Edit tour

Windows Analysis Report
MFA.png

Overview

General Information

Sample Name:	MFA.png
Analysis ID:	1297427
MD5:	af8f9a21b423aa84a456d75bdcaf5c7e
SHA1:	8ee182c96de7e89e037da752ee0addd2ad80c97e
SHA256:	2e2bf46a0b5e6fb48e46c60711d2fc4ad90418d47999f8d2c5944aeae1b5e388
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on logo match)

Phishing site detected (based on image similarity)

Queries the volume information (name, serial number etc) of a device

Found iframes

Creates files inside the system directory

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

mspaint.exe (PID: 7068 cmdline: mspaint.exe "C:\Users\user\Desktop\MFA.png" MD5: B59CF145BBAE39672321768B33A01CFA)

chrome.exe (PID: 5992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://0ffice-authentication.com/?mfknxooz MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

chrome.exe (PID: 5640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1888,i,2116380640700791652,7274111503676162324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 8D1C4713ACB7CC2AAAEE4477C58A80BA)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.0.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.1.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://0ffice-authentication.com	Matcher: Template: microsoft matched with high similarity
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	Matcher: Template: microsoft matched
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	Matcher: Template: microsoft matched

Phishing site detected (based on image similarity)

Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

HTTP Parser: Number of links: 0

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

HTTP Parser: No favicon

Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_2019779022	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_pnacl_json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.fingerprint	Jump to behavior

Source: Joe Sandbox View

IP Address: 13.107.246.60 13.107.246.60

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 5ed61a02-7dde-4f57-9556-b7a1937a8a00x-ms-ests-server: 2.1.16150.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}Referrer-Policy: strict-origin-when-cross-originDate: Fri, 25 Aug 2023 13:28:24 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Source: chromecache_228.4.dr	String found in binary or memory: http://knockoutjs.com/
Source: pnacl_public_x86_64_pnacl_llc_nexe.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	String found in binary or memory: http://llvm.org/):
Source: chromecache_228.4.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_228.4.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: pnacl_public_x86_64_crtend_o.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: manifest.json.3.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: pnacl_public_x86_64_ld_nexe.3.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.3.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: chromecache_228.4.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_220.4.dr, chromecache_222.4.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_220.4.dr, chromecache_222.4.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Dvrtrktau_uydMvoGc1_xfN2ULJBRPHxz6q2oM2aufczSxk8Cchv3g2jlLVO-eHXlJ_BwPi1P-zYcjdR9AuTyG10jrJ2AzQ7yL8SBUliEafdzZn70Pmm-r8GrPXaz7LFgctn_yZRHpJXI09tbP_WroWCmYwT_a7Fwj8gHnQ5nbY; AEC=Ad49MVGGktvnyMQBXjxfVM4VyQMgBORLkDWV_5bpQs3oS50vEqIAFgkFMBQ; CONSENT=PENDING+008; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmRlIAEaBgiA0dCmBg; __Secure-ENID=14.SE=ASWfeSSVBcK3LyggZgGhgI5yIs3Z2wYpfR6yuK81LiYU6I0bFs937AKcakQoHnJkxVLloWnpVW_r8Ar2dupLdGHUm260SY6_u_8bKbtIVuC2UT3_Sjp3_6n5MjyjVSOfngggQke4VZle0rxsEtTK1UwAzXaROx3bb_2_jH9Xta1jpoaREw

Source: unknown

DNS traffic detected: queries for: 0ffice-authentication.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?mfknxooz HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_nun_Nob0yT2WjCUfgBCTog2.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_2W3IEdsiCwViwvv0RWyRLg2.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_vts8ra1it9l0lgwizaxzhg2.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 0ffice-authentication.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0

Source: C:\Windows\SysWOW64\mspaint.exe

File created: C:\Windows\Debug\WIA

Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mspaint.exe mspaint.exe "C:\Users\user\Desktop\MFA.png"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://0ffice-authentication.com/?mfknxooz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1888,i,2116380640700791652,7274111503676162324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1888,i,2116380640700791652,7274111503676162324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926749fa-2615-4987-8845-c33e65f2b957}\InProcServer32

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_5992_2019779022

Jump to behavior

Source: classification engine

Classification label: mal64.phis.winPNG@24/32@16/8

Source: C:\Windows\SysWOW64\mspaint.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_5992_2019779022	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_pnacl_json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.fingerprint	Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\mspaint.exe

Queries volume information: C:\Users\user\Desktop\MFA.png VolumeInformation

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MFA.png	0%	ReversingLabs
MFA.png	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
cs1100.wpc.omegacdn.net	0%	Virustotal	Browse
0ffice-authentication.com	0%	Virustotal	Browse
part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://0ffice-authentication.com/?mfknxooz	0%	Avira URL Cloud	safe
https://0ffice-authentication.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	0%, Virustotal, Browse	unknown
accounts.google.com	172.217.168.77	true	false		high
0ffice-authentication.com	46.243.183.6	true	false	0%, Virustotal, Browse	unknown
part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
www.google.com	172.217.168.68	true	false		high
clients.l.google.com	142.250.203.110	true	false		high
clients2.google.com	unknown	unknown	false		high
identity.nel.measure.office.net	unknown	unknown	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://0ffice-authentication.com/?mfknxooz	false	Avira URL Cloud: safe	unknown
https://0ffice-authentication.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://login.microsoftonline.com	chromecache_220.4.dr, chromecache_222.4.dr	false	high
http://www.opensource.org/licenses/mit-license.php)	chromecache_228.4.dr	false	high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.3.dr	false	high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.3.dr	false	high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_crtend_o.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	false	high
http://knockoutjs.com/	chromecache_228.4.dr	false	high
https://login.windows-ppe.net	chromecache_220.4.dr, chromecache_222.4.dr	false	high
https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js	chromecache_228.4.dr	false	high
http://www.json.org/json2.js	chromecache_228.4.dr	false	high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_crtend_o.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	false	high
http://llvm.org/):	pnacl_public_x86_64_pnacl_llc_nexe.3.dr, pnacl_public_x86_64_pnacl_sz_nexe.3.dr	false	high
https://clients2.google.com/service/update2/crx	manifest.json.3.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.243.183.6	0ffice-authentication.com	Russian Federation	209283	ITGLOBAL-BY	false
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.168.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.168.77	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.6

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1297427
Start date and time:	2023-08-25 15:27:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	MFA.png
Detection:	MAL
Classification:	mal64.phis.winPNG@24/32@16/8
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 172.217.168.67, 34.104.35.123, 23.0.174.11, 23.10.249.144, 20.190.181.3, 40.126.53.19, 20.190.181.6, 20.190.181.2, 20.190.181.23, 40.126.53.21, 20.190.181.0, 40.126.53.16, 20.190.181.5, 40.126.53.18, 23.36.225.122, 216.58.215.234, 172.217.168.10, 172.217.168.42, 172.217.168.74, 142.250.203.106, 20.190.181.4
Excluded domains from analysis (whitelisted): eudb.ris.api.iris.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, a1894.dscb.akamai.net, arc.msn.com, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, www.microsoft.com-c-3.edgekey.net, login.live.com, update.googleapis.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prdv4a.aadg.msidentity.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, aadcdnoriginwus2.afd.azureedge.net, www.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
46.243.183.6	https://0ffice-authentication.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse
46.243.183.6	https://0tp-0ffice365.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse
13.107.246.60	https://www.linkedin.com/slink/?code=d3cYepAb#Z2F2aW4ubm90dEBzd2VkYXZpYS5zZQ==	Get hash	malicious	HTMLPhisher	Browse
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2VvcmdlbW9ycmlzQHBheWUubmV0	Get hash	malicious	HTMLPhisher	Browse
	https://www.dropbox.com/scl/fi/30u77kvec5bhsskq02e3s/IGIW-Sales-and-Education-Trade-Consultants-LLC.docx?rlkey=r5iovpoisn3m3y6lafsrulr6m&dl=0	Get hash	malicious	HTMLPhisher	Browse
	https://indd.adobe.com/view/0575cfc9-7516-4992-a67d-6d987b87d8f9	Get hash	malicious	HTMLPhisher	Browse
	https://xml-v4.discoveryplugs-1.live/click?i=l6bmrwamzne_0	Get hash	malicious	Unknown	Browse
	https://www.linkedin.com/slink/?code=d3cYepAb#c3VwcG9ydEBhcm1pdHdpbmVzLmNvLnVr%3E	Get hash	malicious	HTMLPhisher	Browse
	https://www.linkedin.com/slink/?code=d3cYepAb#c3VwcG9ydEBhcm1pdHdpbmVzLmNvLnVr%3E	Get hash	malicious	HTMLPhisher	Browse
	https://indd.adobe.com/view/e5f5a5b6-c3f6-44af-8ee6-3f30bc42dbb9	Get hash	malicious	HTMLPhisher	Browse
	https://ppehosted.hassannetworkllc-proofpoint.info/?vdogrdby	Get hash	malicious	HTMLPhisher	Browse
	PAYMENT ADVICE.html	Get hash	malicious	HTMLPhisher	Browse
	http://candidodeoliveira.pt/	Get hash	malicious	Unknown	Browse
	https://linkedin.com/slink?code=gGeK-G4Y#2636c6169726540656c736172656379636c652e636f2e756b	Get hash	malicious	HTMLPhisher	Browse
	202398025022MessageEastwesttea_.html	Get hash	malicious	HTMLPhisher	Browse
	Pago_Banco_Estado__Swift_copy.bat.exe	Get hash	malicious	Remcos	Browse
	Statement 825 Paid mt.com .htm	Get hash	malicious	HTMLPhisher	Browse
	2023_eSignature_Cbh_052474466_872203448824739pdf_(2).htm	Get hash	malicious	HTMLPhisher	Browse
	https://schuceo.com/viloorel/hgfijhA/?userid=AhmedS.AlShamsi@cpc.gov.ae	Get hash	malicious	Unknown	Browse
	https://schuceo.com/viloorel/hgfijhA/?userid=AhmedS.AlShamsi@cpc.gov.ae	Get hash	malicious	Unknown	Browse
	https://schuceo.com/viloorel/hgfijhA/?userid=AhmedS.AlShamsi@cpc.gov.ae	Get hash	malicious	Unknown	Browse
	https://linkedin.com/slink?code=eYWGeWp2#YW5kcmVhLmNvc3RhQHlvZ2lwcm9kdWN0cy5jb20=&2441	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0ffice-authentication.com	https://0ffice-authentication.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	46.243.183.6
cs1100.wpc.omegacdn.net	https://account.groupeseb.com/Redirect?map=53465346-Niamh-15353-Ranahan-461&cm=1531146-153-August-1853&sf=1Ranahan-53z46a-12023-Niamh-Ranahan5346&retUrl=http%3A%2F%2Fna3dd2o23.web.app/nranahan07xaQ3brR3wa2vTd0TR3wH05nZ1&m=534611-Ranahan8&c=8Niamh8&p=53146-Friday25August	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://dependantfilshari.xyz/host22/admin/js/mf.php?id=nsz07u9	Get hash	malicious	Unknown	Browse	152.199.23.37
	http://www.baidu.com/link?url=Ug1DfpMfkCwmhBZsR0gT7SitNUkLLkNReZbdZ59ahSJ3k1aW569ArGHHShNLPHQz&wd=&c=E,1,BGeKlw3W1Kwf_wB19Xe3d1oUdDDKsubXU82uAxClO98Ji5f_x3-kuk3pdQNPiSvCK1cQ8Y3MjYJYyKAT3iBo9wRMJ5QCQVnpwz96MjmUXoQ4A53jDmYHU4FEX6g,&typo=1	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://www.dropbox.com/scl/fi/30u77kvec5bhsskq02e3s/IGIW-Sales-and-Education-Trade-Consultants-LLC.docx?rlkey=r5iovpoisn3m3y6lafsrulr6m&dl=0	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	ACH payment confirmation support@healthesystems.com .HTML	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://0ffice-authentication.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://0tp-0ffice365.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	ACCOUNTSTATEMENTCOPY.html	Get hash	malicious	Unknown	Browse	152.199.23.37
	ACCOUNTSTATEMENTCOPY.html	Get hash	malicious	Unknown	Browse	152.199.23.37
	ACCOUNTSTATEMENTCOPY.html	Get hash	malicious	Unknown	Browse	152.199.23.37
	ACH payment confirmation rdownes@farbestfoods.com .HTML	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	ACH payment confirmation rdownes@farbestfoods.com .HTML	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://ppehosted.hassannetworkllc-proofpoint.info/?vdogrdby	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://ppehosted.hassannetworkllc-proofpoint.info/?vdogrdby	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://linkedin.com/slink?code=gGeK-G4Y#2636c6169726540656c736172656379636c652e636f2e756b	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://linkedin.com/slink?code=gGeK-G4Y#96f6c6976696140696e2d6163636f756e74616e63792e636f2e756b	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	202398025022MessageEastwesttea_.html	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	Incoming ACH Confirmation.HTM	Get hash	malicious	Unknown	Browse	152.199.23.37
	https://www.baidu.com/link?url=ou4XHApstHkj9DoANHyTZRHTQge3MuRe4WD6RoRNwOt0Ywy0bCjt0tqv7zwMjhUR#c2VsaW5hLmhvdWdoQHNiYWZsYS5jb20=	Get hash	malicious	Unknown	Browse	152.199.23.37
	jasonReed-phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	152.199.23.37
part-0032.t-0009.t-msedge.net	https://account.groupeseb.com/Redirect?map=53465346-Niamh-15353-Ranahan-461&cm=1531146-153-August-1853&sf=1Ranahan-53z46a-12023-Niamh-Ranahan5346&retUrl=http%3A%2F%2Fna3dd2o23.web.app/nranahan07xaQ3brR3wa2vTd0TR3wH05nZ1&m=534611-Ranahan8&c=8Niamh8&p=53146-Friday25August	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2F2aW4ubm90dEBzd2VkYXZpYS5zZQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2VvcmdlbW9ycmlzQHBheWUubmV0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.dropbox.com/scl/fi/30u77kvec5bhsskq02e3s/IGIW-Sales-and-Education-Trade-Consultants-LLC.docx?rlkey=r5iovpoisn3m3y6lafsrulr6m&dl=0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://indd.adobe.com/view/0575cfc9-7516-4992-a67d-6d987b87d8f9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://xml-v4.discoveryplugs-1.live/click?i=l6bmrwamzne_0	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://0ffice-authentication.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://0tp-0ffice365.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/slink/?code=d3cYepAb#c3VwcG9ydEBhcm1pdHdpbmVzLmNvLnVr%3E	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/slink/?code=d3cYepAb#c3VwcG9ydEBhcm1pdHdpbmVzLmNvLnVr%3E	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://indd.adobe.com/view/e5f5a5b6-c3f6-44af-8ee6-3f30bc42dbb9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://ppehosted.hassannetworkllc-proofpoint.info/?vdogrdby	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	PAYMENT ADVICE.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://ppehosted.hassannetworkllc-proofpoint.info/?vdogrdby	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://candidodeoliveira.pt/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://linkedin.com/slink?code=gGeK-G4Y#2636c6169726540656c736172656379636c652e636f2e756b	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://linkedin.com/slink?code=gGeK-G4Y#96f6c6976696140696e2d6163636f756e74616e63792e636f2e756b	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	202398025022MessageEastwesttea_.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Statement 825 Paid mt.com .htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	2023_eSignature_Cbh_052474466_872203448824739pdf_(2).htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Kristen Puckett shared _knoxdermplastics#Remittance_Notice_pdf_ with you.msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.141
	BOQ-Al Gurg Automation Project.exe	Get hash	malicious	DBatLoader, Remcos	Browse	13.107.136.8
	BOQ-Al Gurg Automation Project.exe	Get hash	malicious	DBatLoader, Remcos	Browse	13.107.136.8
	gucciarm7.elf	Get hash	malicious	Mirai	Browse	20.91.208.152
	gucciarm.elf	Get hash	malicious	Mirai	Browse	22.56.89.90
	guccix86.elf	Get hash	malicious	Mirai	Browse	20.14.171.59
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2F2aW4ubm90dEBzd2VkYXZpYS5zZQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2F2aW4ubm90dEBzd2VkYXZpYS5zZQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	PO.230364.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.219.60
	Upaid_Overdue_Invoice.jar	Get hash	malicious	Dynamic Stealer	Browse	20.226.251.200
	Upaid_Overdue_Invoice.jar	Get hash	malicious	Dynamic Stealer	Browse	20.226.251.200
	https://www.linkedin.com/slink/?code=d3cYepAb#Z2VvcmdlbW9ycmlzQHBheWUubmV0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://www.baidu.com/link?url=Ug1DfpMfkCwmhBZsR0gT7SitNUkLLkNReZbdZ59ahSJ3k1aW569ArGHHShNLPHQz&wd=&c=E,1,BGeKlw3W1Kwf_wB19Xe3d1oUdDDKsubXU82uAxClO98Ji5f_x3-kuk3pdQNPiSvCK1cQ8Y3MjYJYyKAT3iBo9wRMJ5QCQVnpwz96MjmUXoQ4A53jDmYHU4FEX6g,&typo=1	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://bitmovin.com/demos/drm	Get hash	malicious	Unknown	Browse	13.107.213.44
	https://www.dropbox.com/scl/fi/30u77kvec5bhsskq02e3s/IGIW-Sales-and-Education-Trade-Consultants-LLC.docx?rlkey=r5iovpoisn3m3y6lafsrulr6m&dl=0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	6K20nZhV6g.elf	Get hash	malicious	Mirai	Browse	191.237.178.81
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	20.231.62.45
	sora.x86.elf	Get hash	malicious	Mirai	Browse	20.230.213.32
	https://indd.adobe.com/view/0575cfc9-7516-4992-a67d-6d987b87d8f9	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	3DzABAZWMB.elf	Get hash	malicious	Mirai	Browse	20.104.11.91
ITGLOBAL-BY	https://0ffice-authentication.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	46.243.183.6
	https://0tp-0ffice365.com/?mfknxooz	Get hash	malicious	HTMLPhisher	Browse	46.243.183.6
	SecuriteInfo.com.Variant.MSILHeracles.17744.21016.exe	Get hash	malicious	RedLine	Browse	46.243.186.8

