manager US I Sales Jeniffer.schoettler@arcaneunrnen.com +1 (786) 863 2257 "

Source: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa#msdynmkt_trackingcontext=89e184cd-4b42-4d05-891c-d646800c35ab	HTTP Parser: No favicon
Source: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa#msdynmkt_trackingcontext=89e184cd-4b42-4d05-891c-d646800c35ab	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49771 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 13.107.246.41 13.107.246.41
Source: Joe Sandbox View	IP Address: 52.146.76.30 52.146.76.30
Source: Joe Sandbox View	IP Address: 104.94.108.142 104.94.108.142
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.182.102
Source: unknown	TCP traffic detected without corresponding DNS query: 23.45.182.102
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vkF+oXvDPKsCOPm&MD=HWVEBc5B HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/FormLoader.bundle.js HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/plainsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://assets-usa.mkt.dynamics.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-usa.mkt.dynamics.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daaAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1Host: cxppusa1formui01cdnsa01-endpoint.azureedge.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250 HTTP/1.1Host: assets-usa.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vkF+oXvDPKsCOPm&MD=HWVEBc5B HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: public-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: assets-usa.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits HTTP/1.1Host: public-usa.mkt.dynamics.comConnection: keep-aliveContent-Length: 215sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://assets-usa.mkt.dynamics.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 17:17:01 GMTContent-Type: text/htmlContent-Length: 548Connection: closeStrict-Transport-Security: max-age=2592000; preloadx-azure-ref: 20240426T171700Z-17644f8887fxsmp62x2nasg16g00000002hg0000000034a1x-fd-int-roxy-purgeid: 69215008X-Cache: TCP_MISS
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 26 Apr 2024 17:17:05 GMTContent-Length: 0Connection: closex-ms-trace-id: 845bcf146cfa5d58371ff067105e99baStrict-Transport-Security: max-age=2592000; preload

Source: chromecache_189.10.dr, chromecache_190.10.dr	String found in binary or memory: https://KCu.hinomyl.com/WLbwaVu/
Source: chromecache_194.10.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b
Source: chromecache_189.10.dr, chromecache_190.10.dr	String found in binary or memory: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00
Source: chromecache_194.10.dr	String found in binary or memory: https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/FormLoader.bundle.js
Source: ACRMNT.pdf	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZG
Source: chromecache_194.10.dr	String found in binary or memory: https://public-usa.mkt.dynamics.com/api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpagefo

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49771 version: TLS 1.2

Source: classification engine

Classification label: clean1.winPDF@40/58@10/8

Source: ACRMNT.pdf

Initial sample: https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zythiujlbu2jhnzggaw1qweaaaa

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7388

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 19-16-26-739.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACRMNT.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1620,i,2245434487977849350,1117404074893898555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2224,i,14375637986676002986,8035494575245750603,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1620,i,2245434487977849350,1117404074893898555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2224,i,14375637986676002986,8035494575245750603,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ACRMNT.pdf	Initial sample: PDF keyword /JS count = 0
Source: ACRMNT.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: ACRMNT.pdf

Initial sample: PDF keyword stream count = 24

Source: ACRMNT.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ACRMNT.pdf	0%	ReversingLabs
ACRMNT.pdf	2%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
part-0013.t-0009.t-msedge.net	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	0%, Virustotal, Browse	unknown
prdia888eus0aks.mkt.dynamics.com	52.146.76.30	true	false		high
www.google.com	142.250.189.132	true	false		high
public-usa.mkt.dynamics.com	unknown	unknown	false		high
assets-usa.mkt.dynamics.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa	false	high
https://assets-usa.mkt.dynamics.com/favicon.ico	false	high
https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA	false	high
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250	false	high
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa#msdynmkt_trackingcontext=89e184cd-4b42-4d05-891c-d646800c35ab	false	high
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa	false	high
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://public-usa.mkt.dynamics.com/api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpagefo	chromecache_194.10.dr	false	high
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00	chromecache_189.10.dr, chromecache_190.10.dr	false	high
https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZG	ACRMNT.pdf	false	high
https://KCu.hinomyl.com/WLbwaVu/	chromecache_189.10.dr, chromecache_190.10.dr	false	high
https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b	chromecache_194.10.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.189.132	www.google.com	United States	15169	GOOGLEUS	false
52.146.76.30	prdia888eus0aks.mkt.dynamics.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.94.108.142	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.16
192.168.2.4
192.168.2.23