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	http://tracking.confprofs.com/tracking/click?d=LFgQUYmdfOBdGwpFhuN-ElS1D8dMxdYsRnAUL1q-2ozlekJtb1w4dDUmmbJhf5UB1eFE1aSvGoBe0ELHRe6twScgicVoa6HLIVsL8zj6ssYMiyChEf8hpD1M5cmldGExxOjxufUJBY641t7g35UVVw4n0SdMpqkK8XW1TPVTTGYPALg1x85ad96FNV0eOI2ieev1LNttfZxx5AXXf5tm6m81	Get hash	malicious	Unknown	Browse
	http://xml-v4.qksrv1.com/click?i=7yjoashki6q_0	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.23042.9340.exe	Get hash	malicious	Unknown	Browse
	Bcbcpa remittance89783839.html	Get hash	malicious	Unknown	Browse
	https://app.capacities.io/home/2672e14d-4b0c-4e96-a793-aa4fb8d739f4	Get hash	malicious	Unknown	Browse
	https://pub-5e34bcda437b499399d6abc116886480.r2.dev/indexR.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.diamondglass.in/	Get hash	malicious	Unknown	Browse
	ATT26328.html	Get hash	malicious	Unknown	Browse
	https://github.com/mRemoteNG/mRemoteNG/releases/download/v1.76.20/mRemoteNG-Portable-1.76.20.24669.zip	Get hash	malicious	Unknown	Browse
	ACCOUNTSTATEMENTCOPY.html	Get hash	malicious	Unknown	Browse
	http://gpt9.com/api/cpx?q=6cb51c39d189cc673d43b0e080498febc6e6304d1d2154f684abd19673ad75137104f828338656b7690cf46e0e09f1031ee81f68311c1cc165a5b2b142d72a2ae31a0a2562b0c5fda094173142ddda69266325e16144d0654c07a5323086a2688d5b69d0efe3cd930ed8423cdc51ea4c734ff7ab398edbbe84650ffa40a93964cc41e41597e2dc35d545cccc328ee7a37390ebf6fdba970c9406f56e5694782a282cc13809d2db790904c48116185ae8cbb0c1848cc80786a47499cacb274f88dbc1cb208ccf528b7c9675c5e3a07dd464a029497122935f304de607d6d3cabdbb740490836a0076fcc16f899385a9a609976ec08da9125a3b36db3506f7871e	Get hash	malicious	Unknown	Browse
	http://masterplacelove.cfd	Get hash	malicious	Unknown	Browse
	ACCOUNTSTATEMENTCOPY.html	Get hash	malicious	Unknown	Browse
	ACH payment confirmation rdownes@farbestfoods.com .HTML	Get hash	malicious	HTMLPhisher	Browse
	ACH payment confirmation rdownes@farbestfoods.com .HTML	Get hash	malicious	HTMLPhisher	Browse
	https://usps.pp-lose.com/	Get hash	malicious	Unknown	Browse
	https://protect-za.mimecast.com/s/kmIMCxGjjnHDXJAASmqvmI?domain=clt1554948.benchurl.com	Get hash	malicious	Unknown	Browse
	AgshealthWire-receipt.html	Get hash	malicious	Unknown	Browse
	https://www.menti.com/alo8b9w49k13	Get hash	malicious	Unknown	Browse
	ACH Payment.xlsx	Get hash	malicious	HTMLPhisher	Browse

Created / dropped Files

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3034
Entropy (8bit):	5.876664552417901
Encrypted:	false
SSDEEP:	48:p/hEc9q0S+UTKYM43z8nqMsfWRUWEADM/W9n7lqFkakzcVTGkcYTPi6zM:RGcg5z/jjjHgUnV278+aWLy4
MD5:	8B6C3E16DFBF5FD1C9AC2267801DB38E
SHA1:	F5CADC5914DF858C96C189B092BC89C29407BBAA
SHA-256:	FD986A547D9585E98F451B87CA85DEB4B61EE540C6FAC678D7BEDABF04653095
SHA-512:	37048EF8FADF62A26CAEC6EE90AC192429AB1E99424E5C68FACA90C0DAD68642C761FDCAC03FC38FA930841F91FA145A6943EC7F168D4F2FA426F1F092C2F502
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY19wbmFjbF9qc29uIiwicm9vdF9oYXNoIjoiVkNUSHNJVHNUSXVncWNhV2ctWHVpTU1sdWloV1FSTE1sQnpTTGprdGhETSJ9LHsicGF0aCI6Il9wbGF0Zm9ybV9zcGVjaWZpYy94ODZfNjQvcG5hY2xfcHVibGljX3g4Nl82NF9jcnRiZWdpbl9mb3JfZWhfbyIsInJvb3RfaGFzaCI6ImxINWt2a1BvSVZZczZKVHhyOHc5Q2MxXzloVEJCX3lVSlF6VDZseVVNd0kifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0YmVnaW5fbyIsInJvb3RfaGFzaCI6IkVuLVFQTW1HUm1xbG9Ud1gzOTAzckpsMkw0R25sQmdET1FhZlNKaHJ4Nk0ifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0ZW5kX28iLCJyb290X2hhc2giOiJkT2lJVzRmdEdGNW9FY0k1UXYyYjBmdXNrUlYyaUVtdmxhbmV6MlpFc3VvIn0seyJwYXRoIjoiX3BsYXRmb3JtX3NwZWNpZmljL3g4Nl82NC9wbmFjbF9wdWJsaWNfeDg2XzY0X2xkX25leGUiLCJyb290X2hhc2giOiIzNEU5QU9EMmpqLWNoMzZQZ0NVV0YtMUpYWVhVdlNGY1I4bks1aWppcWNjIn0seyJwYXRoIjoiX3B

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_pnacl_json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	4.68252584617246
Encrypted:	false
SSDEEP:	12:TjLJ7qaVgPPd8bdzQBXefosmc5T9+n6e1Cetm1JXcAwA:TJ7jViPOd8wfHmZ6RP15
MD5:	35D5F285F255682477F4C50E93299146
SHA1:	FB58813C4D785412F05962CD379434669DE79C2B
SHA-256:	5424C7B084EC4C8BA0A9C69683E5EE88C325BA28564112CC941CD22E392D8433
SHA-512:	59DF2D5F2684FACC80C72F9C4B7E280F705776076C9D843534F772D5A3D578BEE04289AEE81320F23FB4D743F3969EDF5BA53FEBBAC8A4D27F3BC53BCF271C3E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{. "COMMENT": [. "This file serves as a template for the resource info description used by ", . "the NaCl Chrome plugin. It is kept in the NaCl repository to prevent ", . "hard-coding of NaCl-specific information inside the Chrome repository.". ], . "abi-version": 1, . "pnacl-arch": "x86-64", . "pnacl-ld-name": "ld.nexe", . "pnacl-llc-name": "pnacl-llc.nexe", . "pnacl-sz-name": "pnacl-sz.nexe", . "pnacl-version": "5dfe030a71ca66e72c5719ef5034c2ed24706c43".}

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	3.4025803725190906
Encrypted:	false
SSDEEP:	48:b/5D5V5PK82aTS6aTTw0Do1DttoyDNsEA:b/hbVic1ZtLDNsE
MD5:	604FF8F351A88E7A1DBD7C836378AE86
SHA1:	9D8D89AE9F13D6306E619A4EAAD51EDE91A5F9F3
SHA-256:	947E64BE43E821562CE894F1AFCC3D09CD7FF614C107FC94250CD3EA5C943302
SHA-512:	85B1EDA4C473E00034EE627B7ABB894A77E521BC6A91A91A4A3744CA7511CB0AF10B9723D9ECC2CE3378DD70B659DF842D8C11875958CB77070CF01EC0A15840
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.ELF..............>.................................@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..SP..h.........fff...................h.........fff.............J.$<[.,$J.l=....J.$<.....f.....................................................................................................................................................................................NaCl....x86-64...........zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......`....C....C..B...... .......................<...............@.......X.......................t........................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pna

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2776
Entropy (8bit):	3.5335802354066246
Encrypted:	false
SSDEEP:	48:b/5D5V5ej5ej5PjDdaTS6aTTw6DV1DtFouoyDOsTy:b/hbEEVJB1ZFhLDOsT
MD5:	88C08CD63DE9EA244F70BFC53BBCADF6
SHA1:	8F38A113A66B18BAA02E2C995099CF1145A29DAA
SHA-256:	127F903CC986466AA5A13C17DFDD37AC99762F81A794180339069F48986BC7A3
SHA-512:	78D2500493A65A23D101EC2420DC5F0CE8C75EFAC425C28547121643E4FB568E9D827EF2C0F7068159E043C86B986F29BF92C6BADC675F160B63C7B3512EB95F
Malicious:	false
Preview:	.ELF..............>.....................X...........@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..SP..h.........fff.............J.$<[.,$J.l=....J.$<.....f.K...............`.......P.......................z...................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......@....C....C.................@....C....C.................@...

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	2.799960074375893
Encrypted:	false
SSDEEP:	12:Bvx/ekjlM/NQQmTfR9yp9396QQmTfR9C6wRqD8MTDDw7lEOkSbfuEAXwX6BX2U8b:bDjO/NbmT3296bmT3Twk8qDwh7b7CD8
MD5:	75E79F5DB777862140B04CC6861C84A7
SHA1:	4DB7BDC80206765461AC68CEC03CE28689BBEE0C
SHA-256:	74E8885B87ED185E6811C23942FD9BD1FBAC9115768849AF95A9DECF6644B2EA
SHA-512:	FE3F86E926759E71494F2060C4ED3C883EBCAF20CB129A5AD7F142766C33FAB10B5FABC3C7C938E0E895E27EA0AC03CBFE8D0EEABF5300A4AD07F67FD96CC253
Malicious:	false
Preview:	.ELF..............>.................................@.....@.........................NaCl....x86-64.......clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)...text..comment..bss..group..note.GNU-stack..eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.......................................................!................................................................................................................................................................................................../../../pnacl/support/crtend.c.__EH_FRAME_END__...............................................................................................@...............................................................H.......................................P.......................H...............................