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432278
Start date and time:	2024-04-26 19:15:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ACRMNT.pdf
Detection:	CLEAN
Classification:	clean1.winPDF@40/58@10/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.221.212.219, 23.221.212.204, 23.204.76.141, 162.159.61.3, 172.64.41.3, 54.227.187.23, 52.202.204.11, 52.5.13.197, 23.22.254.206, 199.232.210.172, 192.229.211.108, 172.217.165.195, 142.250.189.142, 142.251.107.84, 34.104.35.123, 142.250.64.170, 142.250.64.138, 142.250.189.138, 172.217.2.202, 142.250.217.202, 172.217.165.202, 142.251.35.234, 142.250.217.234, 192.178.50.42, 142.250.64.234, 142.250.217.170, 192.178.50.74, 172.217.3.74, 172.217.15.202, 172.217.2.195, 192.178.50.46
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, assets-mkt-usa.azureedge.net, clientservices.googleapis.com, acroipm2.adobe.com, cxppusa1im4t7x7z5iubq.trafficmanager.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, assets-mkt-usa.afd.azureedge.net, optimizationguide-pa.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, cxppusa1formui01cdnsa01-endpoint.azureedge.net, clients.l.google.com, geo2.adobe.com, cxppusa1formui01cdnsa01-endpoint.afd.azureedge.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.41	http://www.surveymonkey.com/tr/v1/te/PUEIZHbYTJGrZEIkVMWlCoicdktJQxDgUh5D5mhe1V5RrTmuIdynx7PnFHXRUx9slMgQjvZdyUWqhr_2Bl49oNXjy3TOleTjKMKR6WbsGcrstlT2syBMlSkW7U5aKlKcBD9NFqJqrxGyODSWJJr6_2BMbXsKkDA_2F0ep4iw23xw6huuM_3D	Get hash	malicious	Unknown	Browse	www.eand.com/en/index.html
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	02-11-2024 MVP.html	Get hash	malicious	Unknown	Browse	www.mvphealthcare.com/
	http://y84x.mjt.lu/lnk/CAAABPdweCoAAAAAAAAAAAVG8MwAAAA6pnMAAAAAAAvpOQBlhIO4-ImJ1UImRBC5CNVIkLSaswAL-7Q/2/r-vXj7XjX0azsD7QNKNH-A/aHR0cHM6Ly9hcHBjZW50ZXIubXMvaW52aXRhdGlvbnMvb3JnL2IxNjM2ZDYzMTE0YTM0MjBkYWFmNTg4YTE5N2Y0N2MxNGY4ZDViNWMyM2ZjM2RhYTgxMWM0ODgwOWM1ZTZkNjQ	Get hash	malicious	Unknown	Browse	appcenter.ms/
	http://url7816.acetaxi.com/ls/click?upn=k9eqZnPBEZmPVPka3LxS61O1ksdCJOgznvtiwccqzi2-2BneqvfCXEJ-2FQj-2BZo7snmCwDunBahf2LYhfs7qQp7-2F23xLStq-2BkxJ70xqVvyXzkWM-3D8Cie_z5TGfmB4A65PPE2hDgRdrx6OZsZ3AmrJLHJ0M9ePWeHP5QDTWsAVp117uXam9dNn-2BGSxHeP-2BInRF-2Bgy2v-2FXBPODjmLss6NRV2RYsUYD7um77hgLl0ET9pPGTHF-2BQ1m6-2Fw7-2B-2B9DJOpakZj874YLC8uUep0F7rZMDlM46gmHmQqqAeCV477M0h2b07T2IcXu0hzUcKftN0UG2jhPq8qo00cQl0gvOLl-2BjChyaOdLpENao-3D	Get hash	malicious	Unknown	Browse	twiliosolutions.azurefd.net/
239.255.255.250	https://cgigroup.blob.core.windows.net/cgi-protective-monitoring-service/tools/get-stinger.html	Get hash	malicious	Unknown	Browse
	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse
	z55NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse
52.146.76.30	FW_ FHAS Inc_ - Private and Confidential.msg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse
	infected.docx	Get hash	malicious	HTMLPhisher	Browse
	https://assets-usa.mkt.dynamics.com/97c9a062-91f8-ee11-9048-6045bd00330f/digitalassets/standaloneforms/8ba5ff5d-a1f8-ee11-a1ff-6045bd006d62	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	https://assets-usa.mkt.dynamics.com/dfec4c64-9df2-ee11-9048-6045bd016f3e/digitalassets/standaloneforms/692fca68-35f7-ee11-a1fd-6045bd098894#msdynmkt_trackingcontext=a1e2f77d-3fb4-4f9b-8447-219d31fdfcd9	Get hash	malicious	HTMLPhisher	Browse
	https://assets-usa.mkt.dynamics.com/bf3ca3b9-47ed-ee11-9048-00224806e307/digitalassets/standaloneforms/0cb76a16-5df6-ee11-a1fd-6045bd0a59e1	Get hash	malicious	HTMLPhisher	Browse
	https://s.id/24SUG	Get hash	malicious	HTMLPhisher	Browse
104.94.108.142	RFd2zutX8H.exe	Get hash	malicious	Unknown	Browse
	Benefits Open Enrollment 2024 #U007e Closes on Friday For Carboline	Get hash	malicious	HTMLPhisher	Browse
	Invoices.xls	Get hash	malicious	Unknown	Browse
	Orden_T7405.xla.xlsx	Get hash	malicious	Unknown	Browse
	IF-07b_SIGS-EN-ICS-IC-002_SMC-SCU ICD_v31_19-03-2014.pdf.exe	Get hash	malicious	Unknown	Browse
	btui2YGkc5.exe	Get hash	malicious	NetSupport RAT	Browse
	btui2YGkc5.exe	Get hash	malicious	NetSupport RAT	Browse
	swift_copy.xls	Get hash	malicious	Unknown	Browse
	kSWf9QrxMR.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Iu4a4i5N15.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
part-0013.t-0009.t-msedge.net	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	13.107.246.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://shorturl.at/lMOT7	Get hash	malicious	Unknown	Browse	13.107.213.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.246.41
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fwittywebevents.wipro.com%252Femail-analytics%252Fapi%252Ft%252Fl%253FobjId%253D637c92a3e4b00b92caee94cc%26data%3D05%257C02%257Cgary.fabrizio1%2540wipro.com%257Cb8fe953db5914d2bac8108dc65645f6b%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638496729264132835%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C0%257C%257C%257C%26sdata%3DX8fjcrb6FJIv3A6MeNVFttkEvMY37x2gBwDUYM2DULg%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	13.107.246.41
prdia888eus0aks.mkt.dynamics.com	FW_ FHAS Inc_ - Private and Confidential.msg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.146.76.30
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	infected.docx	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://assets-usa.mkt.dynamics.com/97c9a062-91f8-ee11-9048-6045bd00330f/digitalassets/standaloneforms/8ba5ff5d-a1f8-ee11-a1ff-6045bd006d62	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	52.146.76.30
	https://assets-usa.mkt.dynamics.com/dfec4c64-9df2-ee11-9048-6045bd016f3e/digitalassets/standaloneforms/692fca68-35f7-ee11-a1fd-6045bd098894#msdynmkt_trackingcontext=a1e2f77d-3fb4-4f9b-8447-219d31fdfcd9	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://assets-usa.mkt.dynamics.com/bf3ca3b9-47ed-ee11-9048-00224806e307/digitalassets/standaloneforms/0cb76a16-5df6-ee11-a1fd-6045bd0a59e1	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://s.id/24SUG	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.29
	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.28
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse	23.44.94.139
	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	184.31.62.93
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.214.187.157
	aios3.exe	Get hash	malicious	Unknown	Browse	184.31.60.185
	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	23.59.235.214
	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	104.73.199.214
	https://bushelman-my.sharepoint.com/:b:/p/lance/ESXtc6Laa05KpaC4W3rpMEMBfLSUU1GZhgfhBL8opRqFHg?e=Wrw3le	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.223.31.42
MICROSOFT-CORP-MSN-AS-BLOCKUS	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	52.96.165.130
	file.exe	Get hash	malicious	Unknown	Browse	52.178.17.234
	file.exe	Get hash	malicious	Unknown	Browse	204.79.197.219
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	52.96.28.178
	https://github.com/bambulab/BambuStudio/releases/download/v01.08.04.51/Bambu_Studio_win_public-v01.08.04.51-20240117164301.exe	Get hash	malicious	Unknown	Browse	13.107.42.16
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse	20.118.56.6
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	52.96.165.130
	file.exe	Get hash	malicious	Unknown	Browse	52.178.17.234
	file.exe	Get hash	malicious	Unknown	Browse	204.79.197.219
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	52.96.28.178
	https://github.com/bambulab/BambuStudio/releases/download/v01.08.04.51/Bambu_Studio_win_public-v01.08.04.51-20240117164301.exe	Get hash	malicious	Unknown	Browse	13.107.42.16
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse	20.118.56.6
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	20.157.87.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://unilever3.demdex.net/firstevent?d_event=click&d_bu=317196&c_medium=display&c_destination=Retailer&c_country=BD&c_campaignname=L-LifebuoyHandsanitizerLaunchComm&c_prodcat=CH1097&c_brandcode=BH0300&d_adgroup=All_KV&c_contenttype=display&c_source=Dhaka%20Tribune&d_rd=https://campaign-statistics.com/link_click/PidJvkyg2S_O4JTm/159dfdb0ade49a7c5597d3c1d9bd3d8a	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183
	z55NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse	23.204.76.112 20.114.59.183
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	23.204.76.112 20.114.59.183
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	23.204.76.112 20.114.59.183
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	23.204.76.112 20.114.59.183
	https://srmcorp.tecuidoc.com/?PSZlk=ViP	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288518249181711
Encrypted:	false
SSDEEP:	6:Gd+q2Pwkn2nKuAl9OmbnIFUt8LJSXZmw+LJS3VkwOwkn2nKuAl9OmbjLJ:GYvYfHAahFUt8LAX/+LAF5JfHAaSJ
MD5:	8E92265E419A085F9A6823FFB54A7C0E
SHA1:	A87E518B369C5321A8B7CA3BF31247B11CD15177
SHA-256:	9A5C6886031942937E54E4E76598506867C6458F35A5420E6153D9A64A6D88AB
SHA-512:	BA9FEB90491E45DEE6695C4962C743529D0870390D19ADD7AC30A90C128FF756BA6C91C0A28F62C0255B191CC3106D9C22F93594537BCFB36844E095776A19D9
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:23.797 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-19:16:23.798 1dd8 Recovering log #3.2024/04/26-19:16:23.798 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288518249181711
Encrypted:	false
SSDEEP:	6:Gd+q2Pwkn2nKuAl9OmbnIFUt8LJSXZmw+LJS3VkwOwkn2nKuAl9OmbjLJ:GYvYfHAahFUt8LAX/+LAF5JfHAaSJ
MD5:	8E92265E419A085F9A6823FFB54A7C0E
SHA1:	A87E518B369C5321A8B7CA3BF31247B11CD15177
SHA-256:	9A5C6886031942937E54E4E76598506867C6458F35A5420E6153D9A64A6D88AB
SHA-512:	BA9FEB90491E45DEE6695C4962C743529D0870390D19ADD7AC30A90C128FF756BA6C91C0A28F62C0255B191CC3106D9C22F93594537BCFB36844E095776A19D9
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:23.797 1dd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-19:16:23.798 1dd8 Recovering log #3.2024/04/26-19:16:23.798 1dd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.2285677145156235
Encrypted:	false
SSDEEP:	6:GAp+q2Pwkn2nKuAl9Ombzo2jMGIFUt8LRZZmw+LBVkwOwkn2nKuAl9Ombzo2jMmd:GlvYfHAa8uFUt8LRZ/+LP5JfHAa8RJ
MD5:	DBD1B719A67D0639810AFCC3E553E2BE
SHA1:	73B0101418B708AD8A96A378A047030E35D3FBEB
SHA-256:	0D85AB541BDDD7E062B9C709B881D38F5440C8B1586FA84456155D72EF3C75AA
SHA-512:	820D1E55055E848BADCE3F74529EE44F930424DC1BDA10A7A2B1A02945CD6AE587C5F218C7CEEDC8CFEF49B30FE7DA21021BA78A2895A6C45A04C49C9A9B8F94
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:23.896 1e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-19:16:23.897 1e68 Recovering log #3.2024/04/26-19:16:23.899 1e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.2285677145156235
Encrypted:	false
SSDEEP:	6:GAp+q2Pwkn2nKuAl9Ombzo2jMGIFUt8LRZZmw+LBVkwOwkn2nKuAl9Ombzo2jMmd:GlvYfHAa8uFUt8LRZ/+LP5JfHAa8RJ
MD5:	DBD1B719A67D0639810AFCC3E553E2BE
SHA1:	73B0101418B708AD8A96A378A047030E35D3FBEB
SHA-256:	0D85AB541BDDD7E062B9C709B881D38F5440C8B1586FA84456155D72EF3C75AA
SHA-512:	820D1E55055E848BADCE3F74529EE44F930424DC1BDA10A7A2B1A02945CD6AE587C5F218C7CEEDC8CFEF49B30FE7DA21021BA78A2895A6C45A04C49C9A9B8F94
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:23.896 1e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-19:16:23.897 1e68 Recovering log #3.2024/04/26-19:16:23.899 1e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\04a66e01-8fda-4a7c-a117-d2536b3f9cd9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966127851787609
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQ5eSsBdOg2HKaYZcaq3QYiubInP7E4T3y:Y2sRdsroXdMHK/g3QYhbG7nby
MD5:	6FBFCAFD8CD202ADE32A2BDB8F5C31F9
SHA1:	11574896DB7F946563BC0DD68BAE2998A05E6381
SHA-256:	3FC7C4B2975C48EB23B9D24FE0CFA7F5FEB30DC3FDB888C6641A0B29E8D91FE5
SHA-512:	C95EA21F0EED2CF6AC0F48A11E88E2A9EEE8DC2788C6DC99919EDD8F18115710BDE3EA128E2A5631F479076BDF76056910978C30FA6B0A86CF930BEF853A9371
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358711795619899","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126478},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966127851787609
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQ5eSsBdOg2HKaYZcaq3QYiubInP7E4T3y:Y2sRdsroXdMHK/g3QYhbG7nby
MD5:	6FBFCAFD8CD202ADE32A2BDB8F5C31F9
SHA1:	11574896DB7F946563BC0DD68BAE2998A05E6381
SHA-256:	3FC7C4B2975C48EB23B9D24FE0CFA7F5FEB30DC3FDB888C6641A0B29E8D91FE5
SHA-512:	C95EA21F0EED2CF6AC0F48A11E88E2A9EEE8DC2788C6DC99919EDD8F18115710BDE3EA128E2A5631F479076BDF76056910978C30FA6B0A86CF930BEF853A9371
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358711795619899","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126478},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	5.258234714701456
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7xqz8pzZ:etJCV4FiN/jTN/2r8Mta02fEhgO73goD
MD5:	5918C74E1178FF6D67B9390CAE8960EF
SHA1:	128D15ABF4CD07ABE194966EB0B090755C2A0E04
SHA-256:	5E0587EA1C8F3818F69F521CB898A84EDB20F0A260749874C67B37493DAE13B0
SHA-512:	0FDC1CCD97CCEC3280B76BD0A2677D54D765BE652C946D821EFCC665EEC1E1E5D1C5AAFA4A41DCF0B749460B56BEFBB8ABFB536FB0D3D8F36277AD06C9098188
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.183126183278774
Encrypted:	false
SSDEEP:	6:90N+q2Pwkn2nKuAl9OmbzNMxIFUt8KrvZmw+KrvVkwOwkn2nKuAl9OmbzNMFLJ:9tvYfHAa8jFUt8Krv/+Kr95JfHAa84J
MD5:	687C2F4BA8D352BAD52EBC6158F9D207
SHA1:	9052E11717358FE34F12DC15BC664F79188A6527
SHA-256:	05B5B97F560FF475E9E977A38D03FFABD6C6A7D9575A847D890179AAAFE61571
SHA-512:	8EBC995256CADC78E0A8C9068C29595D3B5AB321E069DB43FD3890ABF06CC2655044B1B85C6A8F1C863D644396B77C9685A7E6B03DFC687CF0BC8B3207F761BC
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:24.012 1e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-19:16:24.013 1e68 Recovering log #3.2024/04/26-19:16:24.013 1e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.183126183278774
Encrypted:	false
SSDEEP:	6:90N+q2Pwkn2nKuAl9OmbzNMxIFUt8KrvZmw+KrvVkwOwkn2nKuAl9OmbzNMFLJ:9tvYfHAa8jFUt8Krv/+Kr95JfHAa84J
MD5:	687C2F4BA8D352BAD52EBC6158F9D207
SHA1:	9052E11717358FE34F12DC15BC664F79188A6527
SHA-256:	05B5B97F560FF475E9E977A38D03FFABD6C6A7D9575A847D890179AAAFE61571
SHA-512:	8EBC995256CADC78E0A8C9068C29595D3B5AB321E069DB43FD3890ABF06CC2655044B1B85C6A8F1C863D644396B77C9685A7E6B03DFC687CF0BC8B3207F761BC
Malicious:	false
Reputation:	low
Preview:	2024/04/26-19:16:24.012 1e68 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-19:16:24.013 1e68 Recovering log #3.2024/04/26-19:16:24.013 1e68 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426171628Z-166.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.036464961456313
Encrypted:	false
SSDEEP:	96:+z7umV0owgcEe3xjDYhbR6JqXqySA7fFLNzh1XOGU:+qLowgne3R6R6ty/9h1ed
MD5:	A68BE5E26220AA6CB1D7D283A1790B92
SHA1:	170D65F4095A68B476356252BA7D07FFD95C2DF8
SHA-256:	1EEDABB97F3783E681B1F8613699F441300A06DB538C48BBEAD75060B972B7AC
SHA-512:	A3526B3758AE17CF1BAFD8555E04039A984776AC30410501DC42F61169F0F41C3A67544DF4B0E9EC500E3C483B5088F1FB7E7236E0942D4774801D171ACF9597
Malicious:	false
Reputation:	low
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445372840115458
Encrypted:	false
SSDEEP:	384:yezci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rhs3OazzU89UTTgUL
MD5:	10AB4C30D33614D52DB8F574030EC2AA
SHA1:	352A318FE6A96AC64282DCFA37EAE61E903B6F64
SHA-256:	82EC788011854F7EA2AD3D908A66531E55F93AD9B3F7C16A75111F16B17DFE5A
SHA-512:	5A0AA1E676BB089A08C2D2219010BAE1C262324ECFF567E8516603DB79352A712A93210DD30538EB3592535B89FA8D2819B5FE38C49A65321DCFD6090EC7323C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7774945775733553
Encrypted:	false
SSDEEP:	48:7MOp/E2ioyVxDioy9oWoy1Cwoy1owKOioy1noy1AYoy1Wioy1hioybioyCsoy1nL:7NpjuhFQXKQwdb9IVXEBodRBkL
MD5:	490B9B41358145FACA4F5C7E0C2C9FA6
SHA1:	DCFFE6DBEEDF9628C8AA1E2D4FFC1E05DA8A5010
SHA-256:	A505E445FC970523886285A7753F9C7F2D838386712194EB56FC68231971825C
SHA-512:	654C7687F4DC55297F04300174951F77D28556AF1BCC41C826B7E5C3868A305C926A10695A370EFE8A3AECB63D2E1D454CD0A1A65A54B0E2F983D967BA61E796
Malicious:	false
Preview:	.... .c......)""...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7388

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	243196
Entropy (8bit):	3.3450692389394283
Encrypted:	false
SSDEEP:	1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwgqErRo+RQn:yPClJ/3AYvYwghFo+RQn
MD5:	F5567C4FF4AB049B696D3BE0DD72A793
SHA1:	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916
SHA-256:	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
SHA-512:	E769735991E5B1331E259608854D00CDA4F3E92285FDC500158CBD09CBCCEAD8A387F78256A43919B13EBE70C995D19242377C315B0CCBBD4F813251608C1D56
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371107634233088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJM3g98kUwPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGMbLUkee9
MD5:	2C32FEAC4D9E0280C2CE74A08E93FDD4
SHA1:	0461BF2A401DF40CB655F283F4CD54EF533B2240
SHA-256:	2655D02C6FFE53DB2CE441CC40A8B09CAA0D8F3BB262F176AD0F9E05014AD912
SHA-512:	C236543206383B56C7C19B96C132B9D7AC09996BDE0D0247F82A678C1E9CEFDF35B25421367092ABDAA2801FB74044DF9807EE7632898137F49AF54C95F02DA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321840005844044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfBoTfXpnrPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGWTfXcUkee9
MD5:	C158F05C9B07A3ED5EAAB76A0C329A6A
SHA1:	2725D59AF8B75B8C66EE9A01872601F121327512
SHA-256:	AA08BF8FB3214C75CE7072B158B51E0FBB9DFB4C6C2984ED6A937BE5B003505B
SHA-512:	B1564357B2CE38134F7114E4DC0ECF91E4AB7414361567DD830A2EDCEAABC7856CB6FC45BF84D5A5CE4539C0D1D134862C208B5BB55D978EA3E29DAD1A1F57B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301326574981446
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfBD2G6UpnrPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGR22cUkee9
MD5:	1CD618DF9E4B545916DF97874AA9B47F
SHA1:	0A7011145B6EE4329FC09FF744A79461615A0E03
SHA-256:	9368CA2885C94E78A18F32E77063BFA60AB731AB916BF0DDA6AF760CC1CB9C55
SHA-512:	D309F5C33D0863865CDDC57D10167249356ECA285E8F38288528F49825DD0672140AB6EADA59B3EC7404F907322673156D542F7F391E4FF5C1C2F27CD57FDFBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358389868425296
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfPmwrPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGH56Ukee9
MD5:	9E908883A3F5D6AD11FF0691DDA265E2
SHA1:	AE7D909B6E9388F01C443EA9E3C60BF8DE84A3E5
SHA-256:	AC0677FC1BFCF0E10C2307ACF7F938ECDBB870CBE1C5238D7060441F4EB203BA
SHA-512:	5E98F003626C79C6D55D137052BCC566EBBA8FFFB27C1AF5AED9B92AF1BD71DB48483F58221E10D6550C08B9EB1025ECD0D5D4829F228C75FF38B616B9CA7600
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.317066515450081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfJWCtMdPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGBS8Ukee9
MD5:	67E379A680306995F910890426EB908F
SHA1:	078E37B1FEF876555E7A81F18BD47278B0B3FE74
SHA-256:	509E0039B6F3EE90980D38D692F5D445D4DB2577EA72CF13CB43E48886B2CEEB
SHA-512:	587DF9D10CBA1305A5A853A656B112F255F8A60907FD2E9BF268B452ABC02B011FE9AE4D0ECC7E0C8436F0CA1E32DC715A8AE8F9728DC1A3A27AB9F0D0E8F600
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305082148703519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJf8dPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGU8Ukee9
MD5:	1BAA3A77020A1F2C9A95482F0386C47D
SHA1:	E313F84F16E53F1930CA75AAF615528784226CD8
SHA-256:	A5D8DE3E5EEEE86A37788A2CFA1F15A787AA015A7F08D17259DCBF3A45F4501A
SHA-512:	94AA7AA1361A301E94FEDFECD64607153F2EB0AEC687E690E96C5D5C2187D96C525FFD4E4D507285D7CABB0738F7A326F73913EDCE1B39432251A2E98923B03E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.308930570471311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfQ1rPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGY16Ukee9
MD5:	610838AF75AF76DB98903353E14A766D
SHA1:	96F22B2257C63F51A2E3CDFE707F8EB637381DFE
SHA-256:	BF6481A679108E84C38D031D4D9D03B5D456F0CFC056CF27E73850D3E2AD4666
SHA-512:	CB8C959F7E89FF260B5BE04FE63C2FB2790D445E42D05FEE62C2C107FF28BBDE8FA78E3F76CF9672D68B399B1AC84D579521FD71F4F6BA38F5E31E64EEF39464
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313329378632362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfFldPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGz8Ukee9
MD5:	B8EE7442B070183C6BD05FFBF756B812
SHA1:	308DCE50683B996876B3FF96800D534FA410A447
SHA-256:	FAD5F8857AEE923DDE11EC29AE9A5170202BA3213476DF1724E0E374118E2169
SHA-512:	0F9D6DB4552A7B965A440F0D01B2B9317D10D4B2A22E5D55E0C14FE435B4F4436AB001CC94B846F4E29CCE40B277370A953DE76B6A9CB00A1F7B9730AF341102
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.740474309111011
Encrypted:	false
SSDEEP:	24:Yv6XUXiUk9VEzvdyKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN9:YvtX3GuAEgigrNt0wSJn+ns8cvFJ3
MD5:	6033246F61797F065A633F75392CE847
SHA1:	E4EDF0EB837C769FEFEC34CD129F4DD1D074B736
SHA-256:	51BE3860E7710DA63D7E62FBE93CF597476EC77AAE16E13D3A1C2B98CCAEB32D
SHA-512:	6D47C0506D5C33F2AA7D51BDB50BDB8541C2E37DDBC28909204C35E5FF3B9A52F6D9C1465F55984517C7750E73F6BDE7E75661080C0838F1A3F70743335A40A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3103169754488215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfYdPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGg8Ukee9
MD5:	4C2EE824CAA0C38B6EDEA0F5EF35EA84
SHA1:	CF6819B57E1089208CDF6159C652DDC52FCAAEB5
SHA-256:	4CE559F6C95ACC15A173ABEC96EB5F6C3AB493A2206031DF0B714E775F4953FB
SHA-512:	C620707D09F7471CE73E1E4A4920DB2426BD36F54DB2E422BF72CA987E9009329DFC1C1C00DF51C9061CE934E8ED82DCC075EF8BDB9FE33C47B4FD358BF6FFFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.778313928883832
Encrypted:	false
SSDEEP:	24:Yv6XUXiUk9VEzvdxrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJN1:YvtX3GuPHgDv3W2aYQfgB5OUupHrQ9F9
MD5:	87F2B1E0E4B7EA9AC3E375A92F801A2B
SHA1:	C682FF45F02573B4E04D33F2D65D2B5EE2B992CE
SHA-256:	F90D5F01FC342C62E15A33860F57A8C900940C810C7AA4D48CC2F84EC208A98F
SHA-512:	68F75CED44107C7B9F94CFC714596F9E1DFAA84009682B373A83DBAC80D25E7EF0E253DCA267FC25ED69FFD929A2CE28BD0A63D65C1C4628DCCC56B2DAB5ABF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.293793166074926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfbPtdPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGDV8Ukee9
MD5:	017ADA21B563C34BD27C99E4C77BDF40
SHA1:	BC3B0515974E0E8C6ED67A8A0E1D34A283F80033
SHA-256:	536D35DCDBE19C6F36E42D1E8E0BA6451D2BA8102F4AA3045E9EE1A25A9779DE
SHA-512:	5AC7BB23AD0C9C0E107F33193CDDA27F71CDC58ED80A461431F8C7C36B45D2540CF39FDAE21D5FD57BCEFA67C4770A0B558A06C11832ACEE0C11FC0CB72DE9F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298587421058204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJf21rPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmG+16Ukee9
MD5:	C703E3A688ADBD94070AF25515589A32
SHA1:	F28B6063B5E0C218824C6759D200350A5F82D339
SHA-256:	92D5EA3B26A5318E9DECECB4A6639DEF61C21C7BD21375D41E9ACDE9F1F11CDB
SHA-512:	7D7CA623751DB6803104BAF911C973B5B285AB5E3B5B64FCD7C55D03CD594212A445619BF807E2137C5453CF2F6B72C9CB6088403D480EEEA6611ECF4693052E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317152104206969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfbpatdPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGVat8Ukee9
MD5:	DF365A19DA3189C19713461E30F2605A
SHA1:	9D94DF484B9FC9E1669BEF9CD6332D9344B5959F
SHA-256:	584AA4567093943E56098F62FDA1301D547C566167DDE403B39FC90D70E16C2F
SHA-512:	666E222300FC7354B3635CC1AC63D8031D578FE1ACBE4A72806A9419FD1A72D5C3320B0F2420DCA1EF8AA73C362171D46107B717CCBA9A134D6389EE635C3FFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.274265091761626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8XiUyNoaHV9VoZcg1vRcR0YoJoAvJfshHHrPeUkwRe9:YvXKXUXiUyNFHVEZc0vdmGUUUkee9
MD5:	3F147CB842EC6E178C0B769A4B93F562
SHA1:	91E4BEA28F5ED18EFE2523A2C57BDDD4B082DC7F
SHA-256:	77C68A77C200A6FE4FA74F67480A58D2D286CEF8A3AA34CADA7340CA874A8744
SHA-512:	F7F90E67B3BE0945BA360111D7BB1323C976E62DB820EFCFCD92DF6D9AFCBFE4925149795325611241AE41FE79DB2AA60092B9FFC022F941E02F090858A91828
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.370501024519475
Encrypted:	false
SSDEEP:	24:Yv6XUXiUk9VEzvdA168CgEXX5kcIfANhw:YvtX3Gu+88Cgs5Fvw
MD5:	55A4240639C95BB28AFBD37BB937636E
SHA1:	BA7385EE5A60CBA674FD326CF7887060E69AE521
SHA-256:	C238572F231C4B8ABB07E7F498F17F002CC328FB98A1EEE0936AD2A197FCB585
SHA-512:	ACCB3A45D12B7F9E45F6744F67BBAB97E6C0D05E54E3D9AA080598242280E4DA2FA85C133B248D4A42349991D1909A39FCA9E8B8AA122E5729F39D1952873791
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8b923a2a-e621-450f-996d-77b5004e50d6","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1714326601448,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714151791489}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129941803683339
Encrypted:	false
SSDEEP:	48:YBc1yzJgKVSARK0uDKgtxla5KszaloZrGR9pV:XmgKVSIujXlmKBStGvH
MD5:	2243BBBEB1EE6843ADA6CF8571B15363
SHA1:	76D8929F7831C47C3683D8B639D551D980E1B735
SHA-256:	A3B52322C1A445479900DF65B5C4F279F8582DADC5B4724D97423BB489C38C9F
SHA-512:	CB601C79CF68BB9C540B798442E93FE863188F7CA9A5D4A224BFBF2F39888B6EACE8361E7F0DE4091998710B85D662211352911E6DEE9F5BD108E2B7750A41BC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f9276084425a2c7eb001705a9bfc2b73","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714151791000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"34d11a50897e3316dea75f5abc12d4c7","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714151791000},{"id":"Edit_InApp_Aug2020","info":{"dg":"be2b98cdd0b00fe2c1d7d311739d1262","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714151791000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"263d23d2790c9784dec4e51544345771","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714151791000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d5bc856dd1237da6b5542436287c322b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714151791000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4d1253c6272774f2628ea2027e5b6062","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714151791000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1876536513128806
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU/SvR9H9vxFGiDIAEkGVvpr:lNVmswUUUUUUUU/+FGSItf
MD5:	BA8AA45025EAC3AD53A11F4A699565AB
SHA1:	91EF91ECD3CBE8D23C47DC689F0CC63058032B6B
SHA-256:	5A0F07985C96B1284AEABD386889D36904D8D2E58F717185FA0205DDA2699D86
SHA-512:	FFA4F67377AD607387F03DD2AE8CA544C73773F9AE8021BCDB1858D07C49BB3261A1E7363001F0FBD7EF00BA87EFDAD49E4BCC27165C3225C9733C854C7C6BCF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6073911864452748
Encrypted:	false
SSDEEP:	48:7MIKUUUUUUUUUUDvR9H9vxFGiDIAEkGVvnqFl2GL7msm:7IUUUUUUUUUUTFGSItxKVmsm
MD5:	54AE1C06F9769F8C27F873B4BC128B1B
SHA1:	7F4E1E306ECC1F86F5CA9CE9E2E09A1CDA1F54B4
SHA-256:	D28ACADD7D5F8211CEE2A669F260232717830651907A5D515161127B0D80E620
SHA-512:	FCD983F4834029D4C5F98F671FFE9B9286D9DFE65BC2BFA5626E37D97069AE487D5D191C4AE2D4CDD348D976A426533273AE80B70A8A19D9CC5AA839EFA28D8F
Malicious:	false
Preview:	.... .c......j.(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI75cfb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5274671434738973
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdWajcflH:Qw946cPbiOxDlbYnuRKvVcflH
MD5:	EC9A2C5D8F56B6280F89F3BD323E7BE6
SHA1:	74A65A1B65126D978D08928F783E212E2AB1942F
SHA-256:	5B4B03841BE82E7CAD0B2E0C91D20C5F2CFF4357A7A1ECD0AAF29DCA593B7E6B
SHA-512:	4BC142C4EE17752824C7CC569AC4940E591FA82C35CE42271446AAF162BEEEAA35D8858402B758D8B9D3C36795F291E3A34AEC25BA3C2761783B7CD46EAD29CD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.9.:.1.6.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 19-16-26-739.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.352900235423584
Encrypted:	false
SSDEEP:	384:aYixaUPkXy4UfVjVw76L9er3kBDDsMcHk/z1t9TrwoXjRRPl0sL1g1cRjxr9oAt/:WLr
MD5:	39A871432A5080367DE00A7070E04A58
SHA1:	B7D8666315B9A8B40D705DD1E3071991482F040E
SHA-256:	BE14FBB5D6BFD764585C4F9F11B971303E38225B819B7BFB76EDAF9667193032
SHA-512:	32EA5AAEFE2B5729BA7605932133FE9CEF54D236F22F19F63B8574CCF75174AFB160E475D6FE44A54322DA1C5E0345118188EA99EDA231B854D83436346A34F2
Malicious:	false
Preview:	SessionID=5dcda64a-c549-4e87-87e4-c8b4b456b74e.1714151786767 Timestamp=2024-04-26T19:16:26:767+0200 ThreadID=3632 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5dcda64a-c549-4e87-87e4-c8b4b456b74e.1714151786767 Timestamp=2024-04-26T19:16:26:768+0200 ThreadID=3632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5dcda64a-c549-4e87-87e4-c8b4b456b74e.1714151786767 Timestamp=2024-04-26T19:16:26:768+0200 ThreadID=3632 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5dcda64a-c549-4e87-87e4-c8b4b456b74e.1714151786767 Timestamp=2024-04-26T19:16:26:768+0200 ThreadID=3632 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5dcda64a-c549-4e87-87e4-c8b4b456b74e.1714151786767 Timestamp=2024-04-26T19:16:26:768+0200 ThreadID=3632 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29845
Entropy (8bit):	5.398422874769609
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rr:H
MD5:	926C4153094950E34F15745B86E66210
SHA1:	4A69139A57C4718E6BB16318FC49E5A3FDAD6883
SHA-256:	66EFA11C59E90D0E7095294F575B6B00005B6924A56DB17EACF4F148F0943CD0
SHA-512:	E2DCEF4B309EAD9B18784FAA00D241E139F9FA75EE95CB50DD39F775297FB6593CEE57846ABFBD27E03881855B9738603F0B5205DBA957A054EA41FFECA73DDF
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29939e50-4cc1-4ae9-93da-cf356a7acac2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\68d5dc3c-31f0-421b-9bbd-874c6be50097.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\85458341-6ad1-4d83-bff4-628e0d396e9e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\cbe092d2-4ad6-4ca9-b516-c5e7e7546138.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1048)
Category:	downloaded
Size (bytes):	29591
Entropy (8bit):	4.436202631900466
Encrypted:	false
SSDEEP:	192:lHVYB4GEwZT1TpSGCeRH8u/Lj7Ma9xPcjBsvLNrqbVb+6JknFjlirg1qaR3H0ZP7:Y4V4iCqaRXTAC6
MD5:	BE7692F169C3A96A3E547E97775D722C
SHA1:	A732463A49B3F6A07ABCF6B462866C98C3766354
SHA-256:	52AFB16A4A7772F60E8D5683CBD6DC28515753995771E34EF708B53A86082D6E
SHA-512:	11C551790290196CF4C61CA5EE2DE3E79DE34CA4DA7D222716121F406501AB61AA692767C8BC9E5D2F5BF2D560AFDC06952D368929F2A194A3CD960DE0F7E5B2
Malicious:	false
URL:	https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa
Preview:	<!DOCTYPE html><html><head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Marketing Form</title>. <meta name="referrer" content="never">. <meta type="xrm/designer/setting" name="type" value="marketing-designer-content-editor-document">. <meta type="xrm/designer/setting" name="layout-editable" value="marketing-designer-layout-editable">. <style>. .editor-control-layout html {. box-sizing: border-box;. background-color: #fff;. }. .editor-control-layout ,. .editor-control-layout :before,. .editor-control-layout *:after {. box-sizing: inherit;. }.. .marketingForm h1 {. color: #000;. margin: 0px;. padding: 0px;. width: 100%;. font-family: "Segoe