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=7511538a3a6a0b862c772eace49075ed1bbe2377, stripped
Category:	dropped
Size (bytes):	2163864
Entropy (8bit):	6.07050487397106
Encrypted:	false
SSDEEP:	24576:HPHonIwYZJ0ykwVO7Owf31yJKzCtxO8RSV4lY+PbeHVxCtjFV4lBNeSAmfGqa+A7:HvSMRwf3SKmlY+PyPvnM2Gq+
MD5:	0BB967D2E99BE65C05A646BC67734833
SHA1:	220A41A326F85081A74C4BB7C5F4E115D1B4B960
SHA-256:	C6C2D0C2FC3E38A9BFA19C78066439C2F745393F1FD1C49C3C6777F697222C76
SHA-512:	8EF8689E00E4B210A30444D18ED6247F364995ABEB2FD272064C3AF671EEDB4D9B8B67CA56F72FEBF8F56896D4EA7EC4B10CB445FFA1C710C1F312E9DA0E4896
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.23042.9340.exe, Detection: malicious, Browse Filename: Bcbcpa remittance89783839.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ATT26328.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ACCOUNTSTATEMENTCOPY.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ACCOUNTSTATEMENTCOPY.html, Detection: malicious, Browse Filename: ACH payment confirmation rdownes@farbestfoods.com .HTML, Detection: malicious, Browse Filename: ACH payment confirmation rdownes@farbestfoods.com .HTML, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: AgshealthWire-receipt.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ACH Payment.xlsx, Detection: malicious, Browse
Preview:	.ELF..............>..... .......@.........!.........@.8...@......................................................................................................................................................{......W...............................................@.......@...............P.td.....h.......h.......h......4b......4b..............Q.td................................................................NaCl....x86-64..............GNU.u.S.:j..,w...u...#w.......?......Y@.......@......1@......B@......P@.....@X@.....``@......h@.....pp@.....H.@.......@.......@.......@.......@.......@....`..@.......@.......A.......A......................p................@..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@........................................ ... ....... .......@...`...`...`...`...................`...`...`...`...`...`...`...................................`...

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40552
Entropy (8bit):	4.127255967843258
Encrypted:	false
SSDEEP:	768:xlP+1fzyUNVU5LmKxeOnjpD5eA/eUnUUxvT:xlP+1ryYMTekpD5eAWjuvT
MD5:	0CE951B216FCF76F754C9A845700F042
SHA1:	6F99A259C0C8DAD5AD29EE983D35B6A0835D8555
SHA-256:	7A1852EA4BB14A2A623521FA53F41F02F8BA3052046CF1AA0903CFAD0D1E1A7B
SHA-512:	7C2F9BF90EB1F43C17B4E14A077759FA9DC62A7239890975B2D6FD543B31289DC3B49AE456CA73B98DE9AC372034F340C708D23D9D3AAB05CCBDABDC56A6314E
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 624 `...................,...8...Z(..e...e...t...t...y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`........................fmod.fmodf.memcmp.memcpy.memmove.memset.__nacl_read_tp.__pnacl_init_irt.longjmp.setjmp.__Sz_fptosi_f32_i64.__Sz_fptosi_f64_i64.__Sz_fptoui_f32_i32.__Sz_fptoui_f32_i64.__Sz_fptoui_f64_i32.__Sz_fptoui_f64_i64.__Sz_sitofp_i64_f32.__Sz_sitofp_i64_f64.__Sz_uitofp_i32_f32.__Sz_uitofp_i32_f64.__Sz_uitofp_i64_f32.__Sz_uitofp_i64_f64.nacl_tp_tdb_offset.nacl_tp_tls_offset.__Sz_bitcast_16xi1_i16.__Sz_bitcast_8xi1_i8.__Sz_bitcast_i16_16xi1.__Sz_bitcast_i8_8xi1.__Sz_fptoui_4xi32_f32.__Sz_uitofp_4xi32_4xf32..e_fmod.o/ 0 0 0 644 2792 `..ELF..............>.....................(...........@.....@.......................................PH..AVAUATSfI.~.M..I.. E....@.A......D..D1.......8fI.~.M.....I.. E..A......D..D..t.D....D..f....D..=....r...Y...^.[A\A]A^..@..,$J.l=....J.$<A[A...M..

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	132784
Entropy (8bit):	3.6998481247844937
Encrypted:	false
SSDEEP:	384:Hf0mOXYmeKzQUIdedRFvT5p1Ee2HyAlL3O4:Hf7OXdmWRJT5p1R2HyAhO4
MD5:	C37CA2EB468E6F05A4E37DF6E6020D0F
SHA1:	EA787E5EADFB488632EC60D8B80B555796FA9FE9
SHA-256:	C1483ED423FEE15D86E8B5D698B2CDAB89186CE7FF9C4E3D5F3F961FD80D7C6E
SHA-512:	01281DE92B281FB29E1ACA96AA64B740B65CC3A9097307827F0D8DB9E1C164C56AFCDFA0BF138EA670A596D55CE2C8D722760744E9FC9343BB6514417BF333BA
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 942 `....;...\|.......4...x..#...-...4l..E...M...U...]...n...u...~X...4.......................L......................t...p...............`......"...*...1...:...D...K...T...\...d...r\|..\|0.......x...........L.......\...8..........................__clzti2.__compilerrt_fmax.__compilerrt_fmaxf.__compilerrt_logb.__compilerrt_logbf.__ctzti2.__divdc3.__divdi3.__divmoddi4.__divmodsi4.__divsc3.__divsi3.__divti3.__fixdfdi.__fixdfsi.__fixdfti.__fixsfdi.__fixsfsi.__fixsfti.__fixunsdfdi.__fixunsdfsi.__fixunsdfti.__fixunssfdi.__fixunssfsi.__fixunssfti.__floatdidf.__floatdisf.__floatsidf.__floatsisf.__floattidf.__floattisf.__floatundidf.__floatundisf.__floatunsidf.__floatunsisf.__floatuntidf.__floatuntisf.compilerrt_abort_impl.__moddi3.__modsi3.__modti3.__muldc3.__muloti4.__mulsc3.__multi3.__popcountdi2.__popcountsi2.__popcountti2.__powidf2.__powisf2.__udivdi3.__udivmoddi4.__udivmodsi4.__udivmodti4.__udivsi3.__udivti3.__umoddi3.__umodsi3.

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	13514
Entropy (8bit):	3.8217211433441904
Encrypted:	false
SSDEEP:	192:uU9v4pXizdrEuxwk3vp20tprpdSGFwDqO:P9v4palvvc0tpFdSGFwmO
MD5:	4E8BEDA73EB7BD99528BF62B7835A3FA
SHA1:	DC0F263A7B2A649D11FF7B56FE9CFAC44F946036
SHA-256:	6B835FD48DF505EB336FF6518CE7B93BB0ED854DADAA5C1EEED48D420291F62C
SHA-512:	46116B8BABC719676D68FD40D2AC82F38A3D13D8A482ADFC6FC32A99170AC3420E52CC33242CCD0FA723ABF4FA5EDBB9CE16A09C729BF04AE4AFBB2F67A1E38B
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 94 `................._pnacl_wrapper_start.__pnacl_real_irt_query_func.__pnacl_wrap_irt_query_func..shim_entry.o/ 0 0 0 644 7392 `..ELF..............>..................... ...........@.....@.........................NaCl....x86-64..................................A.L....A.L...D...........D....A.....t+.. u..t"..A.D..........A... .....A.D...........f..D..<.......................Q.......................V.......................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f).../../ppapi/native_client/src/untrusted/pnacl_irt_shim/shim_entry.c./mnt/data/b/build/slave/sdk/build/src/out_pnacl/x64.NACL_STARTUP_FINI.NACL_STARTUP_ENVC.NACL_STARTUP_ARGC.NACL_STARTUP_ARGV.NaClStartupInfoIndex.unsigned int.size_t.char.TYPE_na

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	2078
Entropy (8bit):	3.21751839673526
Encrypted:	false
SSDEEP:	24:MOcpdhWE5O/bZbmT3296bmT3TwQwDnvD/+R3:MHuECdaTS6aTTwXDvD/+l
MD5:	F950F89D06C45E63CE9862BE59E937C9
SHA1:	9CFAD34139CC428CE0C07A869C15B71A9632365D
SHA-256:	945B1C8A1666CBF05E8B8941B70D9D044BAAFB59B006F728F8995072DE7C4C40
SHA-512:	F9AFBB800A875EDCC63DEA4986179E73632B3182951A99C8B3D37DB454EFD7CC7192ECA5AC87514918A858BAD6DAEAB59548CA2E90EADA9900EF5B9F08E62CFC
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 30 `........._pnacl_wrapper_start..// 20 `.dummy_shim_entry.o/./0 0 0 0 644 1840 `..ELF..............>.................................@.....@.......................................PH..,$J.l=....J.$<.....f..D......................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x...................... ....C....C..... .........................rela.text..comment..bss..group..note.GNU-stack..rela.eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.....................................................................................................................................................

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=309d6d3d463e6b1b0690f39eb226b1e4c469b2ce, stripped
Category:	dropped
Size (bytes):	14091416
Entropy (8bit):	5.928868737447095
Encrypted:	false
SSDEEP:	196608:tKVqXp3Qev4dg6ilfHM8KLM2J3jqjnkZ:uqufB
MD5:	9B159191C29E766EBBF799FA951C581B
SHA1:	D1D4BBC63AB5FC1E4A54EB7B82095A6F2CE535EE
SHA-256:	2F4A3A0730142C5EE4FA2C05D27A5DEFC18886A382D45F5DB254B61B28ED642B
SHA-512:	0B4FF60B5428F81B8B1BCF3328CF80CBD88D8CE5E8BDBC236B06D5A54E7CF26168A3ABB348D87423DA613AB3F0B4D9B37CB5180804839F1CA158EC2B315DDF00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>..... .......@...................@.8...@...............$.....................................................................................................................!.......!......'......G...............................................@.......@...............P.td............................D.......D...............Q.td................................................................NaCl....x86-64..............GNU.0.m=F>k....&...i........................0C......0C..0C..0E..............0C......0E.-DT.!.?.-DT.!.........................?........-DT.!...-DT.!.?.......?......................?..............?."..."..."..."......@.......`...................... ...@...`...................... ...@...`...................... ...@...`...................... ...@...`.......................................`... ...@...`...........`...`.......@...@....... ....1..`3.. 4..`-..`-...:...:...F..@H..`H...H...F...F...G...H.. H...F..@G...I.. I..@I..@G...G...I...I...J...G..`I..

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=4b15de4ab227d5e46213978b8518d53c53ce1db9, stripped
Category:	dropped
Size (bytes):	1901720
Entropy (8bit):	5.955741933854651
Encrypted:	false
SSDEEP:	12288:gXqUSpBjwQO2o8k+7zjidg4euCAauOILffvCpGy4Wh3BTFmHpq82K2/KsvPyla9d:gafZwcOdNe2auOepCBTFmJq3Kf8ksr
MD5:	9DC3172630E525854B232FF71499D77C
SHA1:	0082C58EDCE3769E90DB48E7C26090CE706AD434
SHA-256:	6AA1DA6C264E0AF4E32A004F4076C7557C6AC6D9C38B0C5DE97302D83FA248C3
SHA-512:	9E9584241A39EED1463D7D4C1B26AE570B839AA315778FF3400C61341EBA43B630307DE9F1532A265CA82EA69BDEA03EC9D963E59A18569C02DA8285449870FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>..... .......@...................@.8...@.............................................................................................0.......0................................................Y......................................................@.......@...............P.td....t^......t^......t^.......W.......W..............Q.td................................................................NaCl....x86-64..............GNU.K..J.'..b......<S...`...`... ...@...@.......@.............................................Y@......................p................@.......?..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@`...`.......@.................................................. ...`... ... .......`................... ... ...@...`.......................@... Z...[...[...e.......... ...@... ...@...`........0...0...2..`4.. 6...7...9...~...~...z...{...{..

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.928261499316817
Encrypted:	false
SSDEEP:	3:STDLGswXEVBcVdBiTDt3zLsW:SPLGLErcVdBiDtf3
MD5:	C00BCE97F21B1AD61EB9B8CD001795EE
SHA1:	8E0392FF3DB267D847711C3F4E0D7468060E1535
SHA-256:	59F06F04230E32E8BC839F45B984D31D611930427B631C963D09E7064A602363
SHA-512:	9930E44A6ECC62505DBADCEED5E05645909FF09816FB12AAC0414E6D2830AC09758366C3B7D4EDD7839C87EB16DFA4C66D8981AE6237D408B37135C3506F4CD2
Malicious:	false
Preview:	1.6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	573
Entropy (8bit):	4.859567579783832
Encrypted:	false
SSDEEP:	12:BLqG6yDJmL4mLDlG9hQ181G46XzrXc+EFfNqpaiOc+T5NqXIOclNqXL:BkylmL4mLDlJ18116XsRNqtZeNqXIZlE
MD5:	1863B86D0863199AFDA179482032945F
SHA1:	36F56692E12F2A1EFCA7736C236A8D776B627A86
SHA-256:	F14E451CE2314D29087B8AD0309A1C8B8E81D847175EF46271E0EB49B4F84DC5
SHA-512:	836556F3D978A89D3FC1F07FCED2732A17E314ED6A021737F087E32A69BFA46FD706EBBDFD3607FF42EDCB75DC463C29B9D9D2F122504F567BB95844F579831B
Malicious:	false
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",.. "description": "Portable Native Client Translator Multi-CRX",. "name": "PNaCl Translator Multi-CRX",. "manifest_version": 2,. "minimum_chrome_version": "30.0.0.0",. "version": "0.57.44.2492",. "platforms": [. {. "nacl_arch": "x86-32",. "sub_package_path": "_platform_specific/x86_32/". },. {. "nacl_arch": "x86-64",. "sub_package_path": "_platform_specific/x86_64/". },. {. "nacl_arch": "arm",. "sub_package_path": "_platform_specific/arm/". }. ].}.

C:\Windows\debug\WIA\wiatrace.log

Download File

Process:	C:\Windows\SysWOW64\mspaint.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1526
Entropy (8bit):	5.2768677337661485
Encrypted:	false
SSDEEP:	24:0ucyUWF02k9YXCuUWF0q7URUWF0kuqbUWF0w3OoUWF0HXd/bXE34/U/Xd/Tz/Ul+:0uc5WSmX0WSBSWSkulWSw3eWS3RzE34k
MD5:	BDACDEA0553C16D25EA680F15B095B39
SHA1:	484A9D3DF68BAED7124E9E8CAF1CE68C935FAB26
SHA-256:	50196190F68C64485B0F3EF73E7295B18903B97D728D56B239282CED946935C8
SHA-512:	120991FDAF1A9F577B27DAA9270E5525EA84BA4705FB77C3DF1E83B55CBBA032E7BB87720965E6C689001759D0B119B7485DA3142209BD95F3C58FB3FA92645F
Malicious:	false
Preview:	..************** Started trace for Module: [sti.dll] in Executable [mspaint.exe] ProcessID: [7068] at 2023/08/25 15:28:15:767 **************..WIA: 7068.7064 16 0 0 [sti.dll] AsyncRPCEventTransport::OpenConnectionToServer, AsyncRPC Connection established to server..WIA: 7068.7064 16 0 0 [sti.dll] AsyncRPCEventTransport::OpenConnectionToServer, Got my context 02DA7FE0 from server...WIA: 7068.7064 16 0 0 [sti.dll] WiaEventReceiver::Start, WiaEventReceiver Started.....WIA: 7068.2228 16 0 0 [sti.dll] AsyncRPCEventTransport::CloseNotificationChannel, Closing the async notification channel.....WIA: 7068.2228 16 0 0 [sti.dll] AsyncRPCEventTransport::OpenNotificationChannel, Opening the async notification channel.....WIA: 7068.7064 16 0 0 [sti.dll] AsyncRPCEventTransport::SendRegisterUnregisterInfo, Sent RPC Register/Unregister information...WIA: 7068.7064 16 0 0 [sti.dll] WiaEventReceiver::SendRegisterUnregisterInfo, Added new registration:..WIA: 7068.7064 16 0 0 [sti.dll] EventRegistratio

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057605
Encrypted:	false
SSDEEP:	3:8Kiun9ks:8Kiun2s
MD5:	9F9FA94F28FE0DE82BC8FD039A7BDB24
SHA1:	6FE91F82974BD5B101782941064BCB2AFDEB17D8
SHA-256:	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
SHA-512:	34946EF12CE635F3445ED7B945CF2C272EF7DD9482DA6B1A49C9D09A6C9E111B19B130A3EEBE5AC0CCD394C523B54DD7EB9BF052168979A9E37E7DB174433F64
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE1LjAuNTc5MC4xNzESFwlpWQBsWJZXwBIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgA=

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2345), with CRLF line terminators
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 111100
Category:	downloaded
Size (bytes):	20105
Entropy (8bit):	7.980108733727221
Encrypted:	false
SSDEEP:	384:ekqQ8rNFEhCgMyL2iww6oIR8mWG4UbcFII2IydQcrQl4V5Cxt:9CGEiL/w7R81UgFIjicru4Vsxt
MD5:	E759D76139117DE00214DA95C3B6C0ED
SHA1:	C11ACF355368525D321B781F06ECB3B4DD3F8980
SHA-256:	636E68CF84FBB20CB7DA5B5F3CDDAD43946C81A3899ACDE89C77F14769781834
SHA-512:	EA34A4166814D39338A1360CBBB9520966D669963A28C839E4AA4B874A4D6247A1B1E7591F3099C5CBB92E01B629F9E71481D468150D78A02D897CEB0AF8AE26
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
Preview:	...........}ks.6.....\.R;.J.H=-WR;..&>g^53.G.R[.DY<C..$e.WG..... )...{+'g...l............bw_f7.:x..<x.-.V5)/wE..Y...gy.0.(.-o.e.\|..._..I.....?<{.!x...W..._..^..p..E..'..Y...<.....]..6(. ..D.....Y.......:.ve.?..!..\|t...].+.......a.......\|.P...u.H.d.d.r.c[..~.L..n.-.}e.H3...r..^..iP.u..z.....)..Z.jx..C'......u..{.C...N.o.m~..F(b..f.....h..O.....6....kr.......n2m M$.R..R..i{.~.....n.dKY..#.Kn.4..G...O..l.#.a=..iU..].S.2.wY..O.\|...Z.A....].uU.._%U.<...pp..u=.....C.R..S.....0...A<......&...W..'o.T.."..jO..^+.....DiW.b..7i..7..........lKe.0.~B0.....zQu#...YB.,.{.&.6..G.6..._...J.i.?.LS$( .^.{..u.-.0....K....M&j..s.yB..+....^.)...7e.....]..eFI_.kRX.B......D[.4......+.u=>....R.`QEK...R..d...*S.. ,c5RKBK(......][..eF{T.....6...".....Uk:..S.0Ro.}B.dwJZ}U..S.F.....&.&.~\|......{..Ep.>x..._....}p..=.}...v...7?}...g..1&.......}...^...o.x.>x...../.^....._.........w.v./.........BA...{J..w..$?.}w....?zO.r..5...7.gl..z...g.?.{....R.......yGj

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	689016
Entropy (8bit):	4.210696031972732
Encrypted:	false
SSDEEP:	6144:DnQWWDY3mr16XRxcpuEhjMPRKkC0d7xyF0FA9OgoUE0HUN4oe+:DBWU3xhDKkTshoj5
MD5:	3B72E939A304CE05F0CEAB4A0AC39DD9
SHA1:	B2CFD3CB1BD0EE53C795E040063D0F55F544D939
SHA-256:	CC58721894324D6F6F53B7FE4CB0D08F923AA75E52506C0A58D29E4390B7CEDD
SHA-512:	F4AF43BA51B76496C98A30F06D9903440C4957E18F82B09D2B9C706CAD5939446D8BAA4353FD0620A2F68CEA79878824CD2313594997F0F8403C13FF767E6112
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_2W3IEdsiCwViwvv0RWyRLg2.js
Preview:	!(function (e) {. function n(n) {. for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++). (i = o[s]),. Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]),. (a[i] = 0);. for (t in r) Object.prototype.hasOwnProperty.call(r, t) && (e[t] = r[t]);. for (d && d(n); c.length; ) c.shift()();. }. var t,. i = {},. a = { 22: 0 };. function o(n) {. if (i[n]) return i[n].exports;. var t = (i[n] = { i: n, l: !1, exports: {} });. return e[n].call(t.exports, t, t.exports, o), (t.l = !0), t.exports;. }. Function.prototype.bind \|\|. ((t = Array.prototype.slice),. (Function.prototype.bind = function (e) {. if ("function" != typeof this). throw new TypeError(. "Function.prototype.bind - what is trying to be bound is not callable". );. var n = t.call(arguments, 1),. i = n.length,. a = this,. o = function () {},. r = function () {. return (.

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
URL:	https://0ffice-authentication.com/aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Static File Info