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1048)
Category:	dropped
Size (bytes):	29591
Entropy (8bit):	4.436202631900466
Encrypted:	false
SSDEEP:	192:lHVYB4GEwZT1TpSGCeRH8u/Lj7Ma9xPcjBsvLNrqbVb+6JknFjlirg1qaR3H0ZP7:Y4V4iCqaRXTAC6
MD5:	BE7692F169C3A96A3E547E97775D722C
SHA1:	A732463A49B3F6A07ABCF6B462866C98C3766354
SHA-256:	52AFB16A4A7772F60E8D5683CBD6DC28515753995771E34EF708B53A86082D6E
SHA-512:	11C551790290196CF4C61CA5EE2DE3E79DE34CA4DA7D222716121F406501AB61AA692767C8BC9E5D2F5BF2D560AFDC06952D368929F2A194A3CD960DE0F7E5B2
Malicious:	false
Preview:	<!DOCTYPE html><html><head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Marketing Form</title>. <meta name="referrer" content="never">. <meta type="xrm/designer/setting" name="type" value="marketing-designer-content-editor-document">. <meta type="xrm/designer/setting" name="layout-editable" value="marketing-designer-layout-editable">. <style>. .editor-control-layout html {. box-sizing: border-box;. background-color: #fff;. }. .editor-control-layout ,. .editor-control-layout :before,. .editor-control-layout *:after {. box-sizing: inherit;. }.. .marketingForm h1 {. color: #000;. margin: 0px;. padding: 0px;. width: 100%;. font-family: "Segoe

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.68425644587903
Encrypted:	false
SSDEEP:	24:mioTJODICcnv8cKoexKc846vgBie9ZY8mlvOq8RvLNHVENggeGg:micaIPU7oeoc8xYBfmlgRjNOen
MD5:	DBAC2EBFBE18E8C7CF3830AF4C420E77
SHA1:	78ADD1C663DD8B4AD6BBF89E48376015EA08A85A
SHA-256:	491377DB69C365D489C88BD4AC641D341B52E6A70B034390A5FC3D161268BCA5
SHA-512:	7DBFFD0FB6EC417AB7481919357D20D78224C9B97D180B603CFCD8F8808EA8FD54A4D15103178C15A985C563BE80CBBB6391E58D06C42F1062DF0948E79F7880
Malicious:	false
Preview:	{.. "FormFailedToLoad": "Failed to load form",.. "FormFailedToLoadCors": "The form can not be loaded on a domain that hasn't been allowed for external form hosting or there is a network connectivity issue",.. "LearnMore": "Learn more",.. "FormSubmitted": "Form submitted",.. "FormSubmitError": "Error submitting the form",.. "Reload": "Reload",.. "LookupLoading": "loading...",.. "LookupGenericError": "There was a problem retrieving items. Try again later.",.. "ValidationRequiredField": "This field is required",.. "EventFailedToLoad": "Failed to load event.",.. "EventAtCapacity": "This event is no longer accepting registrations.",.. "EventNotLive": "We are still setting up this event. Please check again in some time or contact the event organizer ",.. "SubmissionErrorEventNotLive": "Registrations for this event have been closed. We look forward to seeing you at our next event.",.. "SubmissionErrorEventCapacityIsFull": "Registrations for this event have been closed. We.re a

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
URL:	https://assets-usa.mkt.dynamics.com/favicon.ico
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1304
Entropy (8bit):	4.68425644587903
Encrypted:	false
SSDEEP:	24:mioTJODICcnv8cKoexKc846vgBie9ZY8mlvOq8RvLNHVENggeGg:micaIPU7oeoc8xYBfmlgRjNOen
MD5:	DBAC2EBFBE18E8C7CF3830AF4C420E77
SHA1:	78ADD1C663DD8B4AD6BBF89E48376015EA08A85A
SHA-256:	491377DB69C365D489C88BD4AC641D341B52E6A70B034390A5FC3D161268BCA5
SHA-512:	7DBFFD0FB6EC417AB7481919357D20D78224C9B97D180B603CFCD8F8808EA8FD54A4D15103178C15A985C563BE80CBBB6391E58D06C42F1062DF0948E79F7880
Malicious:	false
URL:	https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/public/locales/en-us/translation.json
Preview:	{.. "FormFailedToLoad": "Failed to load form",.. "FormFailedToLoadCors": "The form can not be loaded on a domain that hasn't been allowed for external form hosting or there is a network connectivity issue",.. "LearnMore": "Learn more",.. "FormSubmitted": "Form submitted",.. "FormSubmitError": "Error submitting the form",.. "Reload": "Reload",.. "LookupLoading": "loading...",.. "LookupGenericError": "There was a problem retrieving items. Try again later.",.. "ValidationRequiredField": "This field is required",.. "EventFailedToLoad": "Failed to load event.",.. "EventAtCapacity": "This event is no longer accepting registrations.",.. "EventNotLive": "We are still setting up this event. Please check again in some time or contact the event organizer ",.. "SubmissionErrorEventNotLive": "Registrations for this event have been closed. We look forward to seeing you at our next event.",.. "SubmissionErrorEventCapacityIsFull": "Registrations for this event have been closed. We.re a

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	491
Entropy (8bit):	5.056844075174177
Encrypted:	false
SSDEEP:	12:s8+zaYiE8//qvShdeoi22d6eyzaYch6BAdexMAdb:WXy/ivmdeop2dNiVAdexbb
MD5:	11BD5E37248199B16D03E2421C1EBAE2
SHA1:	91F7220D2AAC7172F0EBF2096D8DB69BA3FD0694
SHA-256:	D672D2E402207FD53AB65E60BF65B2FC671BC4B873A7F4F50C34D18DD7922336
SHA-512:	506B3F55241C55CCE625E44FCDBB020A7923043C0103DDCB0573FC9F75491B9FFF9F40078CF3A11D049630F2BEC5DB28D30705B7ECFF1501A828BAAC499AC2F9
Malicious:	false
URL:	https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa
Preview:	<div. data-form-id='b99e27b7-9f00-ef11-a1fd-6045bddb1daa'. data-form-api-url='https://public-usa.mkt.dynamics.com/api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms'. data-cached-form-url='https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa' ></div>. <script src = 'https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/FormLoader.bundle.js' ></script>

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 299 x 168, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5802
Entropy (8bit):	7.938400902817674
Encrypted:	false
SSDEEP:	96:47hYQimms93/8gB0I0LMIlXeuitz5iMhOw2WwyvZeNqrthpCH9gkBbg7:+GH/vI0LdtIzfsw2WJZSqrBCdVBG
MD5:	CB9FCB4735E5BCDB4E78B9C4CD9DCD87
SHA1:	4EEB2133259EB73F3FEC9538394F4757A14B8591
SHA-256:	4A3456E5E51B4086FF5F1163245120E3148E11AD8733C51311ED4DDDD660D206
SHA-512:	15CEA6A90EAF4B1C970CAF25BC9E755077DD85C5CD6236FD60DC17A807D2DCD1DFF06E5886233DC2D589CDA7A74AB29D1EE2012C1884082E21CE401659AD89F3
Malicious:	false
URL:	https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250
Preview:	.PNG........IHDR...+..........)8D...#PLTE....J...........F.......Lp..J..:..F..@........=..........+Z..A.....<..<.Ak..........B.d..;d..@.....L....^~.k......A..8.....6.....:..2..K.......Ft..:.......g.../..........9i..?.s............^.Cp....b...........s....p..+b....Q......N........H.h.....2........%^.....[~..V.Rz.5.....BIDATx...{...mI....%6 ..6Pp!@.@h.L..Y..2......+.d.....N..G.tf\.e...9G.......p8.....p8.....p8.....p8.....p8.....p8.....p... @..u-....ch..Z.3.z.D/..x..Y....i.....!@~u../.n.UO...z{.._].gK._w.....h.....=+.@.,....7].CQ..c,......W...?.A...z.@.....`.h..%..@..,c...#../..#........_.p.....>......../.8x... .:.M.D..}L...v?.f..._k.........'B..U...t. ..e.b.....c]a.].\|...M.......Q.l.>.$_....2....=Q....T=...U..%...m...B%-...S..`o.bI".s&.jF.lK.GZ...{ZN .D^.8..VMOS.L.....R.TQ.4..9......S.-..P..?;@.=?.}Q.5.E.Z.Y{...........{]V.J......W...I.[......F.7.....Y.A...m....?y..Z.v.5i..v.Dk.;h......^...;..h7&n.4.."..."L+.. .c.@....1..'.V...\........di..

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 299 x 168, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5802
Entropy (8bit):	7.938400902817674
Encrypted:	false
SSDEEP:	96:47hYQimms93/8gB0I0LMIlXeuitz5iMhOw2WwyvZeNqrthpCH9gkBbg7:+GH/vI0LdtIzfsw2WJZSqrBCdVBG
MD5:	CB9FCB4735E5BCDB4E78B9C4CD9DCD87
SHA1:	4EEB2133259EB73F3FEC9538394F4757A14B8591
SHA-256:	4A3456E5E51B4086FF5F1163245120E3148E11AD8733C51311ED4DDDD660D206
SHA-512:	15CEA6A90EAF4B1C970CAF25BC9E755077DD85C5CD6236FD60DC17A807D2DCD1DFF06E5886233DC2D589CDA7A74AB29D1EE2012C1884082E21CE401659AD89F3
Malicious:	false
Preview:	.PNG........IHDR...+..........)8D...#PLTE....J...........F.......Lp..J..:..F..@........=..........+Z..A.....<..<.Ak..........B.d..;d..@.....L....^~.k......A..8.....6.....:..2..K.......Ft..:.......g.../..........9i..?.s............^.Cp....b...........s....p..+b....Q......N........H.h.....2........%^.....[~..V.Rz.5.....BIDATx...{...mI....%6 ..6Pp!@.@h.L..Y..2......+.d.....N..G.tf\.e...9G.......p8.....p8.....p8.....p8.....p8.....p8.....p... @..u-....ch..Z.3.z.D/..x..Y....i.....!@~u../.n.UO...z{.._].gK._w.....h.....=+.@.,....7].CQ..c,......W...?.A...z.@.....`.h..%..@..,c...#../..#........_.p.....>......../.8x... .:.M.D..}L...v?.f..._k.........'B..U...t. ..e.b.....c]a.].\|...M.......Q.l.>.$_....2....=Q....T=...U..%...m...B%-...S..`o.bI".s&.jF.lK.GZ...{ZN .D^.8..VMOS.L.....R.TQ.4..9......S.-..P..?;@.=?.}Q.5.E.Z.Y{...........{]V.J......W...I.[......F.7.....Y.A...m....?y..Z.v.5i..v.Dk.;h......^...;..h7&n.4.."..."L+.. .c.@....1..'.V...\........di..

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65461)
Category:	downloaded
Size (bytes):	711081
Entropy (8bit):	5.444336573525724
Encrypted:	false
SSDEEP:	3072:Ns0tPO7ZVKF61InSjikH0Gu0r2ee6PnBdHQdU1HECHttsMkO3bBqMG/+9coZukG6:N7tPOCWPQdUzCO3bBL9jZVGiMRlRhxkR
MD5:	FDC2BE4EB54FF521EB5F6CA57AEDAE03
SHA1:	580FEFB1274BB5A21E34DC206D3F042512CA2EDC
SHA-256:	36C366BC39F4B2EB17CC2EAC87B9B94199CB4DFC0FF9F3D8A2F4C2EADE1BB9C3
SHA-512:	42939CBF474C6593774F5B5FF13A5E9FCDDE7CAAE05229CBE9804C1368337B892EB3ED96CA85133A34AC0551696B4995EA203773B474BF31E50780BF9BDD53C2
Malicious:	false
URL:	https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/usa/FormLoader/FormLoader.bundle.js
Preview:	/! For license information please see FormLoader.bundle.js.LICENSE.txt /.var d365mktforms;(()=>{var e,t,n={317:function(e,t){var n="undefined"!=typeof self?self:this,r=function(){function e(){this.fetch=!1,this.DOMException=n.DOMException}return e.prototype=n,new e}();!function(e){!function(t){var n="URLSearchParams"in e,r="Symbol"in e&&"iterator"in Symbol,i="FileReader"in e&&"Blob"in e&&function(){try{return new Blob,!0}catch(e){return!1}}(),a="FormData"in e,o="ArrayBuffer"in e;if(o)var s=["[object Int8Array]","[object Uint8Array]","[object Uint8ClampedArray]","[object Int16Array]","[object Uint16Array]","[object Int32Array]","[object Uint32Array]","[object Float32Array]","[object Float64Array]"],u=ArrayBuffer.isView\|\|function(e){return e&&s.indexOf(Object.prototype.toString.call(e))>-1};function c(e){if("string"!=typeof e&&(e=String(e)),/[^a-z0-9\-#$%&'*+.^_`\|~]/i.test(e))throw new TypeError("Invalid character in header field name");return e.toLowerCase()}function l(e){return"strin

Static File Info

General

File type:	PDF document, version 1.3, 1 pages
Entropy (8bit):	7.977854623222528
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	ACRMNT.pdf
File size:	143'638 bytes
MD5:	44159aca23f90b1cabf0005a7975f77c
SHA1:	8fe88115faaa0c3bda916d9e375588443fc10199
SHA256:	01109b3bc2fa06f9c6d47bda68d49ffed38556b9b18d978ef2fc576704df31ae
SHA512:	498597fa1b92c9862d7d0b1a59c27e1353ee7e154301203ba77bc64ade9dc11faf0e954648eb46ea63a6f272da5d3ab6e478a34fb080d0deb097b4a2bc09c5d2
SSDEEP:	3072:lP3YuN0HLCNhtbC0CrZXcgcfjfZ7kqzXW3lYnXp/ahi2Xofbvi:Z3YudNm0CdpcfjfZhXW3lYnXp6i24zK
TLSH:	88E302A8E109981DF690CA53A92638CBBD5C73D305C934C23574DA5EF607960AB337EB
File Content Preview:	%PDF-1.3.%............3 0 obj.<< /Filter /FlateDecode /Length 1862 >>.stream.x..Y...6.}.W(.....jE].4.%.C........b. -v.&i....\|wv<i0...e...!)...I....$.H8...1..a\|-..F.......(......^..?.?qG....++H..kA.I....i..................<K...~...n..w...............$.>...