General

File type:	PNG image data, 340 x 338, 8-bit/color RGBA, non-interlaced
Entropy (8bit):	7.988507609338744
TrID:	Portable Network Graphics (16016/1) 100.00%
File name:	MFA.png
File size:	176'475 bytes
MD5:	af8f9a21b423aa84a456d75bdcaf5c7e
SHA1:	8ee182c96de7e89e037da752ee0addd2ad80c97e
SHA256:	2e2bf46a0b5e6fb48e46c60711d2fc4ad90418d47999f8d2c5944aeae1b5e388
SHA512:	dfe511bbbcab66b18ac55d828b87379df9821af246d611ff393198c492924c63ff0e7daf9109fe62e1948d8c42345de0c4639029195e2a7dccc1840395cbae5e
SSDEEP:	3072:xOA97aBbe+l6NZwPpTItVuN8GJaduD71PQUsuLdBH8WHuvVqqZiNRdixgM1PDSDC:xO6ov6NZwPpTItcuGJad8WU9pBH8WoII
TLSH:	DD042353B7F6092156EC1CA7EA2A84E409229DC2C5176F1FB84EF8ED23370505E8EDB4
File Content Preview:	.PNG........IHDR...T...R.......'....miCCPICC Profile..H..W.XS...[.....@@J.M.......H/.....J..A.^..\....].Ql+ v.....bAEY.u...&$......}s..3g.S.L.=.h}.I.y.6....YBx0stZ:...`.. @..y\|............n@K(W..\.....+.... c!...........Ke....z...R%........*%.V..J.....m..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 25, 2023 15:28:22.795393944 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.795474052 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.795568943 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.796822071 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.796854019 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.806679964 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.806756020 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.806853056 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.807220936 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.807260990 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.810756922 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.810830116 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.810923100 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.811803102 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.811839104 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.864876986 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.866491079 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.866549015 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.868190050 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.868292093 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.872704983 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.872890949 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.873306990 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.873332977 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.874227047 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.874521017 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.874567032 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.875200033 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.875296116 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.876575947 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.876648903 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.878005981 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.878108025 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.878410101 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.878439903 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.913511038 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.916706085 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.916840076 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.916882038 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.916997910 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.917073011 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.920061111 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.920092106 CEST	443	49724	142.250.203.110	192.168.2.5
Aug 25, 2023 15:28:22.920161963 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.920183897 CEST	49724	443	192.168.2.5	142.250.203.110
Aug 25, 2023 15:28:22.938401937 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.938735962 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.938832045 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.939706087 CEST	49723	443	192.168.2.5	172.217.168.77
Aug 25, 2023 15:28:22.939745903 CEST	443	49723	172.217.168.77	192.168.2.5
Aug 25, 2023 15:28:22.946278095 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.946695089 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.946748018 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.948427916 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.948525906 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.956140041 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.956357002 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.956522942 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:22.956578016 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:22.996503115 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.058429956 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.058619976 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.058758974 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.060420036 CEST	49725	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.060466051 CEST	443	49725	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.063947916 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.064013958 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.064126968 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.064436913 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.064475060 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.183558941 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.183862925 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.183917046 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.184987068 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.187338114 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.187582970 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.187603951 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.187628984 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.227488995 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.586659908 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586724997 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586791039 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586824894 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.586843967 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586886883 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586915970 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586940050 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.586945057 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.586958885 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.586982012 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.586997032 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.587037086 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.587127924 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.587193012 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.595613956 CEST	49728	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.595643044 CEST	443	49728	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.645555019 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.645622969 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.645755053 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.646037102 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.646063089 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.752285957 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.753278017 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.753338099 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.754336119 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.754823923 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.755021095 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.755045891 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:23.755129099 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:23.794606924 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727221012 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727319002 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727389097 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727411032 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727447033 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727500916 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727551937 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727612019 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727612019 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727678061 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727754116 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727754116 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727780104 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727818966 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727888107 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727905989 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.727938890 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.727998972 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.774553061 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.774719954 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.774765968 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.774771929 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.774842024 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.778234005 CEST	49729	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.778292894 CEST	443	49729	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.857285023 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.857378006 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.857527018 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.857762098 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.857836962 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.857928991 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.858117104 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.858164072 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:24.858403921 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:24.858468056 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.000524998 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.000912905 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.000957012 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.001933098 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.002419949 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.002609015 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.002639055 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.002712011 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.026725054 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.027476072 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.027513027 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.028217077 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.028779030 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.028989077 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.029025078 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.029072046 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.042633057 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.068627119 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.282206059 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.283683062 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.283826113 CEST	443	49732	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.283966064 CEST	49732	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.380673885 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.380732059 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.380815983 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.380836964 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.381158113 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.381228924 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.381262064 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.381731033 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.427742958 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.427855015 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.427911043 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.427917957 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.427972078 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.427993059 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.429857016 CEST	49731	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.429903030 CEST	443	49731	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.467652082 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.467724085 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.467863083 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.469851017 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.469896078 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.471167088 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.471256971 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.471404076 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.471765995 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.471821070 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.522726059 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.522797108 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.522891998 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.523502111 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.523559093 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.523710966 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.524329901 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.524380922 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.524671078 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.524743080 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.558450937 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.558814049 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.558875084 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.560537100 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.560647964 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.561878920 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.562020063 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.593573093 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.594126940 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.594223976 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.596231937 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.596379995 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.596935034 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.597121000 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.597196102 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.597254038 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.601699114 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.601737976 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:25.636729002 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.636794090 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.641721010 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:25.656024933 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.657119036 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.657179117 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.657881975 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.658391953 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.658545971 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.658607960 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.658653975 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.659063101 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.662698030 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.662759066 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.664196968 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.664366961 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.665163994 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.665278912 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.665388107 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.665431023 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.677700996 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.698868990 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.705718994 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.705765963 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.746704102 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814151049 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814203024 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814215899 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814238071 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814279079 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814292908 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814332962 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814364910 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814364910 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814393044 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814414978 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814431906 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814464092 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.814476967 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814538956 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.814555883 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.854770899 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.866054058 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.866095066 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.866180897 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.866187096 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.866218090 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.866240025 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.866264105 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.866328001 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.900312901 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.900358915 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.900460005 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.900497913 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.900525093 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.906258106 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.917541027 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.917577028 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.917684078 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.917715073 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.917751074 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.918016911 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918045044 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918117046 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.918134928 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918162107 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.918657064 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918709040 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918754101 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.918771982 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.918809891 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.919220924 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919254065 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919325113 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.919342041 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919367075 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.919826984 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919866085 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919919968 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.919943094 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.919966936 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.947688103 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.947719097 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.951862097 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.951972961 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.951972961 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.952007055 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.952060938 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.952296972 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.952347040 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.952414989 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.952440977 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.952467918 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.958566904 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.958609104 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.958620071 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.958646059 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.958655119 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.958663940 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959170103 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959201097 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959220886 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959238052 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959263086 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959264040 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959281921 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959281921 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959292889 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959306955 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959316969 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959342003 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959357977 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959373951 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959392071 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.959450960 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.959542036 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.960932970 CEST	49738	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.960975885 CEST	443	49738	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.962064028 CEST	49736	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.962111950 CEST	443	49736	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.972486973 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.972536087 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.972594023 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.972642899 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.972672939 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.972970963 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973012924 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973042011 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.973061085 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973088026 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.973505974 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973541021 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973598003 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.973613977 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.973639965 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.974122047 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974165916 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974216938 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.974239111 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974262953 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.974633932 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974670887 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974715948 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.974730968 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.974759102 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.977565050 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.977653027 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.977730989 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.977755070 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.977778912 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.979511023 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.979567051 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.979625940 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.979645014 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.979671001 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.982495070 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.982548952 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.982758045 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.982777119 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.982811928 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.984702110 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.984738111 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:25.984862089 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:25.984882116 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003345966 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003391027 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003468037 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.003492117 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003516912 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003519058 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.003556967 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003604889 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.003622055 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.003650904 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.003989935 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.004036903 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.004091024 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.004106998 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.004153013 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.025825024 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.025871038 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.025974035 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.026007891 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026037931 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.026221991 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026261091 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026307106 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.026321888 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026346922 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.026880980 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026913881 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.026974916 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.027009010 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.027040958 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.027427912 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.027484894 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.027515888 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.027534962 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.027580023 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.028013945 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028044939 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028106928 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.028146029 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028172970 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.028628111 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028667927 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028728008 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.028749943 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.028772116 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.031656981 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.031689882 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.031759024 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.031779051 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.031804085 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.035809994 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.035850048 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.035958052 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.035984039 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.036006927 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.036827087 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.036855936 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.036919117 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.036935091 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.036974907 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.040695906 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.040761948 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.040838003 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.040858984 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.040925026 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.042607069 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.042655945 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.042732954 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.042756081 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.042781115 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.044765949 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.044825077 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.044883013 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.044905901 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.044930935 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.048665047 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.048738003 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.048811913 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.048835039 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.048857927 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.050806999 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.050887108 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.050946951 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.050967932 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.050991058 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.053778887 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.053838968 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.053972006 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.054001093 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.055896997 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.055968046 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.056107044 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.056107044 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.056159019 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.059727907 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.059802055 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.059859991 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.059891939 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.059920073 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.060595036 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.060630083 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.060734034 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.060760975 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.060786963 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.060787916 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.060874939 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.077879906 CEST	49737	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.077912092 CEST	443	49737	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.144696951 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.144794941 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.144906044 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.145334005 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.145373106 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.215038061 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.215095997 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.215217113 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.215444088 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.215482950 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.284538031 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.284960985 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.285027981 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.285715103 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.286410093 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.286592007 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.286690950 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.286746979 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.328284979 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.333564997 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.333960056 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.334007025 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.335212946 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.338102102 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.338258982 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.338371992 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.338428020 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.377860069 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.660872936 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.660962105 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.660988092 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661060095 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661077976 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661103010 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661143064 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661178112 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661178112 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661178112 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661211014 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661264896 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661334038 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.661351919 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661741972 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.661818981 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.672455072 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.672519922 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.672600031 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.673098087 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.673126936 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.697900057 CEST	49740	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.697951078 CEST	443	49740	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.740034103 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.752935886 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.752966881 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.754766941 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.754903078 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.757246017 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.757467985 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.798671007 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.798702955 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:26.839968920 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:26.844691038 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.844770908 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.844865084 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.845288038 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.845321894 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.982748985 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.983155012 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.983222008 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.985387087 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.985522985 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.986007929 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:26.986160994 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:26.986215115 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.027481079 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.072168112 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.072220087 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.275419950 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.443320036 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443353891 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443407059 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443423033 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443636894 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443691969 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.443726063 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443743944 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443770885 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.443789005 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.443840981 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.443939924 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.447410107 CEST	49741	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.447443962 CEST	443	49741	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493598938 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493674994 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493700027 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493747950 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493788958 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493818998 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.493915081 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.493916035 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.493916035 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.493916035 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.493994951 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.494045019 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.494067907 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.494086981 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.494138002 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.494153023 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.494453907 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.494544029 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.500829935 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.500888109 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.501014948 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.501287937 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.501321077 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.502343893 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.502430916 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.502511978 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.502831936 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.502866983 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.503948927 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.504021883 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.504110098 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.504431963 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.504476070 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.506846905 CEST	49743	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.506912947 CEST	443	49743	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.666429043 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.667289972 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.667361021 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.670010090 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.670511007 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.670555115 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.670916080 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.671025038 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.671278000 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.676871061 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.677098036 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.677511930 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.677748919 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.677793026 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.677828074 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.677865982 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.677921057 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.684933901 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.685307980 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.685345888 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.686023951 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.686532021 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.686757088 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.688553095 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.688644886 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.765727043 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:27.765777111 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:27.865731001 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.585505009 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.585575104 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.585654974 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.585694075 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.587301970 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.587399960 CEST	443	49747	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.587568045 CEST	49747	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.592669010 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.592751026 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.592874050 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.593154907 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.593194962 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.648125887 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.648911953 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.648943901 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.649048090 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.649077892 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.649120092 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.649136066 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.649188042 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.649221897 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.649250984 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.649300098 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.650362968 CEST	49745	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.650391102 CEST	443	49745	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.653033972 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.653146029 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.653255939 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.653906107 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.653939962 CEST	443	49746	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.653986931 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.654035091 CEST	49746	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.701627016 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.703682899 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.703737020 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.704765081 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.709738016 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.709959984 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.710015059 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.750227928 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.750322104 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.750433922 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.750956059 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.751044035 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.751127005 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.751224995 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.751265049 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.751471043 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.751492977 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.751502037 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.765836954 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.876565933 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.877166033 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.877223969 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.877784014 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.877845049 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.878016949 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.878242016 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.878269911 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.878370047 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.879040003 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.879373074 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.879487038 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.879559994 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.903384924 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.903811932 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.903862000 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.906368017 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.906557083 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.907145977 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.907310963 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.907402992 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.907449961 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.918780088 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.947022915 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:28.947074890 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:28.987818956 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.007797003 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.008830070 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.008872986 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.010281086 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.011286974 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.011490107 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.011507988 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.011545897 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.027307987 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.027349949 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.027489901 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.027528048 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.028975964 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.029058933 CEST	443	49748	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.029148102 CEST	49748	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.050801992 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.218154907 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.221162081 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.221271992 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.221297979 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.221353054 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.221430063 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.221756935 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.221785069 CEST	443	49749	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.221870899 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.221870899 CEST	49749	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.348819971 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.348865986 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.349064112 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.349129915 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.349214077 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.352355003 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.352514982 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.352615118 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.364691019 CEST	49752	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:29.364737988 CEST	443	49752	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.747061968 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.750209093 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:29.750375986 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:30.222455978 CEST	49750	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:30.222522020 CEST	443	49750	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:30.523626089 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:30.523793936 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:30.523886919 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:31.244306087 CEST	49735	443	192.168.2.5	13.107.246.60
Aug 25, 2023 15:28:31.244357109 CEST	443	49735	13.107.246.60	192.168.2.5
Aug 25, 2023 15:28:31.244868994 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.244925976 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.245023012 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.245410919 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.245439053 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.360713005 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.361797094 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.361880064 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.362744093 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.363519907 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.363683939 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.363717079 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.407476902 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.493052959 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.649180889 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.649265051 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.649403095 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.847137928 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.850162029 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.850307941 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:31.850325108 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:31.850402117 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.802916050 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.802994967 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.885726929 CEST	49753	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.885785103 CEST	443	49753	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.911942959 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.919275045 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.919348955 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.920850039 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.949726105 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.949918032 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:32.949945927 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.950263977 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:32.999222994 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:33.282736063 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:33.289513111 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:33.289611101 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:33.290107965 CEST	49754	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:33.290141106 CEST	443	49754	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:36.792227030 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:36.792339087 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:36.792426109 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:39.142256975 CEST	49742	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:28:39.142297029 CEST	443	49742	172.217.168.68	192.168.2.5
Aug 25, 2023 15:28:39.142532110 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.142580032 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.142719984 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.143075943 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.143107891 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.264353037 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.272957087 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.273005009 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.273789883 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.313922882 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.314167976 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.314213037 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.335171938 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.335278034 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.335391998 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.336816072 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.336855888 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.450773954 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.453504086 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.453569889 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.454828978 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.455787897 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.455950975 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.455964088 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.456024885 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.494491100 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.499608040 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.735296965 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.739051104 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.739137888 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.739682913 CEST	49759	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.739702940 CEST	443	49759	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.756932974 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.756987095 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.757061005 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.757471085 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.757492065 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.884526968 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.898329020 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.898395061 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.899137020 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.899657965 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.899836063 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:39.899854898 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.899890900 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:39.998451948 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.213066101 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.216028929 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.216186047 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.221600056 CEST	49761	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.221637011 CEST	443	49761	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580476999 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580549002 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580569983 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580672026 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580708027 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580708027 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580724001 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580753088 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580775976 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580775976 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580787897 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580806971 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580811024 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580933094 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580950975 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.580956936 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.580986023 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581027031 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581027031 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581044912 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581060886 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581103086 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581123114 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581159115 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581176996 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581195116 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581224918 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581289053 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581299067 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581350088 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.581372976 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:28:40.581456900 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.591036081 CEST	49758	443	192.168.2.5	46.243.183.6
Aug 25, 2023 15:28:40.591084003 CEST	443	49758	46.243.183.6	192.168.2.5
Aug 25, 2023 15:29:26.704163074 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:26.704217911 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.704329967 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:26.704823017 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:26.704842091 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.761707067 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.762101889 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:26.762135029 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.763151884 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.763748884 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:26.763915062 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:26.810760975 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:36.746804953 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:36.746920109 CEST	443	49791	172.217.168.68	192.168.2.5
Aug 25, 2023 15:29:36.747035027 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:37.278827906 CEST	49791	443	192.168.2.5	172.217.168.68
Aug 25, 2023 15:29:37.278904915 CEST	443	49791	172.217.168.68	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 25, 2023 15:28:22.769032001 CEST	65212	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.769383907 CEST	50088	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.770180941 CEST	54988	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.770554066 CEST	53183	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.770934105 CEST	60422	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.771276951 CEST	64219	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:22.785320997 CEST	53	53183	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.789494991 CEST	53	54988	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.799032927 CEST	53	65212	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.803404093 CEST	53	64219	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.804579020 CEST	53	60422	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.808648109 CEST	53	50088	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:22.826730013 CEST	53	64997	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:23.062840939 CEST	53	51019	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:24.780328035 CEST	57619	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:24.781080961 CEST	56046	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:25.407326937 CEST	56852	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:25.407679081 CEST	54947	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:25.427634954 CEST	53	54947	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:25.436326027 CEST	53	56852	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:26.640844107 CEST	53460	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:26.641246080 CEST	63275	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:26.661397934 CEST	53	63275	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:26.670108080 CEST	53	53460	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:26.798877001 CEST	57156	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:26.799386978 CEST	59551	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:28:26.830024004 CEST	53	59551	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:26.843677998 CEST	53	57156	8.8.8.8	192.168.2.5
Aug 25, 2023 15:28:39.381781101 CEST	53	52943	8.8.8.8	192.168.2.5
Aug 25, 2023 15:29:22.051229954 CEST	53	62986	8.8.8.8	192.168.2.5
Aug 25, 2023 15:29:24.872462034 CEST	59094	53	192.168.2.5	8.8.8.8
Aug 25, 2023 15:29:24.872967005 CEST	65259	53	192.168.2.5	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 25, 2023 15:28:22.826988935 CEST	192.168.2.5	8.8.8.8	d03b	(Port unreachable)	Destination Unreachable
Aug 25, 2023 15:29:41.846081018 CEST	192.168.2.5	8.8.8.8	d0c3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 25, 2023 15:28:22.769032001 CEST	192.168.2.5	8.8.8.8	0x2d29	Standard query (0)	0ffice-authentication.com	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:22.769383907 CEST	192.168.2.5	8.8.8.8	0xd227	Standard query (0)	0ffice-authentication.com	65	IN (0x0001)	false
Aug 25, 2023 15:28:22.770180941 CEST	192.168.2.5	8.8.8.8	0x1013	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:22.770554066 CEST	192.168.2.5	8.8.8.8	0x9b81	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Aug 25, 2023 15:28:22.770934105 CEST	192.168.2.5	8.8.8.8	0x18ed	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:22.771276951 CEST	192.168.2.5	8.8.8.8	0xe282	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Aug 25, 2023 15:28:24.780328035 CEST	192.168.2.5	8.8.8.8	0xba72	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:24.781080961 CEST	192.168.2.5	8.8.8.8	0x91f1	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Aug 25, 2023 15:28:25.407326937 CEST	192.168.2.5	8.8.8.8	0x47db	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:25.407679081 CEST	192.168.2.5	8.8.8.8	0x1807	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Aug 25, 2023 15:28:26.640844107 CEST	192.168.2.5	8.8.8.8	0x2e37	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:26.641246080 CEST	192.168.2.5	8.8.8.8	0x1a77	Standard query (0)	www.google.com	65	IN (0x0001)	false
Aug 25, 2023 15:28:26.798877001 CEST	192.168.2.5	8.8.8.8	0x56e2	Standard query (0)	0ffice-authentication.com	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:26.799386978 CEST	192.168.2.5	8.8.8.8	0x7dd4	Standard query (0)	0ffice-authentication.com	65	IN (0x0001)	false
Aug 25, 2023 15:29:24.872462034 CEST	192.168.2.5	8.8.8.8	0x9680	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:29:24.872967005 CEST	192.168.2.5	8.8.8.8	0x9f38	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 25, 2023 15:28:22.789494991 CEST	8.8.8.8	192.168.2.5	0x1013	No error (0)	accounts.google.com		172.217.168.77	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:22.799032927 CEST	8.8.8.8	192.168.2.5	0x2d29	No error (0)	0ffice-authentication.com		46.243.183.6	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:22.803404093 CEST	8.8.8.8	192.168.2.5	0xe282	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:22.804579020 CEST	8.8.8.8	192.168.2.5	0x18ed	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:22.804579020 CEST	8.8.8.8	192.168.2.5	0x18ed	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:24.801498890 CEST	8.8.8.8	192.168.2.5	0x91f1	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:24.807265043 CEST	8.8.8.8	192.168.2.5	0xba72	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:25.427634954 CEST	8.8.8.8	192.168.2.5	0x1807	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:25.431605101 CEST	8.8.8.8	192.168.2.5	0x4b59	No error (0)	dual.part-0032.t-0009.t-msedge.net	part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:25.431960106 CEST	8.8.8.8	192.168.2.5	0x88e3	No error (0)	dual.part-0032.t-0009.t-msedge.net	part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:25.431960106 CEST	8.8.8.8	192.168.2.5	0x88e3	No error (0)	part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:25.431960106 CEST	8.8.8.8	192.168.2.5	0x88e3	No error (0)	part-0032.t-0009.t-msedge.net		13.107.213.60	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:25.436326027 CEST	8.8.8.8	192.168.2.5	0x47db	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:28:25.436326027 CEST	8.8.8.8	192.168.2.5	0x47db	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:26.661397934 CEST	8.8.8.8	192.168.2.5	0x1a77	No error (0)	www.google.com			65	IN (0x0001)	false
Aug 25, 2023 15:28:26.670108080 CEST	8.8.8.8	192.168.2.5	0x2e37	No error (0)	www.google.com		172.217.168.68	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:28:26.843677998 CEST	8.8.8.8	192.168.2.5	0x56e2	No error (0)	0ffice-authentication.com		46.243.183.6	A (IP address)	IN (0x0001)	false
Aug 25, 2023 15:29:24.896408081 CEST	8.8.8.8	192.168.2.5	0x9f38	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 25, 2023 15:29:24.899677992 CEST	8.8.8.8	192.168.2.5	0x9680	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

0ffice-authentication.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49723	172.217.168.77	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:22 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Dvrtrktau_uydMvoGc1_xfN2ULJBRPHxz6q2oM2aufczSxk8Cchv3g2jlLVO-eHXlJ_BwPi1P-zYcjdR9AuTyG10jrJ2AzQ7yL8SBUliEafdzZn70Pmm-r8GrPXaz7LFgctn_yZRHpJXI09tbP_WroWCmYwT_a7Fwj8gHnQ5nbY; AEC=Ad49MVGGktvnyMQBXjxfVM4VyQMgBORLkDWV_5bpQs3oS50vEqIAFgkFMBQ; CONSENT=PENDING+008; SOCS=CAESHAgCEhJnd3NfMjAyMzA4MDMtMF9SQzIaAmRlIAEaBgiA0dCmBg; __Secure-ENID=14.SE=ASWfeSSVBcK3LyggZgGhgI5yIs3Z2wYpfR6yuK81LiYU6I0bFs937AKcakQoHnJkxVLloWnpVW_r8Ar2dupLdGHUm260SY6_u_8bKbtIVuC2UT3_Sjp3_6n5MjyjVSOfngggQke4VZle0rxsEtTK1UwAzXaROx3bb_2_jH9Xta1jpoaREw
2023-08-25 13:28:22 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-08-25 13:28:22 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 25 Aug 2023 13:28:22 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-lQPVu-nyogNGR7b3bDWlTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-25 13:28:22 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-08-25 13:28:22 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49724	142.250.203.110	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:22 UTC	1	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-115.0.5790.171 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-25 13:28:22 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-daLPtkAgijsf1-XVyCU_KQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 25 Aug 2023 13:28:22 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6080 X-Daystart: 23302 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-08-25 13:28:22 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 30 38 30 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 33 33 30 32 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6080" elapsed_seconds="23302"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-08-25 13:28:22 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-08-25 13:28:22 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49740	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:26 UTC	846	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:26 UTC	850	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:26 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 0c4fb9c2-c01e-000f-56b3-d4be6c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132826Z-gvh4egp9k52kdd667ytenycgp800000002wg000000007ad9 X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:26 UTC	851	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2023-08-25 13:28:26 UTC	866	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49741	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:26 UTC	848	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
2023-08-25 13:28:27 UTC	869	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:27 GMT Content-Type: application/x-javascript content-length: 109863 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:54 GMT ETag: 0x8DAFF34DD9DC630 x-ms-request-id: 4918f058-a01e-0009-5258-d74460000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132826Z-9qpxpsnq3p5hx45fff464wuq5n00000002mg00000001pfsk X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:27 UTC	870	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6b 7b db c8 91 30 fa 7d 7f 05 c5 93 68 00 13 a4 48 ea 6a 92 10 d7 e3 f1 64 bd c7 63 fb b5 3d d9 37 af cc f8 81 c8 a6 84 31 04 30 b8 d8 56 44 ee 6f 3f 55 d5 77 a0 49 c9 1e 27 9b 73 4e 9e 8c 45 34 1a 7d a9 ae ae ae aa ae cb c1 a3 bd 7f 6b 3d 6a 75 1f fe bf d6 db 77 4f de bc 6b bd fa b9 f5 ee 3f 9e bf f9 a9 f5 1a 9e fe d2 7a f9 ea dd f3 a7 cf 1e de 0e 76 8a ff bd bb 8e 8b d6 32 4e 58 0b fe 5e 46 05 5b b4 b2 b4 95 e5 ad 38 9d 67 f9 2a cb a3 92 15 ad 1b f8 37 8f a3 a4 b5 cc b3 9b 56 79 cd 5a ab 3c fb 8d cd cb a2 95 c4 45 09 1f 5d b2 24 fb dc f2 a0 b9 7c d1 7a 1d e5 e5 6d eb f9 6b bf 07 ed 33 68 2d be 8a 53 f8 7a 9e ad 6e e1 f7 75 d9 4a b3 32 9e b3 56 94 2e a8 b5 04 1e d2 82 b5 aa 74 c1 f2 d6 e7 eb 78 7e dd fa 25 9e e7 59 91 Data Ascii: k{0}hHjdc=710VDo?UwI'sNE4}k=juwOk?zv2NX^F[8g*7VyZ<E]$\|zmk3h-SznuJ2V.tx~%Y
2023-08-25 13:28:27 UTC	885	IN	Data Raw: a3 b5 83 5d cd d6 d3 73 7a 32 c0 26 c8 e3 9b 29 ff e3 f9 e4 9e 2b 72 16 fc f5 7d d1 59 c3 7f 7f e0 69 0b 36 68 6a 2f 5f fe 44 99 1d ea 3e c1 22 b6 c1 58 6e 0e 32 31 06 09 af 13 b6 c3 b6 19 8a c7 74 f8 fb bb 3e 7d 8c 8b 6d 20 fc 48 83 3d 38 ff ce 43 1d e0 26 33 1c dc e9 ac 2c e9 84 24 af 02 6d 4b b1 f1 8d e4 b3 a9 07 6b ee 63 10 b7 c3 46 10 b7 b2 c7 13 2c fe 12 ad fe c4 83 02 66 3c ae fe 91 ef 78 13 18 d5 9f 66 69 81 a1 ab 29 9e da 99 df 7c a1 2a bf c4 ac a2 18 77 7b e0 1b 25 38 9e a3 2d a9 8c 71 00 c7 3c 68 db 71 5f 04 6d 3b 3e 39 f1 7b b4 ae 6f 59 09 84 06 bb 3d f5 7b d0 e1 0a 08 d8 8b b8 28 6b 61 bc 39 29 c7 a0 ce 44 e6 3f 50 4a dd 0c d3 fd 3e c9 31 50 46 1b 0b da 94 4d 41 56 e1 dc d4 1b cc 40 68 56 d4 c5 b5 ea 1f e3 d5 9f 11 d3 23 ec d5 fe c4 7a d5 e6 Data Ascii: ]sz2&)+r}Yi6hj/_D>"Xn21t>}m H=8C&3,$mKkcF,f<xfi)\|*w{%8-q<hq_m;>9{oY={(ka9)D?PJ>1PFMAV@hV#z
2023-08-25 13:28:27 UTC	886	IN	Data Raw: 23 30 22 75 c1 a1 5b a0 67 5c a3 58 32 27 9a 62 c7 a1 cd 04 4a 6f 34 45 70 03 b3 9f b8 bb 44 67 b9 38 b0 3b 37 09 72 77 d0 9d 93 c7 5d ad 74 cb 27 62 b8 95 4f e1 cc ec 52 35 5a 41 ba 85 ae 58 30 9c 7a a4 44 c9 ad f6 53 1e c9 0b d9 b1 eb 4e c8 a4 8e e4 ba 86 5b 12 3a 6f 2d f6 c5 6d f2 c4 30 68 7d 23 11 e4 9e 9b 3f 92 16 d1 30 7e c9 4a 72 85 b5 29 df 30 5f 1a eb d9 6c 18 53 82 a5 60 c4 f4 88 e1 a4 79 f5 39 95 31 36 4c f7 9f da 08 80 a3 9a ba 59 be 74 46 4c b3 9b cc 37 3d 92 b8 1f ee 9d 10 a3 05 97 29 9e c4 3e 2e 6c de d3 d8 56 b4 50 23 73 d1 f4 3b b9 0b e5 c7 f5 6d ee f9 9b b1 01 46 c9 8c 23 77 85 a0 24 36 cb 28 53 7c 77 93 65 37 c5 fa c6 fb 2d 3c b6 f1 99 42 0b 5e d1 8d 33 ba 76 60 76 87 62 70 1d c2 5b b3 43 d5 28 26 75 c7 17 04 33 de 04 4e c5 54 84 4a a3 Data Ascii: #0"u[g\X2'bJo4EpDg8;7rw]t'bOR5ZAX0zDSN[:o-m0h}#?0~Jr)0_lS`y916LYtFL7=)>.lVP#s;mF#w$6(S\|we7-<B^3v`vbp[C(&u3NTJ
2023-08-25 13:28:27 UTC	895	IN	Data Raw: cd 3d fb 73 db 36 d2 bf 7f 7f 85 cd 7a 1c 22 82 9f 79 34 21 c3 ea 1c 57 ed b4 13 c7 19 ab b9 cc 8d ac 78 68 99 b2 d9 c8 62 4a 52 76 12 4b f7 b7 df 3e 00 10 20 29 c5 c9 f5 66 be 1f 6c 52 20 9e 8b c5 02 fb c0 2e 05 2d d7 3f 0a ce 04 a9 97 98 f7 e2 02 bd 76 20 51 a7 df 80 eb 09 bf 8c c7 f4 64 d7 ed 4e 1e 4e 3a 98 4c 74 6a 41 c9 c9 75 5a d2 8b 62 c3 9c 32 2a ed 18 aa 77 d2 27 a6 8a a6 1a 75 30 c4 8e aa d8 64 91 cb 00 d7 48 ac 0a 8a a2 33 6b 9d a4 b9 b1 4f 56 31 db a3 db 8b a6 08 cb 43 4f cb f0 ed ea 22 cd ef d7 08 65 5d d2 c4 ec 3a 2e 3e b4 c8 c9 76 49 58 f9 55 a7 91 2b 02 7d d4 d7 fb 20 19 aa f5 1a e2 3b e6 6f f3 9f 87 2a a6 6c 02 67 2d f5 02 db 6e 3e 75 7f 99 e8 27 39 ee 85 4b e3 9d 3c 7f fc 37 45 45 82 dd 97 82 df 3c 7d fe e4 6b e1 3c ed 9d b9 4d 0b de a6 Data Ascii: =s6z"y4!WxhbJRvK> )flR .-?v QdNN:LtjAuZb2w'u0dH3kOV1CO"e]:.>vIXU+} ;olg-n>u'9K<7EE<}k<M

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49743	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:26 UTC	868	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:27 UTC	902	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:27 GMT Content-Type: image/x-icon Content-Length: 17174 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT ETag: 0x8D8731230C851A6 x-ms-request-id: 072a10b5-201e-0055-4132-d7d34a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132827Z-t55b0udznx0x93et2m96ry5y1000000004v00000000266ds X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:27 UTC	902	IN	Data Raw: 00 00 01 00 06 00 80 80 10 00 00 00 00 00 68 28 00 00 66 00 00 00 48 48 10 00 00 00 00 00 e8 0d 00 00 ce 28 00 00 30 30 10 00 00 00 00 00 68 06 00 00 b6 36 00 00 20 20 10 00 00 00 00 00 e8 02 00 00 1e 3d 00 00 18 18 10 00 00 00 00 00 e8 01 00 00 06 40 00 00 10 10 10 00 00 00 00 00 28 01 00 00 ee 41 00 00 28 00 00 00 80 00 00 00 00 01 00 00 01 00 04 00 00 00 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 ba 7f 00 22 50 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 20 00 00 03 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 Data Ascii: h(fHH(00h6 =@(A(("P"""""""""""""""""""""""""""""" 333333333333333
2023-08-25 13:28:27 UTC	918	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ef a4 00 00 00 b9 ff 00 00 bc 7b 00 1f 4c f9 00 22 50 f2 00 f7 a6 00 00 00 ba 7f 00 f3 a6 00 00 1e 4e f6 00 23 4e f4 00 f3 a4 00 00 00 bc 7d 00 00 ba 7d 00 00 00 00 00 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 22 22 22 22 22 22 c0 03 33 33 33 33 33 33 33 22 Data Ascii: {L"PN#N}}"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"""""""3333333"