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.3
Total Entropy:	7.977855
Total Bytes:	143638
Stream Entropy:	7.996395
Stream Bytes:	135336
Entropy outside Streams:	5.131631
Bytes outside Streams:	8302
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	49
endobj	49
stream	24
endstream	24
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
5	0000000000000000	9c6da10117896a9337ef124f3eca38f0
23	0000000000000000	d04c7799b8e8387ba6e8cbf142c66529
24	0000000000000000	56f3dc58f5a04c8ab5a527809a1efc58
25	0000000000000000	c1ed9b7c235033e21c3d1c2ba27a3425
26	a0a0a1a0a0a080a2	6f6d56c74d77e9828138d59a4cf9b941

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 19:16:19.564377069 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 19:16:29.306142092 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 19:16:32.542345047 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.542380095 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:32.542474985 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.544454098 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.544466972 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:32.808928967 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:32.809031010 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.812242985 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.812258959 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:32.812572956 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:32.847299099 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:32.888135910 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:33.051238060 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:33.051312923 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:33.051439047 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.248541117 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.248564959 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.248585939 CEST	49738	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.248590946 CEST	443	49738	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.629024982 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.629066944 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.629196882 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.630219936 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.630234957 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.893832922 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.894072056 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.917165041 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.917184114 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.918119907 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:34.919121027 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:34.960122108 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:35.142760992 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:35.142868042 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:35.142936945 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:35.143786907 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:35.143814087 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:35.143826008 CEST	49739	443	192.168.2.4	23.204.76.112
Apr 26, 2024 19:16:35.143832922 CEST	443	49739	23.204.76.112	192.168.2.4
Apr 26, 2024 19:16:36.063812971 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.063858032 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.063950062 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.064146042 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.064155102 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.461498022 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.461791992 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.461811066 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.462830067 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.462932110 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.469221115 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.469296932 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.469507933 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.469523907 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.510474920 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.632328987 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.632414103 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.632631063 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.632900000 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.632900000 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:36.632930040 CEST	443	49740	104.94.108.142	192.168.2.4
Apr 26, 2024 19:16:36.633104086 CEST	49740	443	192.168.2.4	104.94.108.142
Apr 26, 2024 19:16:41.904505968 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:41.904542923 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:41.904623032 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:41.905829906 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:41.905842066 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:42.529988050 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:42.530086040 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:42.532545090 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:42.532555103 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:42.532846928 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:42.572974920 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:42.989480972 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:42.997692108 CEST	49723	80	192.168.2.4	23.45.182.102
Apr 26, 2024 19:16:43.036117077 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.125773907 CEST	80	49723	23.45.182.102	192.168.2.4
Apr 26, 2024 19:16:43.125893116 CEST	49723	80	192.168.2.4	23.45.182.102
Apr 26, 2024 19:16:43.430260897 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430326939 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430349112 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430387974 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430442095 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430474043 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.430501938 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430514097 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.430543900 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.430607080 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430696011 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.430702925 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430820942 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.430883884 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.450938940 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.450978994 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:43.450995922 CEST	49741	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:16:43.451004028 CEST	443	49741	20.114.59.183	192.168.2.4
Apr 26, 2024 19:16:51.915466070 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:51.915481091 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:51.915544987 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:51.916512966 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:51.916524887 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.389409065 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.389780045 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:52.389795065 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.391315937 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.391459942 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:52.392813921 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:52.392899036 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.393064022 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:52.393069029 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:52.443619013 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:55.738158941 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:55.738234043 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:55.738281965 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:55.749993086 CEST	49749	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:16:55.750011921 CEST	443	49749	52.146.76.30	192.168.2.4
Apr 26, 2024 19:16:55.931727886 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:55.931770086 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:55.931843042 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:55.932048082 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:55.932065010 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.024115086 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.024156094 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.024241924 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.024419069 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.024431944 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.337172985 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.337531090 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:56.337563992 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.338826895 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.338888884 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:56.339947939 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:56.340018034 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.340146065 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:56.340153933 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:56.367866039 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.368103981 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.368117094 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.369540930 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.369601011 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.370584011 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.370673895 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.392334938 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:56.423163891 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:56.423188925 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:16:56.469372034 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:16:57.785814047 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:57.786042929 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:57.786145926 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:57.787148952 CEST	49751	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:57.787188053 CEST	443	49751	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:57.976454973 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:57.976502895 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:57.976594925 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:57.976833105 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:57.976847887 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.377536058 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.379196882 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.379223108 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.380367994 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.380446911 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.381519079 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.381593943 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.381726027 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.381738901 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.422517061 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.785356998 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785423994 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785475016 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785500050 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.785505056 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785531044 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.785540104 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785554886 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.785607100 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.785619974 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.785674095 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.786329985 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.786359072 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.786401033 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.786413908 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.786427021 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.786448956 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.915584087 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.915611029 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.915699005 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.915721893 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.915806055 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.916373014 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.916402102 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.916441917 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.916449070 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.916467905 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.916486979 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.917098045 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.917118073 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.917166948 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:58.917172909 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:58.917212963 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.037029028 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.037066936 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.037175894 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.037199974 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.037242889 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042128086 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042188883 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042212963 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042232037 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042247057 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042275906 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042531967 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042551994 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042582035 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042588949 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.042612076 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.042632103 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043045044 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043065071 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043103933 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043109894 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043133974 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043155909 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043428898 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043451071 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043489933 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043494940 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043519020 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043534040 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043839931 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043859959 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043891907 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043898106 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.043921947 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.043936968 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.044411898 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.044431925 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.044488907 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.044496059 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.044536114 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.162499905 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.162535906 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.162836075 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.162858963 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.162918091 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.166083097 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.166114092 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.166166067 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.166178942 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.166197062 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.166213989 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.173230886 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.173259974 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.173300028 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.173316002 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.173342943 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.173358917 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.174504042 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.174529076 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.174581051 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.174591064 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.174616098 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.174637079 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.175620079 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.175642014 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.175683022 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.175693035 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.175717115 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.175734997 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.176500082 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.176525116 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.176563978 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.176573038 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.176625967 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.176625967 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.177601099 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.177623987 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.177680016 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.177692890 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.177747965 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.178392887 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.178412914 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.178464890 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.178474903 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.178510904 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.178528070 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.179312944 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.179336071 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.179378986 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.179389000 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.179424047 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.180417061 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.180439949 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.180504084 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.180517912 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.180556059 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.181447029 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.181467056 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.181499958 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.181510925 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.181533098 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.181549072 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.182634115 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.182657957 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.182689905 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.182699919 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.182723045 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.182735920 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.183626890 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.183650970 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.183686018 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.183693886 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.183722019 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.183728933 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.184514046 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.184536934 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.184577942 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.184583902 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.184608936 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.184624910 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287540913 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287570953 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287620068 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287633896 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287663937 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287691116 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287823915 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287854910 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287882090 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287890911 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.287916899 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.287939072 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.292557955 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292577028 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292640924 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.292649031 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292671919 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.292685032 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.292769909 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292788982 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292834997 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.292841911 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.292881012 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.298213005 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.298232079 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.298305988 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.298314095 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.298363924 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.298979044 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299005985 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299047947 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.299055099 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299074888 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.299098015 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.299643040 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299662113 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299707890 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.299715996 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.299762964 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.300400972 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.300421000 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.300532103 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.300544024 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.300580978 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.300580978 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.301399946 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.301419020 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.301476002 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.301482916 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.301533937 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302192926 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302220106 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302243948 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302249908 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302268982 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302293062 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302858114 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302876949 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302917004 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302922010 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.302946091 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.302964926 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.303471088 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.303489923 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.303528070 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.303534985 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.303555012 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.303576946 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.304081917 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.304110050 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.304131031 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.304136038 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.304155111 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.304177046 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.304908037 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.304927111 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.304989100 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.304996014 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.305032015 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.305663109 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.305681944 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.305720091 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.305726051 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.305742979 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.305766106 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306094885 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306113958 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306144953 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306152105 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306174040 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306194067 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306529999 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306554079 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306587934 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306593895 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306617022 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306636095 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306649923 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306698084 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306703091 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306742907 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.306747913 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.306788921 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.307203054 CEST	49753	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.307220936 CEST	443	49753	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.330478907 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.330521107 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.330619097 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.330946922 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.330957890 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.336705923 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.336745977 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.336816072 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.337508917 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.337526083 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.353493929 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.353585005 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.353684902 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.353935003 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.353971958 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.715048075 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.722878933 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.733335018 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:16:59.768162012 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.768168926 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:16:59.783776045 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.838655949 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.838720083 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.838747025 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.838782072 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.838932037 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.838956118 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.839301109 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.839868069 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.840029955 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.840096951 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.840922117 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.841021061 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.841191053 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.841383934 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.841423035 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.841495991 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.842160940 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.842243910 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.842252016 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.842259884 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:00.884121895 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.884126902 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:00.894639969 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.025434971 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.025744915 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.025877953 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.070888996 CEST	49755	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.070897102 CEST	443	49755	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.161339045 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.161425114 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.161523104 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.194433928 CEST	49754	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.194463015 CEST	443	49754	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.260570049 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.260623932 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.260711908 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.270632982 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.270661116 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.650808096 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.651179075 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.651206970 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.652221918 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.652333975 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.652601957 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.652650118 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.652753115 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.652760029 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.668930054 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.668957949 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.668966055 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.668997049 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669027090 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669081926 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.669095039 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669161081 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.669668913 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669699907 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669723034 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.669728041 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669743061 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.669745922 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.669763088 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.669790030 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.670890093 CEST	49756	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.670902967 CEST	443	49756	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.678919077 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.678951979 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.679160118 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.679220915 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.679234028 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.680340052 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:01.680361986 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:01.680428982 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:01.680932045 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:01.680943012 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:01.699203014 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.846548080 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.846591949 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:01.846681118 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.846895933 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:01.846908092 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.062747955 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.063133001 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.063158035 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.063492060 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.063836098 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.063899994 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.064009905 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.094067097 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.094147921 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.094234943 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.095619917 CEST	49757	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.095638990 CEST	443	49757	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.104108095 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.141907930 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:02.142146111 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:02.142158031 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:02.143198967 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:02.143260956 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:02.143654108 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:02.143712044 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:02.143852949 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:02.143858910 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:02.188316107 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:02.229886055 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.230232000 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.230252028 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.231275082 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.231333017 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.231662989 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.231722116 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.231810093 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.231816053 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.282022953 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.736217022 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736249924 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736259937 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736277103 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736310959 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736352921 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.736382008 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736394882 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.736428976 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.736882925 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.736943007 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.738358021 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.738429070 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.738435030 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.738468885 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:02.738509893 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.738598108 CEST	49760	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:02.738611937 CEST	443	49760	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:03.140336037 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.140562057 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.140748978 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.140980959 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.141001940 CEST	443	49759	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.141015053 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.141052961 CEST	49759	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.142364025 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.142385006 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.142452955 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.142771006 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.142782927 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.609498978 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.655723095 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.655751944 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.656435013 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.703880072 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.715348005 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.715533018 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:03.766402006 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.843096018 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:03.884123087 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:04.336982965 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:04.337093115 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:04.337150097 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:04.732960939 CEST	49761	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:04.732988119 CEST	443	49761	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:04.917599916 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:04.917638063 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:04.917697906 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:04.917932034 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:04.917944908 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.007260084 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.007292032 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.007328033 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.007365942 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.007405996 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.007430077 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.034152985 CEST	49758	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.034188986 CEST	443	49758	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.268475056 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.268523932 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.268599987 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.268879890 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.268910885 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.380727053 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.381079912 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.381104946 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.382586002 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.382658005 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.382991076 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.383066893 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.383120060 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.383126020 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.438029051 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.544076920 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.544187069 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.544279099 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.544816017 CEST	49762	443	192.168.2.4	52.146.76.30
Apr 26, 2024 19:17:05.544826031 CEST	443	49762	52.146.76.30	192.168.2.4
Apr 26, 2024 19:17:05.649175882 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.649557114 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.649590015 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.649938107 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.650248051 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.650336981 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.650434017 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.692118883 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.902117014 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.902152061 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.902194977 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.902225971 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:05.902286053 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.902306080 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.903629065 CEST	49763	443	192.168.2.4	13.107.246.41
Apr 26, 2024 19:17:05.903646946 CEST	443	49763	13.107.246.41	192.168.2.4
Apr 26, 2024 19:17:06.366010904 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:06.366091013 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:06.366170883 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:06.641949892 CEST	49752	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:06.641988993 CEST	443	49752	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:20.964040041 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:20.964081049 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:20.964175940 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:20.964585066 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:20.964600086 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:21.579583883 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:21.579653978 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:21.584186077 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:21.584204912 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:21.584429026 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:21.594180107 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:21.640115976 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.185189009 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.185215950 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.185234070 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.185451984 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:22.185482025 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.185615063 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:22.190092087 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:22.190125942 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:22.190139055 CEST	49771	443	192.168.2.4	20.114.59.183
Apr 26, 2024 19:17:22.190145016 CEST	443	49771	20.114.59.183	192.168.2.4
Apr 26, 2024 19:17:55.956273079 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:55.956321955 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:55.956404924 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:55.956666946 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:55.956685066 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:56.286442041 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:56.286747932 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:56.286765099 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:56.287221909 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:56.287518024 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:17:56.287605047 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:17:56.328790903 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:06.275794983 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:06.275901079 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:06.275986910 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:08.105245113 CEST	49773	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:08.105278015 CEST	443	49773	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.012377024 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:56.012428999 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.012522936 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:56.012857914 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:56.012868881 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.343533039 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.344341040 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:56.344369888 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.344705105 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.345613956 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:18:56.345676899 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:18:56.399952888 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:19:06.357028008 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:19:06.357115984 CEST	443	49775	142.250.189.132	192.168.2.4
Apr 26, 2024 19:19:06.357211113 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:19:08.107634068 CEST	49775	443	192.168.2.4	142.250.189.132
Apr 26, 2024 19:19:08.107660055 CEST	443	49775	142.250.189.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 19:16:43.548587084 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 19:16:51.669594049 CEST	59721	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:51.669969082 CEST	49975	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:51.795423031 CEST	53	54543	1.1.1.1	192.168.2.4
Apr 26, 2024 19:16:51.819345951 CEST	53	61032	1.1.1.1	192.168.2.4
Apr 26, 2024 19:16:52.748346090 CEST	53	60604	1.1.1.1	192.168.2.4
Apr 26, 2024 19:16:55.762533903 CEST	49834	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:55.762533903 CEST	53477	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:55.897049904 CEST	50031	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:55.897399902 CEST	61699	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:16:56.022670031 CEST	53	50031	1.1.1.1	192.168.2.4
Apr 26, 2024 19:16:56.023099899 CEST	53	61699	1.1.1.1	192.168.2.4
Apr 26, 2024 19:17:01.678230047 CEST	50244	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:17:01.678421021 CEST	56256	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:17:04.759613991 CEST	56217	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:17:04.759762049 CEST	59578	53	192.168.2.4	1.1.1.1
Apr 26, 2024 19:17:06.768456936 CEST	53	51847	1.1.1.1	192.168.2.4
Apr 26, 2024 19:17:11.396409988 CEST	53	59588	1.1.1.1	192.168.2.4
Apr 26, 2024 19:17:30.273169994 CEST	53	61799	1.1.1.1	192.168.2.4
Apr 26, 2024 19:17:51.647015095 CEST	53	65003	1.1.1.1	192.168.2.4
Apr 26, 2024 19:17:53.129440069 CEST	53	63291	1.1.1.1	192.168.2.4
Apr 26, 2024 19:18:19.653497934 CEST	53	52128	1.1.1.1	192.168.2.4
Apr 26, 2024 19:19:05.043214083 CEST	53	55793	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 19:17:04.989425898 CEST	192.168.2.4	1.1.1.1	c2bd	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 19:16:51.669594049 CEST	192.168.2.4	1.1.1.1	0xb612	Standard query (0)	public-usa.mkt.dynamics.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:51.669969082 CEST	192.168.2.4	1.1.1.1	0x8475	Standard query (0)	public-usa.mkt.dynamics.com	65	IN (0x0001)	false
Apr 26, 2024 19:16:55.762533903 CEST	192.168.2.4	1.1.1.1	0x8044	Standard query (0)	assets-usa.mkt.dynamics.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:55.762533903 CEST	192.168.2.4	1.1.1.1	0x845a	Standard query (0)	assets-usa.mkt.dynamics.com	65	IN (0x0001)	false
Apr 26, 2024 19:16:55.897049904 CEST	192.168.2.4	1.1.1.1	0xde52	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:55.897399902 CEST	192.168.2.4	1.1.1.1	0xf163	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 19:17:01.678230047 CEST	192.168.2.4	1.1.1.1	0x4928	Standard query (0)	assets-usa.mkt.dynamics.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.678421021 CEST	192.168.2.4	1.1.1.1	0xa619	Standard query (0)	assets-usa.mkt.dynamics.com	65	IN (0x0001)	false
Apr 26, 2024 19:17:04.759613991 CEST	192.168.2.4	1.1.1.1	0xa783	Standard query (0)	public-usa.mkt.dynamics.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:04.759762049 CEST	192.168.2.4	1.1.1.1	0xd485	Standard query (0)	public-usa.mkt.dynamics.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 19:16:51.882383108 CEST	1.1.1.1	192.168.2.4	0x8475	No error (0)	public-usa.mkt.dynamics.com	cxppusa1im4t7x7z5iubq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:51.882383108 CEST	1.1.1.1	192.168.2.4	0x8475	No error (0)	public-prdia888eus0aks.mkt.dynamics.com	prdia888eus0aks.mkt.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:51.909508944 CEST	1.1.1.1	192.168.2.4	0xb612	No error (0)	public-usa.mkt.dynamics.com	cxppusa1im4t7x7z5iubq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:51.909508944 CEST	1.1.1.1	192.168.2.4	0xb612	No error (0)	public-prdia888eus0aks.mkt.dynamics.com	prdia888eus0aks.mkt.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:51.909508944 CEST	1.1.1.1	192.168.2.4	0xb612	No error (0)	prdia888eus0aks.mkt.dynamics.com		52.146.76.30	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:55.889184952 CEST	1.1.1.1	192.168.2.4	0x8044	No error (0)	assets-usa.mkt.dynamics.com	assets-mkt-usa.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:55.889184952 CEST	1.1.1.1	192.168.2.4	0x8044	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:55.889184952 CEST	1.1.1.1	192.168.2.4	0x8044	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:55.889184952 CEST	1.1.1.1	192.168.2.4	0x8044	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:55.929430008 CEST	1.1.1.1	192.168.2.4	0x845a	No error (0)	assets-usa.mkt.dynamics.com	assets-mkt-usa.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:56.022670031 CEST	1.1.1.1	192.168.2.4	0xde52	No error (0)	www.google.com		142.250.189.132	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:56.023099899 CEST	1.1.1.1	192.168.2.4	0xf163	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 19:16:57.975872993 CEST	1.1.1.1	192.168.2.4	0x1cb	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:16:57.975872993 CEST	1.1.1.1	192.168.2.4	0x1cb	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:16:57.975872993 CEST	1.1.1.1	192.168.2.4	0x1cb	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.253418922 CEST	1.1.1.1	192.168.2.4	0xb70c	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:01.253418922 CEST	1.1.1.1	192.168.2.4	0xb70c	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.253418922 CEST	1.1.1.1	192.168.2.4	0xb70c	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.844679117 CEST	1.1.1.1	192.168.2.4	0x4928	No error (0)	assets-usa.mkt.dynamics.com	assets-mkt-usa.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:01.844679117 CEST	1.1.1.1	192.168.2.4	0x4928	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:01.844679117 CEST	1.1.1.1	192.168.2.4	0x4928	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.844679117 CEST	1.1.1.1	192.168.2.4	0x4928	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:01.845983982 CEST	1.1.1.1	192.168.2.4	0xa619	No error (0)	assets-usa.mkt.dynamics.com	assets-mkt-usa.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:04.886209011 CEST	1.1.1.1	192.168.2.4	0xa783	No error (0)	public-usa.mkt.dynamics.com	cxppusa1im4t7x7z5iubq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:04.886209011 CEST	1.1.1.1	192.168.2.4	0xa783	No error (0)	public-prdia888eus0aks.mkt.dynamics.com	prdia888eus0aks.mkt.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:04.886209011 CEST	1.1.1.1	192.168.2.4	0xa783	No error (0)	prdia888eus0aks.mkt.dynamics.com		52.146.76.30	A (IP address)	IN (0x0001)	false
Apr 26, 2024 19:17:04.989305019 CEST	1.1.1.1	192.168.2.4	0xd485	No error (0)	public-usa.mkt.dynamics.com	cxppusa1im4t7x7z5iubq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 19:17:04.989305019 CEST	1.1.1.1	192.168.2.4	0xd485	No error (0)	public-prdia888eus0aks.mkt.dynamics.com	prdia888eus0aks.mkt.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

armmf.adobe.com

slscr.update.microsoft.com

public-usa.mkt.dynamics.com

assets-usa.mkt.dynamics.com

https:

cxppusa1formui01cdnsa01-endpoint.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:16:33 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=49633 Date: Fri, 26 Apr 2024 17:16:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:34 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 17:16:35 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=49624 Date: Fri, 26 Apr 2024 17:16:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 17:16:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	104.94.108.142	443	7700	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:36 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-04-26 17:16:36 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 26 Apr 2024 17:16:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:42 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vkF+oXvDPKsCOPm&MD=HWVEBc5B HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:16:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2649b30e-2a02-4629-9b15-d12fe1e064dd MS-RequestId: a00002af-6aec-4696-918a-40faa333aa1e MS-CV: /m+UEDxMUEehloeT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:16:42 GMT Connection: close Content-Length: 24490
2024-04-26 17:16:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 17:16:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	52.146.76.30	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:52 UTC	745	OUT	GET /api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA HTTP/1.1 Host: public-usa.mkt.dynamics.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:16:55 UTC	460	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 26 Apr 2024 17:16:55 GMT Content-Length: 0 Connection: close Location: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa#msdynmkt_trackingcontext=89e184cd-4b42-4d05-891c-d646800c35ab x-ms-trace-id: 6deb889ccafccc8ac3f47da16ad20be5 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:56 UTC	773	OUT	GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:16:57 UTC	495	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:16:57 GMT Content-Type: text/html Content-Length: 491 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=900, must-revalidate x-ms-trace-id: 8c024cb7eb6996444e2d24db97a5e599 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff x-azure-ref: 20240426T171656Z-1865489d5f46s4qnhr87brpyc40000000abg000000013cwt x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:16:57 UTC	491	IN	Data Raw: 3c 64 69 76 0a 20 20 20 20 20 20 20 20 64 61 74 61 2d 66 6f 72 6d 2d 69 64 3d 27 62 39 39 65 32 37 62 37 2d 39 66 30 30 2d 65 66 31 31 2d 61 31 66 64 2d 36 30 34 35 62 64 64 62 31 64 61 61 27 0a 20 20 20 20 20 20 20 20 64 61 74 61 2d 66 6f 72 6d 2d 61 70 69 2d 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 70 75 62 6c 69 63 2d 75 73 61 2e 6d 6b 74 2e 64 79 6e 61 6d 69 63 73 2e 63 6f 6d 2f 61 70 69 2f 76 31 2e 30 2f 6f 72 67 73 2f 35 32 66 35 32 37 63 38 2d 35 61 66 64 2d 65 65 31 31 2d 39 30 34 38 2d 30 30 30 64 33 61 31 30 36 38 33 37 2f 6c 61 6e 64 69 6e 67 70 61 67 65 66 6f 72 6d 73 27 0a 20 20 20 20 20 20 20 20 64 61 74 61 2d 63 61 63 68 65 64 2d 66 6f 72 6d 2d 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2d 75 73 61 2e 6d 6b 74 2e 64 79 6e 61 6d Data Ascii: <div data-form-id='b99e27b7-9f00-ef11-a1fd-6045bddb1daa' data-form-api-url='https://public-usa.mkt.dynamics.com/api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms' data-cached-form-url='https://assets-usa.mkt.dynam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:16:58 UTC	592	OUT	GET /usa/FormLoader/FormLoader.bundle.js HTTP/1.1 Host: cxppusa1formui01cdnsa01-endpoint.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://assets-usa.mkt.dynamics.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:16:58 UTC	636	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:16:58 GMT Content-Type: application/javascript Content-Length: 711081 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 27 Feb 2024 09:22:18 GMT ETag: 0x8DC3775981D513B x-ms-request-id: ac1df01d-101e-009d-6ceb-9735f4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * x-azure-ref: 20240426T171658Z-1865489d5f4c7br6veundbra3w000000017g00000000hmyq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-04-26 17:16:58 UTC	15748	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 46 6f 72 6d 4c 6f 61 64 65 72 2e 62 75 6e 64 6c 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 76 61 72 20 64 33 36 35 6d 6b 74 66 6f 72 6d 73 3b 28 28 29 3d 3e 7b 76 61 72 20 65 2c 74 2c 6e 3d 7b 33 31 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 74 68 69 73 2e 66 65 74 63 68 3d 21 31 2c 74 68 69 73 2e 44 4f 4d 45 78 63 65 70 74 69 6f 6e 3d 6e 2e 44 4f 4d 45 78 63 65 70 74 69 6f 6e 7d 72 65 74 75 72 6e 20 65 2e 70 72 6f 74 6f Data Ascii: /! For license information please see FormLoader.bundle.js.LICENSE.txt /var d365mktforms;(()=>{var e,t,n={317:function(e,t){var n="undefined"!=typeof self?self:this,r=function(){function e(){this.fetch=!1,this.DOMException=n.DOMException}return e.proto
2024-04-26 17:16:58 UTC	16384	IN	Data Raw: 22 72 65 61 63 74 2e 6d 65 6d 6f 22 29 2c 6c 3d 64 28 22 72 65 61 63 74 2e 6c 61 7a 79 22 29 7d 76 61 72 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3b 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 61 63 74 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 2d 64 65 63 6f 64 65 72 2e 68 74 6d 6c 3f 69 6e 76 61 72 69 61 6e 74 3d 22 2b 65 2c 6e 3d 31 3b 6e 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 74 2b 3d 22 26 61 72 67 73 5b 5d 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 3b 72 65 74 75 72 6e 22 4d 69 6e 69 66 69 65 64 20 52 Data Ascii: "react.memo"),l=d("react.lazy")}var p="function"==typeof Symbol&&Symbol.iterator;function f(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n<arguments.length;n++)t+="&args[]="+encodeURIComponent(arguments[n]);return"Minified R
2024-04-26 17:16:58 UTC	16384	IN	Data Raw: 46 67 59 43 6e 6b 41 45 6d 64 4b 43 62 70 36 48 41 44 6d 51 66 44 70 53 51 45 58 63 77 69 41 78 55 61 69 78 47 79 49 4b 47 67 48 6b 4d 6c 41 71 65 43 77 4a 41 67 44 73 74 5a 41 67 51 77 4b 45 6a 68 5a 39 41 52 34 4d 41 41 53 47 46 72 67 30 6d 47 44 43 67 51 49 46 6d 62 4d 73 41 47 42 69 2b 38 36 4b 46 42 68 49 34 63 50 77 6d 7a 61 48 41 30 57 51 66 64 75 53 77 49 53 47 69 43 41 4d 70 56 6a 77 6e 45 67 51 41 49 66 6b 45 43 51 6b 41 4e 41 41 73 41 41 41 41 41 42 34 41 48 67 43 46 42 41 59 45 68 49 61 45 78 4d 62 45 52 45 4a 45 70 4b 61 6b 35 4f 62 6b 5a 47 4a 6b 4c 43 6f 73 6c 4a 61 55 31 4e 62 55 74 4c 61 30 39 50 62 30 48 42 6f 63 56 46 4a 55 64 48 4a 30 6a 49 36 4d 7a 4d 37 4d 72 4b 36 73 37 4f 37 73 50 44 34 38 6e 4a 36 63 33 4e 37 63 76 4c 36 38 44 41 Data Ascii: FgYCnkAEmdKCbp6HADmQfDpSQEXcwiAxUaixGyIKGgHkMlAqeCwJAgDstZAgQwKEjhZ9AR4MAASGFrg0mGDCgQIFmbMsAGBi+86KFBhI4cPwmzaHA0WQfduSwISGiCAMpVjwnEgQAIfkECQkANAAsAAAAAB4AHgCFBAYEhIaExMbEREJEpKak5ObkZGJkLCoslJaU1NbUtLa09Pb0HBocVFJUdHJ0jI6MzM7MrK6s7O7sPD48nJ6c3N7cvL68DA
2024-04-26 17:16:58 UTC	16384	IN	Data Raw: 69 6c 65 6e 74 3a 21 31 7d 3b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 6e 29 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 6e 5b 69 5d 26 26 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 5d 22 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 61 70 70 6c 79 28 6e 5b 69 5d 29 7c 7c 74 68 69 73 2e 61 64 64 52 65 73 6f 75 72 63 65 28 65 2c 74 2c 69 2c 6e 5b 69 5d 2c 7b 73 69 6c 65 6e 74 3a 21 30 7d 29 3b 72 2e 73 69 6c 65 6e 74 7c 7c 74 68 69 73 2e 65 6d 69 74 28 22 61 64 64 65 64 22 2c 65 2c 74 2c 6e 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 52 65 73 6f 75 72 63 65 42 75 6e 64 6c 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 29 7b 76 61 72 20 61 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 Data Ascii: ilent:!1};for(var i in n)"string"!=typeof n[i]&&"[object Array]"!==Object.prototype.toString.apply(n[i])\|\|this.addResource(e,t,i,n[i],{silent:!0});r.silent\|\|this.emit("added",e,t,n)}},{key:"addResourceBundle",value:function(e,t,n,r,i){var a=arguments.leng
2024-04-26 17:16:58 UTC	16384	IN	Data Raw: 72 28 31 3d 3d 65 3f 30 3a 32 3d 3d 65 3f 31 3a 65 3c 37 3f 32 3a 65 3c 31 31 3f 33 3a 34 29 7d 2c 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 28 31 3d 3d 65 7c 7c 31 31 3d 3d 65 3f 30 3a 32 3d 3d 65 7c 7c 31 32 3d 3d 65 3f 31 3a 65 3e 32 26 26 65 3c 32 30 3f 32 3a 33 29 7d 2c 31 32 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 28 65 25 31 30 21 3d 31 7c 7c 65 25 31 30 30 3d 3d 31 31 29 7d 2c 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 28 30 21 3d 3d 65 29 7d 2c 31 34 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 28 31 3d 3d 65 3f 30 3a 32 3d 3d 65 3f 31 3a 33 3d 3d 65 3f 32 3a 33 29 7d 2c 31 35 3a 66 75 6e 63 74 Data Ascii: r(1==e?0:2==e?1:e<7?2:e<11?3:4)},11:function(e){return Number(1==e\|\|11==e?0:2==e\|\|12==e?1:e>2&&e<20?2:3)},12:function(e){return Number(e%10!=1\|\|e%100==11)},13:function(e){return Number(0!==e)},14:function(e){return Number(1==e?0:2==e?1:3==e?2:3)},15:funct