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49745	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:27 UTC	919	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:28 UTC	929	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:28 GMT Content-Type: application/x-javascript content-length: 15748 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Thu, 26 Jan 2023 00:32:55 GMT ETag: 0x8DAFF34DE08B462 x-ms-request-id: 06559fa5-a01e-0035-4b58-d79168000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132827Z-een70huwm95fd4218txaekp7a000000002n000000000w04y X-Cache: TCP_MISS Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:28 UTC	930	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2023-08-25 13:28:28 UTC	934	IN	Data Raw: ad 5b 7d 77 da c6 d2 ff ff 7e 0a a1 db 43 a4 9b b5 6c da a4 ed c5 55 7d 1c 5e 12 5a 3b 76 0d ee 5b 92 c3 11 68 01 c5 42 52 b5 c2 98 1a be fb f3 9b 5d 09 09 10 d8 e9 73 73 1c 83 76 67 67 67 67 e7 7d e4 e3 ff 54 fe a5 fd 47 3b 7a fe 3f ad db 3b bf e9 69 57 6d ad f7 ae 73 d3 d4 ae f1 f4 87 f6 fe aa d7 69 b4 9e 8f 87 36 a5 ff bd 89 27 b4 91 e7 73 0d 9f 03 47 70 57 0b 03 2d 8c 35 2f 18 86 71 14 c6 4e c2 85 36 c5 ef d8 73 7c 6d 14 87 53 2d 99 70 2d 8a c3 cf 7c 98 08 cd f7 44 82 45 03 ee 87 73 cd 00 ba d8 d5 ae 9d 38 59 68 9d 6b d3 02 7e 0e 6c de d8 0b b0 7a 18 46 0b 7c 9f 24 5a 10 26 de 90 6b 4e e0 4a 6c 3e 1e 02 c1 b5 59 e0 f2 58 9b 4f bc e1 44 bb f4 86 71 28 c2 51 a2 c5 7c c8 bd 7b 6c 22 66 18 df dc 82 69 4e cc 35 c1 13 6d 14 c6 c9 44 d1 61 69 5d 82 4c b1 0a Data Ascii: [}w~ClU}^Z;v[hBR]ssvgggg}TG;z?;iWmsi6'sGpW-5/qN6s\|mS-p-\|DEs8Yhk~lzF\|$Z&kNJl>YXODq(Q\|{l"fiN5mDai]L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49747	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:27 UTC	921	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:28 UTC	925	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:28 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: dc2d3869-901e-0012-0758-d7d155000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132827Z-d7wc7reh0p1u79a27xc1z0rw3n00000004ng00000000dsdr X-Cache: TCP_MISS Accept-Ranges: bytes
2023-08-25 13:28:28 UTC	926	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49746	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:27 UTC	923	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:28 UTC	930	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:28 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: 6cc11a98-301e-0034-3f58-d7ba6a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132827Z-0mnqb2b00x019e48rxu5672t5s00000002kg00000000yu0w X-Cache: TCP_MISS Accept-Ranges: bytes
2023-08-25 13:28:28 UTC	931	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49748	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:28 UTC	940	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:29 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:28 GMT Content-Type: image/gif Content-Length: 2672 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:37 GMT ETag: 0x8D79B83739984DD x-ms-request-id: dc2d3869-901e-0012-0758-d7d155000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132828Z-6y76xdx52t5zff9dcafv559wkw00000002cg00000000ugs5 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2023-08-25 13:28:29 UTC	947	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e 69 18 14 00 21 Data Ascii: GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~i!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49750	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:28 UTC	941	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:29 UTC	956	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:29 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:30 GMT ETag: 0x8D7B0071D86E386 x-ms-request-id: ea194574-701e-0058-2758-d70c51000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132829Z-xtnatf37990dza54mahby36c7w00000003k000000002kr5v X-Cache: TCP_MISS Accept-Ranges: bytes
2023-08-25 13:28:29 UTC	956	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49749	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:28 UTC	943	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:29 UTC	949	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:29 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 65733c1b-901e-0012-7249-d7d155000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132829Z-0mnqb2b00x019e48rxu5672t5s00000002m000000000v5ef X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2023-08-25 13:28:29 UTC	950	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49752	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:29 UTC	945	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:29 UTC	951	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:29 GMT Content-Type: image/gif Content-Length: 3620 Connection: close Cache-Control: public, max-age=31536000 Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373B17F89 x-ms-request-id: 6cc11a98-301e-0034-3f58-d7ba6a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132829Z-1s3ybxd1vx03tdkpy8u7vmxd7400000002x000000000dg7a X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:29 UTC	952	IN	Data Raw: 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 0f Data Ascii: GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49725	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:22 UTC	4	OUT	GET /?mfknxooz HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-08-25 13:28:23 UTC	5	IN	HTTP/1.1 302 Found Set-Cookie: qPdM=3LLuUALVcdxm; path=/; samesite=none; secure; httponly Set-Cookie: qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; path=/; samesite=none; secure; httponly location: /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 Date: Fri, 25 Aug 2023 13:28:22 GMT Connection: close Transfer-Encoding: chunked
2023-08-25 13:28:23 UTC	6	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49753	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:31 UTC	957	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:31 UTC	958	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:31 GMT Content-Type: image/svg+xml Content-Length: 1435 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:38 GMT ETag: 0x8D79B8373CB2849 x-ms-request-id: 65733c1b-901e-0012-7249-d7d155000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132831Z-b6hgxyhcch3mb75xnmu97w8gxs00000004wg000000016vxb X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2023-08-25 13:28:31 UTC	959	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 24 b5 5d 68 a5 Data Ascii: WMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#$]h

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49754	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:32 UTC	960	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:33 UTC	961	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:33 GMT Content-Type: image/svg+xml Content-Length: 673 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Feb 2020 22:01:30 GMT ETag: 0x8D7B0071D86E386 x-ms-request-id: 2a42fe93-501e-0066-23b3-d48f5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132833Z-5xm45gb8010t77ez01bnb7awc400000002k000000000p5r2 X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:33 UTC	962	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 21 02 39 81 41 Data Ascii: Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9!9A

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49758	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:39 UTC	963	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_76bb127b5869a5c6b8b3.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:40 UTC	971	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 content-length: 113440 Content-Type: application/x-javascript Content-Encoding: gzip Content-MD5: SxsaXa39nTRc5WmIHM+/cw== Last-Modified: Thu, 26 Jan 2023 00:32:56 GMT ETag: 0x8DAFF34DE8E0647 X-Cache: TCP_MISS x-ms-request-id: 7bf3d98a-d01e-0016-2958-d77d5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0h6zoZAAAAAB0zuHgBEuUSbbmm84uazR0QU1TMDRFREdFMTkyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= X-Azure-Ref: 0h6zoZAAAAAAOlQ6x0ZGXT6rRWc4v11ezU1RPRURHRTE0MDYAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 Date: Fri, 25 Aug 2023 13:28:39 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:40 UTC	972	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 79 7f db 38 b2 28 fa ff fd 14 b6 a6 c7 11 db b4 2c 6a 97 6d c6 e3 78 e9 64 a6 bb 93 93 a5 e7 cc c8 ea 0c 45 41 12 db 14 29 93 94 97 c4 9e cf fe aa 0a 3b 29 67 39 e7 9e 7b df ef bd cc 34 4d 14 0a 85 42 01 28 14 0a 05 6a ff c7 ed ff b5 f5 e3 d6 de b7 ff db 7a f7 fe e4 ed fb ad d7 17 5b ef 5f be 7a 7b b6 f5 06 52 ff d8 fa f5 f5 fb 57 a7 e7 df 4e 07 2b c5 ff de 2f a2 7c 6b 16 c5 6c 0b fe 4e 82 9c 4d b7 d2 64 2b cd b6 a2 24 4c b3 55 9a 05 05 cb b7 96 f0 cc a2 20 de 9a 65 e9 72 ab 58 b0 ad 55 96 fe c1 c2 22 df 8a a3 bc 80 42 13 16 a7 b7 5b 75 20 97 4d b7 de 04 59 71 bf f5 ea 8d d3 00 fa 0c a8 45 f3 28 81 d2 61 ba ba 87 f7 45 b1 95 a4 45 14 b2 ad 20 99 12 b5 18 12 49 ce b6 d6 c9 94 65 5b b7 8b 28 5c 6c fd 12 85 59 9a a7 b3 62 Data Ascii: y8(,jmxdEA);)g9{4MB(jz[_z{RWN+/\|klNMd+$LU erXU"B[u MYqE(aEE Ie[(\lYb
2023-08-25 13:28:40 UTC	987	IN	Data Raw: 9d 2d 97 80 2e b9 5e 32 f1 c1 62 f2 ba bc 3d ff c9 48 6c 3c d0 98 18 39 d5 ef 8d 19 b9 1f 56 95 7c fe 1d c5 cc 8a 63 27 1e ac 38 76 6a 58 59 f1 d2 d8 d2 97 d8 a9 25 46 90 3a e9 21 23 48 9d 76 de 99 11 a4 4e 26 66 66 05 a9 23 8d b7 22 90 0d 56 09 5e 42 26 05 81 54 5d d6 24 dd 47 81 b5 1b ae 3e 0d 55 66 e9 ee 13 4d e3 8a 53 ba 65 a1 57 a0 56 08 bb 8d 5b 0e fa a5 af 1e eb 0a cc fb 4f 6d 59 b0 74 01 4a f1 ba f1 06 54 5f e7 56 af 40 d1 56 57 e5 56 6e a5 74 ab b9 92 4d d5 8a 8b 4a 4f 1b 57 89 8c 18 4b 2e 7f 23 4f c5 54 f2 9e c4 9c ea 45 a8 8e 99 55 be 9f 14 ca cc 0d 17 9b 86 32 af 72 6f 69 a8 da 5c be 9d d4 33 32 c4 ec 08 5a 06 cc 16 9d 6a 6b f5 82 52 a8 0a 6d 38 20 2c e7 49 7b a8 5d ce b0 ee 28 a9 ae d8 70 49 89 be 80 21 32 2b 6c 86 3a af d2 bf 9d 72 9e d4 56 Data Ascii: -.^2b=Hl<9V\|c'8vjXY%F:!#HvN&ff#"V^B&T]$G>UfMSeWV[OmYtJT_V@VWVntMJOWK.#OTEU2roi\32ZjkRm8 ,I{](pI!2+l:rV
2023-08-25 13:28:40 UTC	988	IN	Data Raw: f7 32 26 6a ea 49 d8 8d 0d 89 c2 2b fb b6 e8 40 82 4b 06 7d e5 de 61 77 76 29 3f 4e 5c b9 54 38 e4 44 8c 9f 2e e1 90 2b 1d ca c8 eb a9 d4 f2 f2 f5 db 5f f9 08 61 84 20 7e 13 e9 8e 1c 45 45 f9 f7 ec 4c e5 da 56 00 2b 1c bc 2d a1 95 40 f1 ae cc b1 a2 c4 89 2f f4 8d 28 83 39 e0 dd 45 30 81 45 db 11 e5 41 b9 23 f5 41 49 f5 81 4b 8e 60 7f ce b5 48 99 3c d0 a0 9d 62 91 ae 26 72 3c b5 69 f3 0a 10 e3 5a b7 c7 21 b2 4e ea f8 8a 71 3e e1 48 25 e3 bc 2b a0 2a f0 23 20 6f 60 91 e6 8a 03 ea 11 eb d0 9c c6 60 16 48 59 f0 af f2 bf 7f 7b 72 76 6e 02 0a cb 65 da 25 d7 90 84 69 57 33 ff 3d a8 6a b4 2d ff f2 c1 c6 60 db 49 c7 c8 51 ce ca d0 00 1a 01 b8 dc 47 b5 39 fe 56 b2 a4 26 6b 97 09 2a ac 44 d5 d8 c9 05 e4 9a 7b 9f 45 2b e3 b7 9e c5 2c 47 a0 c6 13 15 e7 6a ff 34 e5 80 Data Ascii: 2&jI+@K}awv)?N\T8D.+_a ~EELV+-@/(9E0EA#AIK`H<b&r<iZ!Nq>H%+# o``HY{rvne%iW3=j-`IQG9V&kD{E+,Gj4
2023-08-25 13:28:40 UTC	996	IN	Data Raw: a7 bd 6f 6d 6e db 58 16 fc be bf 42 62 6c 19 30 40 f1 a1 87 23 92 20 a3 6b 3b bb ae ca b9 71 25 b9 f7 c3 21 69 1e 90 04 49 44 20 c0 00 a4 1e 16 b8 bf 7d bb 7b de 00 28 c9 3e f7 d4 dd da da 54 2c 02 83 79 f6 f4 f4 f4 f4 f4 43 5d 10 64 db 87 88 3c 72 06 f7 db ba 1f 85 cb b8 53 73 30 db 78 6c 8c f1 c0 cd aa b6 0e dc b5 71 a7 6a f4 42 48 fd b1 1b 28 1e 60 97 6b da 08 65 86 94 32 b8 45 68 a9 0a 08 5c ec a0 06 44 b6 bb c2 ad fd d8 3a 44 57 bb 2b 21 11 c2 b3 33 42 cb dd 78 0f 12 5a bd 0d 41 0c cf ce 30 10 40 fa 15 b2 19 30 c0 c7 f7 86 92 fb 7b ae 90 4c ab 9f 2d 8f 95 5c 1e ea db 13 94 9b e5 c1 8e fc 57 2e 86 15 ee 75 4e 1b ef 3c 34 88 4d 93 f9 83 9c 78 7c 51 68 33 05 c4 71 da 80 90 f6 0b 50 6c e5 ae 14 8a cd 8b b8 a5 50 78 fe af c3 ad 81 86 60 a8 69 7a 10 c7 34 Data Ascii: omnXBbl0@# k;q%!iID }{(>T,yC]d<rSs0xlqjBH(`ke2Eh\D:DW+!3BxZA0@0{L-\W.uN<4Mx\|Qh3qPlPx`iz4
2023-08-25 13:28:40 UTC	1004	IN	Data Raw: 8d c1 54 40 2b 36 a1 05 40 d0 cf 11 6c fc 31 ef 4c ac 8d 3f d4 52 9b df 02 15 48 f1 b8 e9 b7 4c 3b 39 09 fb 15 50 a8 04 a0 18 d6 cb e0 18 da 45 ca 0a a3 37 29 83 d8 cd 0f d1 19 b5 e1 8b a5 5c a6 2c 62 35 96 ae 02 cc 05 a2 33 3f e6 76 3a 1e 3c 9f 45 f2 89 50 39 bb 16 b2 3b 85 b1 d0 4c 96 af f4 bc 26 45 ae ee 96 20 21 11 c7 a0 81 9e 87 4e a2 b9 a2 1d 43 0c 8c 5e e0 6e bd aa 49 d2 cc a7 b6 03 25 ce e9 04 5d 49 ac 30 1a b5 5d ae 2f 06 1c e2 d9 2b ea 75 b7 4e 55 7b 4a 4c c4 70 6e 90 b2 73 97 39 27 78 72 ae de a8 b9 f0 38 cc d8 75 19 9c 47 82 0e 6c 43 28 f4 36 f7 3f e3 0d af 92 66 3e 4e 3e f0 6d e9 d6 aa e0 79 cd 19 0f f0 b0 38 dc d6 5b c4 e4 a6 c1 6d 90 12 db a4 ef 75 76 a7 d0 a4 80 9e 7d 70 eb 6d 9a 15 98 a3 ae 3a 2b 21 27 c9 16 0f a9 44 20 df c5 48 70 a3 81 Data Ascii: T@+6@l1L?RHL;9PE7)\,b53?v:<EP9;L&E !NC^nI%]I0]/+uNU{JLpns9'xr8uGlC(6?f>N>my8[muv}pm:+!'D Hp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49759	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:39 UTC	965	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:39 UTC	967	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:39 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 0576e4d8-701e-0064-1649-d7d959000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132839Z-een70huwm95fd4218txaekp7a000000002k000000001t0rk X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:39 UTC	968	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49761	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:39 UTC	968	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; brcap=0
2023-08-25 13:28:40 UTC	969	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:40 GMT Content-Type: image/svg+xml Content-Length: 621 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Tue, 10 Nov 2020 03:41:24 GMT ETag: 0x8D8852A7FA6B761 x-ms-request-id: 0576e4d8-701e-0064-1649-d7d959000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132840Z-t55b0udznx0x93et2m96ry5y1000000004v000000002699g X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2023-08-25 13:28:40 UTC	970	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b 4c 68 af a1 b8 Data Ascii: }UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49728	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:23 UTC	6	OUT	GET /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I
2023-08-25 13:28:23 UTC	7	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: c77d01d6-1b6b-485b-b493-6529d5746000 x-ms-ests-server: 2.1.16110.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]} x-ms-clitelem: 1,50168,0,, nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: fpc=Avk-wbVDnvdIr9avJqHlFZI; expires=Sun, 24-Sep-2023 13:28:23 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 25 Aug 2023 13:28:23 GMT Connection: close content-length: 20851 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:23 UTC	9	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" conten
2023-08-25 13:28:23 UTC	23	IN	Data Raw: 5f 52 65 70 6f 72 74 46 61 69 6c 75 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 69 66 28 73 28 29 26 26 21 74 28 29 29 7b 74 68 72 6f 77 22 5b 52 65 74 72 79 20 22 2b 65 2b 22 5d 20 46 61 69 6c 65 64 20 74 6f 20 6c 6f 61 64 20 65 78 74 65 72 6e 61 6c 20 72 65 73 6f 75 72 63 65 20 5b 27 22 2b 72 2b 22 27 5d 2c 20 72 65 6c 6f 61 64 69 6e 67 20 66 72 6f 6d 20 66 61 6c 6c 62 61 63 6b 20 43 44 4e 20 65 6e 64 70 6f 69 6e 74 22 7d 7d 2c 66 2e 24 4c 6f 61 64 65 72 3d 63 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 69 66 28 21 24 29 7b 76 61 72 20 65 3d 6e 65 77 20 76 2e 24 4c 6f 61 64 65 72 3b 65 2e 41 64 64 49 66 28 21 76 2e 6a 51 75 65 72 79 2c 79 2e 73 62 75 6e 64 6c 65 2c 22 57 65 62 57 61 74 73 6f 6e 5f 44 65 6d Data Ascii: _ReportFailure=function(e,r){if(s()&&!t()){throw"[Retry "+e+"] Failed to load external resource ['"+r+"'], reloading from fallback CDN endpoint"}},f.$Loader=c}(),function(){function e(){if(!$){var e=new v.$Loader;e.AddIf(!v.jQuery,y.sbundle,"WebWatson_Dem