2024-04-26 17:16:59 UTC	16384	IN	Data Raw: 64 4e 61 6d 65 73 70 61 63 65 28 74 29 3f 74 68 69 73 2e 6c 6f 67 67 65 72 2e 77 61 72 6e 28 27 64 69 64 20 6e 6f 74 20 73 61 76 65 20 6b 65 79 20 22 27 2e 63 6f 6e 63 61 74 28 6e 2c 27 22 20 61 73 20 74 68 65 20 6e 61 6d 65 73 70 61 63 65 20 22 27 29 2e 63 6f 6e 63 61 74 28 74 2c 27 22 20 77 61 73 20 6e 6f 74 20 79 65 74 20 6c 6f 61 64 65 64 27 29 2c 22 54 68 69 73 20 6d 65 61 6e 73 20 73 6f 6d 65 74 68 69 6e 67 20 49 53 20 57 52 4f 4e 47 20 69 6e 20 79 6f 75 72 20 73 65 74 75 70 2e 20 59 6f 75 20 61 63 63 65 73 73 20 74 68 65 20 74 20 66 75 6e 63 74 69 6f 6e 20 62 65 66 6f 72 65 20 69 31 38 6e 65 78 74 2e 69 6e 69 74 20 2f 20 69 31 38 6e 65 78 74 2e 6c 6f 61 64 4e 61 6d 65 73 70 61 63 65 20 2f 20 69 31 38 6e 65 78 74 2e 63 68 61 6e 67 65 4c 61 6e 67 75 Data Ascii: dNamespace(t)?this.logger.warn('did not save key "'.concat(n,'" as the namespace "').concat(t,'" was not yet loaded'),"This means something IS WRONG in your setup. You access the t function before i18next.init / i18next.loadNamespace / i18next.changeLangu
2024-04-26 17:16:59 UTC	16384	IN	Data Raw: 62 6a 65 63 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 6e 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 65 28 6e 29 26 26 28 6e 3d 54 65 28 22 22 2c 6e 29 2e 73 6c 69 63 65 28 31 29 29 2c 65 2e 71 75 65 72 79 53 74 72 69 6e 67 50 61 72 61 6d 73 26 26 28 74 3d 54 65 28 74 2c 65 2e 71 75 65 72 79 53 74 72 69 6e 67 50 61 72 61 6d 73 29 29 3b 74 72 79 7b 76 61 72 20 69 3b 28 69 3d 76 65 3f 6e 65 77 20 76 65 3a 6e 65 77 20 62 65 28 22 4d 53 58 4d 4c 32 2e 58 4d 4c 48 54 54 50 2e 33 2e 30 22 29 29 2e 6f 70 65 6e 28 6e 3f 22 50 4f 53 54 22 3a 22 47 45 54 22 2c 74 2c 31 29 2c 65 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 69 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 2c 22 58 4d 4c 48 74 Data Ascii: bject?function(e,t,n,r){n&&"object"===we(n)&&(n=Te("",n).slice(1)),e.queryStringParams&&(t=Te(t,e.queryStringParams));try{var i;(i=ve?new ve:new be("MSXML2.XMLHTTP.3.0")).open(n?"POST":"GET",t,1),e.crossDomain\|\|i.setRequestHeader("X-Requested-With","XMLHt
2024-04-26 17:16:59 UTC	16384	IN	Data Raw: 74 65 72 3d 22 41 66 74 65 72 22 2c 65 2e 63 75 72 72 65 6e 74 3d 22 43 75 72 72 65 6e 74 22 7d 28 74 74 7c 7c 28 74 74 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 6e 6f 48 6f 6c 64 6f 75 74 3d 22 6e 6f 48 6f 6c 64 6f 75 74 22 2c 65 2e 68 6f 6c 64 6f 75 74 3d 22 68 6f 6c 64 6f 75 74 22 7d 28 6e 74 7c 7c 28 6e 74 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 43 6f 6e 64 69 74 69 6f 6e 4d 65 74 3d 22 43 6f 6e 64 69 74 69 6f 6e 4d 65 74 22 2c 65 2e 54 69 6d 65 4c 69 6d 69 74 3d 22 54 69 6d 65 4c 69 6d 69 74 22 7d 28 72 74 7c 7c 28 72 74 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 53 74 61 6e 64 41 6c 6f 6e 65 3d 22 53 74 61 6e 64 41 6c 6f 6e 65 22 2c 65 2e 53 69 6e 67 6c 65 41 63 74 69 6f 6e 3d 22 53 69 6e 67 6c Data Ascii: ter="After",e.current="Current"}(tt\|\|(tt={})),function(e){e.noHoldout="noHoldout",e.holdout="holdout"}(nt\|\|(nt={})),function(e){e.ConditionMet="ConditionMet",e.TimeLimit="TimeLimit"}(rt\|\|(rt={})),function(e){e.StandAlone="StandAlone",e.SingleAction="Singl
2024-04-26 17:16:59 UTC	16384	IN	Data Raw: 2e 70 75 73 68 28 5b 32 2c 34 2c 2c 35 5d 29 2c 5b 34 2c 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 74 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 61 29 7b 72 65 74 75 72 6e 20 69 5b 61 5d 26 26 69 5b 61 5d 2e 72 65 71 75 65 73 74 65 64 41 74 21 3d 3d 72 3f 6f 2e 74 72 79 52 65 74 72 69 65 76 65 56 61 6c 75 65 28 22 22 2e 63 6f 6e 63 61 74 28 65 2c 22 5f 22 29 2e 63 6f 6e 63 61 74 28 74 29 2c 6f 2e 65 78 70 69 72 61 74 69 6f 6e 43 61 63 68 65 2c 69 5b 61 5d 2c 6e 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6e 75 6c 6c 29 7d 29 29 29 5d 3b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 20 73 2e 73 65 6e 74 28 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 61 5b 74 5b 6e 5d 5d 3d 65 7d 29 29 2c 5b 32 2c 61 Data Ascii: .push([2,4,,5]),[4,Promise.all(t.map((function(t,a){return i[a]&&i[a].requestedAt!==r?o.tryRetrieveValue("".concat(e,"_").concat(t),o.expirationCache,i[a],n):Promise.resolve(null)})))];case 3:return s.sent().forEach((function(e,n){return a[t[n]]=e})),[2,a
2024-04-26 17:16:59 UTC	16384	IN	Data Raw: 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 5b 34 2c 74 68 69 73 2e 66 65 74 63 68 47 65 74 28 65 29 5d 3b 63 61 73 65 20 31 3a 69 66 28 21 28 6e 3d 72 2e 73 65 6e 74 28 29 29 2e 6f 6b 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 22 2e 63 6f 6e 63 61 74 28 6e 75 6c 6c 3d 3d 74 3f 22 22 3a 74 2b 22 20 22 2c 22 53 74 61 74 75 73 3a 20 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 74 61 74 75 73 2c 22 20 2d 20 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 74 61 74 75 73 54 65 78 74 29 29 3b 72 65 74 75 72 6e 5b 34 2c 6e 2e 6a 73 6f 6e 28 29 5d 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 5b 32 2c 72 2e 73 65 6e 74 28 29 5d 7d 7d 29 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 50 6f 73 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 Data Ascii: {case 0:return[4,this.fetchGet(e)];case 1:if(!(n=r.sent()).ok)throw new Error("".concat(null==t?"":t+" ","Status: ").concat(n.status," - ").concat(n.statusText));return[4,n.json()];case 2:return[2,r.sent()]}}))}))},e.prototype.fetchPost=function(e,t){retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49756	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:00 UTC	738	OUT	GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: text/plain sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:01 UTC	589	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:01 GMT Content-Type: text/html Content-Length: 29591 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=900, must-revalidate x-ms-trace-id: fe1a92370e5d2ae7de5a1a9ddd095853 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff x-azure-ref: 20240426T171700Z-17644f8887fddqrtm10p4ae79g00000000y00000000091f0 x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:17:01 UTC	15795	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 72 6b 65 74 69 6e 67 20 46 6f 72 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 Data Ascii: <!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Marketing Form</title> <meta name="referrer" cont
2024-04-26 17:17:01 UTC	13796	IN	Data Raw: 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 74 77 6f 4f 70 74 69 6f 6e 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 72 61 64 69 6f 62 75 74 74 6f 6e 73 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 74 77 6f 4f 70 74 69 6f 6e 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 74 77 6f 6f 70 74 69 6f 6e 5f 63 68 65 63 6b 62 6f 78 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 6f 70 74 69 6f 6e 53 65 74 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 72 61 64 69 6f 62 75 74 74 6f 6e 73 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 6d 75 6c 74 69 4f 70 74 69 6f 6e 53 65 74 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 66 69 65 6c 64 73 65 74 20 3e 20 64 69 76 2c Data Ascii: } .twoOptionFormFieldBlock div.radiobuttons > div, .twoOptionFormFieldBlock div.twooption_checkbox > div, .optionSetFormFieldBlock div.radiobuttons > div, .multiOptionSetFormFieldBlock fieldset > div,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:00 UTC	650	OUT	GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1 Host: cxppusa1formui01cdnsa01-endpoint.azureedge.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://assets-usa.mkt.dynamics.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://assets-usa.mkt.dynamics.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:01 UTC	608	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:00 GMT Content-Type: application/json Content-Length: 1304 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 27 Feb 2024 09:22:19 GMT ETag: 0x8DC377598F59007 x-ms-request-id: 001bb379-401e-0080-58fd-975acd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * x-azure-ref: 20240426T171700Z-1865489d5f469db67514m1tnm40000000bgg0000000083u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:17:01 UTC	1304	IN	Data Raw: 7b 0d 0a 20 20 22 46 6f 72 6d 46 61 69 6c 65 64 54 6f 4c 6f 61 64 22 3a 20 22 46 61 69 6c 65 64 20 74 6f 20 6c 6f 61 64 20 66 6f 72 6d 22 2c 0d 0a 20 20 22 46 6f 72 6d 46 61 69 6c 65 64 54 6f 4c 6f 61 64 43 6f 72 73 22 3a 20 22 54 68 65 20 66 6f 72 6d 20 63 61 6e 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 20 6f 6e 20 61 20 64 6f 6d 61 69 6e 20 74 68 61 74 20 68 61 73 6e 27 74 20 62 65 65 6e 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 65 78 74 65 72 6e 61 6c 20 66 6f 72 6d 20 68 6f 73 74 69 6e 67 20 6f 72 20 74 68 65 72 65 20 69 73 20 61 20 6e 65 74 77 6f 72 6b 20 63 6f 6e 6e 65 63 74 69 76 69 74 79 20 69 73 73 75 65 22 2c 0d 0a 20 20 22 4c 65 61 72 6e 4d 6f 72 65 22 3a 20 22 4c 65 61 72 6e 20 6d 6f 72 65 22 2c 0d 0a 20 20 22 46 6f 72 6d 53 75 62 6d 69 74 74 65 Data Ascii: { "FormFailedToLoad": "Failed to load form", "FormFailedToLoadCors": "The form can not be loaded on a domain that hasn't been allowed for external form hosting or there is a network connectivity issue", "LearnMore": "Learn more", "FormSubmitte

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:00 UTC	713	OUT	GET /favicon.ico HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:01 UTC	313	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 17:17:01 GMT Content-Type: text/html Content-Length: 548 Connection: close Strict-Transport-Security: max-age=2592000; preload x-azure-ref: 20240426T171700Z-17644f8887fxsmp62x2nasg16g00000002hg0000000034a1 x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_MISS
2024-04-26 17:17:01 UTC	548	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:01 UTC	422	OUT	GET /usa/FormLoader/public/locales/en-us/translation.json HTTP/1.1 Host: cxppusa1formui01cdnsa01-endpoint.azureedge.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:02 UTC	615	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:02 GMT Content-Type: application/json Content-Length: 1304 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Tue, 27 Feb 2024 09:22:19 GMT ETag: 0x8DC377598F59007 x-ms-request-id: aa2f63ca-b01e-006b-52fd-976aad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Allow-Origin: * x-azure-ref: 20240426T171701Z-17644f8887f66bdz5dc1vumqq000000000zg000000005t5m x-fd-int-roxy-purgeid: 66630197 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:17:02 UTC	1304	IN	Data Raw: 7b 0d 0a 20 20 22 46 6f 72 6d 46 61 69 6c 65 64 54 6f 4c 6f 61 64 22 3a 20 22 46 61 69 6c 65 64 20 74 6f 20 6c 6f 61 64 20 66 6f 72 6d 22 2c 0d 0a 20 20 22 46 6f 72 6d 46 61 69 6c 65 64 54 6f 4c 6f 61 64 43 6f 72 73 22 3a 20 22 54 68 65 20 66 6f 72 6d 20 63 61 6e 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 20 6f 6e 20 61 20 64 6f 6d 61 69 6e 20 74 68 61 74 20 68 61 73 6e 27 74 20 62 65 65 6e 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 65 78 74 65 72 6e 61 6c 20 66 6f 72 6d 20 68 6f 73 74 69 6e 67 20 6f 72 20 74 68 65 72 65 20 69 73 20 61 20 6e 65 74 77 6f 72 6b 20 63 6f 6e 6e 65 63 74 69 76 69 74 79 20 69 73 73 75 65 22 2c 0d 0a 20 20 22 4c 65 61 72 6e 4d 6f 72 65 22 3a 20 22 4c 65 61 72 6e 20 6d 6f 72 65 22 2c 0d 0a 20 20 22 46 6f 72 6d 53 75 62 6d 69 74 74 65 Data Ascii: { "FormFailedToLoad": "Failed to load form", "FormFailedToLoadCors": "The form can not be loaded on a domain that hasn't been allowed for external form hosting or there is a network connectivity issue", "LearnMore": "Learn more", "FormSubmitte

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49758	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:02 UTC	668	OUT	GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250 HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:05 UTC	483	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:04 GMT Content-Type: image/png Content-Length: 5802 Connection: close Access-Control-Allow-Origin: * x-ms-trace-id: 9390753d9f438bc5103810212deb95a4 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff x-azure-ref: 20240426T171702Z-1865489d5f4pfk67n80fmg1bbw0000000bgg000000009k8u Cache-Control: public, max-age=2592000 x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:17:05 UTC	5802	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2b 00 00 00 a8 08 03 00 00 00 8f 29 38 44 00 00 01 23 50 4c 54 45 ff ff ff 09 4a b2 ff ff fd ff ff fb ff ff f9 00 46 af ff ff f7 ff fe ff 4c 70 c2 08 4a b5 00 3a ae 00 46 b1 00 40 aa ff fd ff d5 e1 ed 00 3d ac af c1 e1 c8 d4 e8 f7 f9 fd 2b 5a b9 00 41 b0 dc e5 f6 00 3c b6 00 3c af 41 6b bf 84 9b cd 9b b0 d9 f6 fc fc 00 42 b1 64 80 c1 3b 64 bc 00 40 b5 b7 cd e8 00 4c b0 a5 b9 df 5e 7e c4 6b 89 cf e6 f1 f4 00 41 b3 00 38 b3 ff ff f2 00 36 a8 a9 c3 e4 00 3a a7 00 32 a8 00 4b aa fc f9 ff ff fc f6 46 74 c1 00 3a ba ce db e9 ed f7 f5 67 87 c3 00 2f ae 81 a0 cb b2 c8 e1 d8 e6 ec 97 af ce 39 69 b5 00 3f a2 73 95 cb e5 ed f8 ca d4 ef a1 b2 de 8d aa de 13 5e af 43 70 b4 d0 e7 f5 62 8e c0 b7 c6 e7 cd d7 e6 b2 Data Ascii: PNGIHDR+)8D#PLTEJFLpJ:F@=+ZA<<AkBd;d@L^~kA86:2KFt:g/9i?s^Cpb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49759	52.146.76.30	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:02 UTC	605	OUT	OPTIONS /api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits HTTP/1.1 Host: public-usa.mkt.dynamics.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://assets-usa.mkt.dynamics.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:03 UTC	383	IN	HTTP/1.1 204 No Content Server: nginx Date: Fri, 26 Apr 2024 17:17:03 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Methods: GET,POST Access-Control-Allow-Origin: https://assets-usa.mkt.dynamics.com x-ms-trace-id: 7fe44e3330fb79e57740a25d3cd10b54 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49760	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:02 UTC	444	OUT	GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:02 UTC	589	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:02 GMT Content-Type: text/html Content-Length: 29591 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=900, must-revalidate x-ms-trace-id: 320fe764e3488188173de2c72aa1c369 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff x-azure-ref: 20240426T171702Z-1865489d5f469db67514m1tnm40000000bd000000000pvpx x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-26 17:17:02 UTC	15795	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 72 6b 65 74 69 6e 67 20 46 6f 72 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 Data Ascii: <!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Marketing Form</title> <meta name="referrer" cont
2024-04-26 17:17:02 UTC	13796	IN	Data Raw: 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 74 77 6f 4f 70 74 69 6f 6e 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 72 61 64 69 6f 62 75 74 74 6f 6e 73 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 74 77 6f 4f 70 74 69 6f 6e 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 74 77 6f 6f 70 74 69 6f 6e 5f 63 68 65 63 6b 62 6f 78 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 6f 70 74 69 6f 6e 53 65 74 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 64 69 76 2e 72 61 64 69 6f 62 75 74 74 6f 6e 73 20 3e 20 64 69 76 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 6d 75 6c 74 69 4f 70 74 69 6f 6e 53 65 74 46 6f 72 6d 46 69 65 6c 64 42 6c 6f 63 6b 20 66 69 65 6c 64 73 65 74 20 3e 20 64 69 76 2c Data Ascii: } .twoOptionFormFieldBlock div.radiobuttons > div, .twoOptionFormFieldBlock div.twooption_checkbox > div, .optionSetFormFieldBlock div.radiobuttons > div, .multiOptionSetFormFieldBlock fieldset > div,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49761	52.146.76.30	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:03 UTC	715	OUT	POST /api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits HTTP/1.1 Host: public-usa.mkt.dynamics.com Connection: keep-alive Content-Length: 215 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://assets-usa.mkt.dynamics.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:03 UTC	215	OUT	Data Raw: 7b 22 70 61 67 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2d 75 73 61 2e 6d 6b 74 2e 64 79 6e 61 6d 69 63 73 2e 63 6f 6d 2f 35 32 66 35 32 37 63 38 2d 35 61 66 64 2d 65 65 31 31 2d 39 30 34 38 2d 30 30 30 64 33 61 31 30 36 38 33 37 2f 64 69 67 69 74 61 6c 61 73 73 65 74 73 2f 73 74 61 6e 64 61 6c 6f 6e 65 66 6f 72 6d 73 2f 62 39 39 65 32 37 62 37 2d 39 66 30 30 2d 65 66 31 31 2d 61 31 66 64 2d 36 30 34 35 62 64 64 62 31 64 61 61 23 6d 73 64 79 6e 6d 6b 74 5f 74 72 61 63 6b 69 6e 67 63 6f 6e 74 65 78 74 3d 38 39 65 31 38 34 63 64 2d 34 62 34 32 2d 34 64 30 35 2d 38 39 31 63 2d 64 36 34 36 38 30 30 63 33 35 61 62 22 7d Data Ascii: {"pageUrl":"https://assets-usa.mkt.dynamics.com/52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/standaloneforms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa#msdynmkt_trackingcontext=89e184cd-4b42-4d05-891c-d646800c35ab"}
2024-04-26 17:17:04 UTC	366	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 26 Apr 2024 17:17:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: https://assets-usa.mkt.dynamics.com x-ms-trace-id: bd1b95eeb5b709c0ea8f3fcb9c18b7c9 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff
2024-04-26 17:17:04 UTC	54	IN	Data Raw: 32 62 0d 0a 7b 22 69 6e 74 65 72 61 63 74 69 6f 6e 53 74 61 74 75 73 22 3a 30 2c 22 65 72 72 6f 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2b{"interactionStatus":0,"errorMessage":null}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49762	52.146.76.30	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:05 UTC	468	OUT	GET /api/v1.0/orgs/52f527c8-5afd-ee11-9048-000d3a106837/landingpageforms/forms/b99e27b7-9f00-ef11-a1fd-6045bddb1daa/visits HTTP/1.1 Host: public-usa.mkt.dynamics.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:05 UTC	218	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 26 Apr 2024 17:17:05 GMT Content-Length: 0 Connection: close x-ms-trace-id: 845bcf146cfa5d58371ff067105e99ba Strict-Transport-Security: max-age=2592000; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49763	13.107.246.41	443	8904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:05 UTC	467	OUT	GET /52f527c8-5afd-ee11-9048-000d3a106837/digitalassets/images/d28a00ec-9e00-ef11-a1fd-6045bddb1daa?ts=638493836057785250 HTTP/1.1 Host: assets-usa.mkt.dynamics.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 17:17:05 UTC	503	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 17:17:05 GMT Content-Type: image/png Content-Length: 5802 Connection: close Access-Control-Allow-Origin: * x-ms-trace-id: 9390753d9f438bc5103810212deb95a4 Strict-Transport-Security: max-age=2592000; preload x-content-type-options: nosniff x-azure-ref: 20240426T171705Z-1865489d5f4vxtqf9836nc5azn00000004g0000000019860 Cache-Control: public, max-age=2592000 x-fd-int-roxy-purgeid: 69215008 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-26 17:17:05 UTC	5802	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2b 00 00 00 a8 08 03 00 00 00 8f 29 38 44 00 00 01 23 50 4c 54 45 ff ff ff 09 4a b2 ff ff fd ff ff fb ff ff f9 00 46 af ff ff f7 ff fe ff 4c 70 c2 08 4a b5 00 3a ae 00 46 b1 00 40 aa ff fd ff d5 e1 ed 00 3d ac af c1 e1 c8 d4 e8 f7 f9 fd 2b 5a b9 00 41 b0 dc e5 f6 00 3c b6 00 3c af 41 6b bf 84 9b cd 9b b0 d9 f6 fc fc 00 42 b1 64 80 c1 3b 64 bc 00 40 b5 b7 cd e8 00 4c b0 a5 b9 df 5e 7e c4 6b 89 cf e6 f1 f4 00 41 b3 00 38 b3 ff ff f2 00 36 a8 a9 c3 e4 00 3a a7 00 32 a8 00 4b aa fc f9 ff ff fc f6 46 74 c1 00 3a ba ce db e9 ed f7 f5 67 87 c3 00 2f ae 81 a0 cb b2 c8 e1 d8 e6 ec 97 af ce 39 69 b5 00 3f a2 73 95 cb e5 ed f8 ca d4 ef a1 b2 de 8d aa de 13 5e af 43 70 b4 d0 e7 f5 62 8e c0 b7 c6 e7 cd d7 e6 b2 Data Ascii: PNGIHDR+)8D#PLTEJFLpJ:F@=+ZA<<AkBd;d@L^~kA86:2KFt:g/9i?s^Cpb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 17:17:21 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vkF+oXvDPKsCOPm&MD=HWVEBc5B HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 17:17:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: aab8a549-d4bf-4d57-a46f-4f689faeddb3 MS-RequestId: 83f99976-d39f-451e-8e30-6908acd0df29 MS-CV: 0ooOQ856xUmBDthI.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 17:17:21 GMT Connection: close Content-Length: 25457
2024-04-26 17:17:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 17:17:22 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	19:16:22
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACRMNT.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:16:23
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:16:23
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1620,i,2245434487977849350,1117404074893898555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:16:48
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://public-usa.mkt.dynamics.com/api/orgs/52f527c8-5afd-ee11-9048-000d3a106837/r/zYThiUJLBU2JHNZGgAw1qwEAAAA"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:16:50
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2224,i,14375637986676002986,8035494575245750603,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ACRMNT.pdf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\04a66e01-8fda-4a7c-a117-d2536b3f9cd9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426171628Z-166.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7388

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Windows Analysis Report
ACRMNT.pdf