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49729	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:23 UTC	29	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_nun_Nob0yT2WjCUfgBCTog2.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
2023-08-25 13:28:24 UTC	31	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:24 GMT Content-Type: application/x-javascript content-length: 138740 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 12 Jul 2023 10:42:33 GMT ETag: 0x8DB82C4B32A50A1 x-ms-request-id: e6985c1f-d01e-0052-57f4-d50244000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132824Z-0zzug582f97wz2ve9054setc4n00000002tg00000001w2ev X-Cache: TCP_HIT Accept-Ranges: bytes Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:24 UTC	32	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bc bd 7b 5f e3 38 d2 30 fa ff f3 29 82 77 0f 63 4f 4c c8 05 68 70 70 e7 4d 03 dd cd 0c b7 21 61 7a 66 69 96 9f 93 08 70 77 62 67 6d 07 9a 09 79 3f fb a9 8b 64 cb 8e 43 f7 ec 73 7e 67 2e c1 96 4a b2 54 aa 2a 55 95 4a d2 e6 cf 6b ff 53 f9 b9 b2 f1 e3 ff 54 7a fd ee 65 bf 72 fe be d2 ff 78 7c 79 58 b9 80 b7 3f 2b 67 e7 fd e3 83 a3 1f af 07 3f 8a ff f7 1f fc b8 72 e7 8f 45 05 fe 0e bc 58 8c 2a 61 50 09 a3 8a 1f 0c c3 68 1a 46 5e 22 e2 ca 04 7e 23 df 1b 57 ee a2 70 52 49 1e 44 65 1a 85 5f c4 30 89 2b 63 3f 4e a0 d0 40 8c c3 a7 8a 09 d5 45 a3 ca 85 17 25 cf 95 e3 0b ab 06 f5 0b a8 cd bf f7 03 28 3d 0c a7 cf f0 fc 90 54 82 30 f1 87 a2 e2 05 23 aa 6d 0c 2f 41 2c 2a b3 60 24 a2 ca d3 83 3f 7c a8 9c fa c3 28 8c c3 bb a4 12 89 a1 f0 1f Data Ascii: {_80)wcOLhppM!azfipwbgmy?dCs~g.JTUJkSTzerx\|yX?+g?rEXaPhF^"~#WpRIDe_0+c?N@E%(=T0#m/A,*`$?\|(
2023-08-25 13:28:24 UTC	47	IN	Data Raw: 8d d8 f6 cc dc 91 1a 43 bc 1f b7 93 d4 04 9d 2a 85 98 2e 9c 4f 44 54 b9 4d a7 88 1f 4b 32 32 f1 58 c0 f6 18 a8 68 ec 46 80 77 d3 5a d4 06 30 95 d3 85 50 78 a6 56 46 90 49 2d 14 96 83 10 48 1c 71 0d 66 2a ed 68 93 d2 cb c5 85 ba 83 24 3b 3b 56 9d 8a 96 1e 34 26 3a 26 5e ef 0a ea 84 8d 37 b3 0a 3c 57 e4 9c 98 24 a6 9b 66 f1 bc 78 91 5e 56 11 77 02 3e 85 59 66 80 a2 82 67 27 75 02 ac c0 4d 9c 00 2f f9 71 e4 41 4c d1 fa 7a c4 15 1e 8f d6 d7 a9 c5 7c 65 cb 9c 12 49 d9 34 d0 1f c1 bd 30 6c 09 eb a4 a5 38 85 06 5c 25 f2 e8 d3 23 69 c0 81 ad 37 d9 89 80 7a 13 44 0f 9e 86 2b 77 c4 00 cd 70 76 01 49 ea 96 78 3c 82 7c be b0 0a e7 9c 99 46 92 12 01 25 b0 43 dd c0 6b 95 82 5a 69 9e bb 06 9c 10 68 ed 74 f5 97 97 97 48 3b 5d a6 86 9a 83 3d 7f 04 a9 8d 67 67 8c 1d 61 cb Data Ascii: C.ODTMK22XhFwZ0PxVFI-Hqfh$;;V4&:&^7<W$fx^Vw>Yfg'uM/qALz\|eI40l8\%#i7zD+wpvIx<\|F%CkZihtH;]=gga
2023-08-25 13:28:24 UTC	48	IN	Data Raw: e0 65 ac ed 5e 6d 50 90 c1 ea 36 1b b4 68 b5 5b a3 22 b7 07 b2 b5 de f6 f7 93 f4 5e 9b b6 5f ad 5a 91 1b 5d 27 d7 fe 0d 74 16 fe 66 99 37 d0 83 85 dd ab 9d 2c 4d 63 78 8a 36 4a 92 5e ed 51 9e d9 68 90 54 30 20 65 60 1a 8f 2a 70 25 cd b7 e0 51 ce 53 ee 7c 84 eb 57 57 d3 11 2d be e2 9d 5d 31 f9 35 79 2d 97 24 38 25 e3 b0 c3 e4 83 0a 79 7c 08 0a 66 14 3e 8b 11 64 e0 67 3d 5d 7e a6 e3 28 0a fd 47 86 10 96 af 8e d8 c6 e3 b2 03 33 b1 05 1e c3 9d 8d be c4 1a de 6b 6c e5 8a 06 aa 68 c0 c7 7c 63 39 37 d0 cf f0 16 8b 72 e6 ac 88 da ed 2d 1d 1d 7e 7b eb c2 40 17 98 51 bf 86 10 51 29 4f 51 1e 58 38 d5 b7 91 4d 0e 81 b6 54 62 fe 30 6f cc 3d f3 c0 60 00 ea e1 ab 2b 71 2c 7c 79 20 7d 45 aa a7 fe f2 d5 04 79 0b 18 d5 cc b4 89 ce f5 cd 42 73 e9 d1 fd 06 f6 5d 89 2c ab f0 Data Ascii: e^mP6h["^_Z]'tf7,Mcx6J^QhT0 e`*p%QS\|WW-]15y-$8%y\|f>dg=]~(G3klh\|c97r-~{@QQ)OQX8MTb0o=`+q,\|y }EyBs],
2023-08-25 13:28:24 UTC	56	IN	Data Raw: 6f 73 ef de df b6 91 a4 8d fe 7f 3e 05 89 f5 cf 06 42 88 96 9c 64 32 01 8d f0 67 cb f2 c4 19 df d6 b2 93 cc c8 1a 2d 48 80 12 2c 0a e0 00 a0 64 8d c4 ef 7e ea a9 ea 6e 34 2e 94 9d d9 39 e7 7d 67 37 16 01 34 1a 7d ad ae eb 53 3b 8f a8 c7 a6 b6 dc 8f ea b3 3a c6 20 2d f0 cf 2a 7c 44 9d 5c 4e 46 a3 cc 1f 8d 56 5e f6 98 1a bd 50 d1 b6 8d b6 67 ec dd e8 d3 88 70 cc a6 2a 60 46 65 c5 8f 59 fe fa eb dc 5d f8 b1 ee a7 72 37 0c 64 52 37 eb 30 dd 68 14 eb 27 b5 4c 5e ca 5e a3 f7 e1 89 78 ef ae 45 22 5c 62 47 20 df e6 c8 95 f6 46 81 b2 fd 76 10 29 5b 63 95 d3 cf f3 7c ac 35 0f 74 54 2d 93 b2 e4 c0 4e 10 02 a2 2f 54 e0 01 bf f4 60 20 02 f6 78 f0 62 c1 05 ae 52 3a f5 a8 06 58 86 d9 7e 39 97 fc 23 52 b7 af 82 47 c5 67 2c 83 f3 98 ce 78 61 31 f3 0a f8 d8 cd c7 d9 cc 0e Data Ascii: os>Bd2g-H,d~n4.9}g74}S;: -\|D\NFV^Pgp`FeY]r7dR70h'L^^xE"\bG Fv)[c\|5tT-N/T` xbR:X~9#RGg,xa1
2023-08-25 13:28:24 UTC	64	IN	Data Raw: 00 07 b0 4f ed 22 9c 93 b4 09 30 a1 92 01 56 33 16 67 b1 86 d6 59 fa cf 75 82 0d c5 2e 7c 6e 33 d5 b0 95 d0 87 8f c6 c2 e6 c5 79 fe 9e 22 9b 2b 5c 0f cf 1d bf e8 3f 3f 6d 0a 41 2c 07 56 d8 7c ea 9a 45 17 1a ac 04 f0 5e d4 d4 02 23 a7 1f 22 7f 03 4f f7 70 58 05 29 87 ca 57 4d 27 34 5a b4 91 90 3b 44 85 9b 17 19 b6 cf ec 11 9e ba 2d 54 4c a3 e0 58 b2 00 ef af 23 45 22 8f bf 48 fd 9e cd dc fa 65 49 c0 70 00 b3 ad c6 31 9a 97 25 37 00 cb bc 73 93 e9 bc 7a a1 92 05 2b 2d 2f cb af 24 bb 13 65 88 a8 7a 54 7b d5 f4 8b f4 b8 fe 7c a6 ac 2e 76 e7 95 37 a7 3a 86 b8 65 92 d8 fd 6b 1b 57 81 6e 13 63 c7 c9 e0 7b 28 a5 a3 9f 39 44 71 01 f4 a0 af 19 0a 56 5f 84 f5 c0 a8 5b 5b be 5f 37 b0 6e 79 cf 92 b6 26 db d0 53 f6 57 68 73 ad 1d 2f 90 cc b5 cf 39 db 23 36 ef d1 d6 aa Data Ascii: O"0V3gYu.\|n3y"+\??mA,V\|E^#"OpX)WM'4Z;D-TLX#E"HeIp1%7sz+-/$ezT{\|.v7:ekWnc{(9DqV_[[_7ny&SWhs/9#6

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49731	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:24 UTC	80	OUT	GET /__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2023-08-25 13:28:25 UTC	85	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msauth.net>; rel=dns-prefetch, <https://aadcdn.msftauth.net>; rel=dns-prefetch P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f4a7a3f3-bec0-4b44-82f9-89024cee5d00 x-ms-ests-server: 2.1.16150.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]} x-ms-clitelem: 1,0,0,, nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; expires=Sun, 24-Sep-2023 13:28:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; domain=0ffice-authentication.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA; expires=Sun, 24-Sep-2023 13:28:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Fri, 25 Aug 2023 13:28:24 GMT Connection: close content-length: 44735 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:25 UTC	87	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2023-08-25 13:28:25 UTC	101	IN	Data Raw: 79 33 4a 45 6e 4d 50 54 68 37 4c 64 66 6f 6f 36 77 2d 34 78 4a 6b 55 68 6b 79 77 5a 6c 50 2d 57 75 6c 6d 70 4f 33 70 72 52 73 65 47 59 4b 42 49 56 56 70 6c 4a 77 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 6d 6f 64 65 3d 66 6f 72 6d 5f 70 6f 73 74 5c 75 30 30 32 36 6e 6f 6e 6f 6e 63 65 3d 36 33 37 39 32 39 39 30 33 37 37 36 34 36 36 36 38 31 2e 59 32 59 34 59 6a 4e 6a 4f 57 49 74 4e 57 52 6c 4d 69 30 30 4e 57 52 6d 4c 57 45 79 4e 47 45 74 4e 47 4d 78 4d 32 52 68 4e 6a 68 6d 4d 6d 59 31 4e 54 49 33 59 6d 4d 35 4f 54 4d 74 4f 57 45 79 4e 69 30 30 59 57 4a 6a 4c 54 67 35 5a 44 41 74 59 6d 59 79 4d 6a 67 77 4f 57 46 6a 4d 57 55 78 5c 75 30 30 32 36 78 2d 63 6c 69 65 6e 74 2d 53 4b 55 3d 49 44 5f 4e 45 54 53 54 41 4e 44 41 52 44 32 5f 30 5c 75 30 30 32 36 78 Data Ascii: y3JEnMPTh7Ldfoo6w-4xJkUhkywZlP-WulmpO3prRseGYKBIVVplJw\u0026response_mode=form_post\u0026nononce=637929903776466681.Y2Y4YjNjOWItNWRlMi00NWRmLWEyNGEtNGMxM2RhNjhmMmY1NTI3YmM5OTMtOWEyNi00YWJjLTg5ZDAtYmYyMjgwOWFjMWUx\u0026x-client-SKU=ID_NETSTANDARD2_0\u0026x
2023-08-25 13:28:25 UTC	117	IN	Data Raw: 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 72 3d 65 2e 24 44 65 62 75 67 3d 65 2e 24 44 65 62 75 67 7c 7c 7b 7d 2c 74 3d 65 2e 24 43 6f 6e 66 69 67 7c 7c 7b 7d 3b 69 66 28 21 72 2e 61 70 70 65 6e 64 4c 6f 67 29 7b 76 61 72 20 6e 3d 5b 5d 2c 6f 3d 30 3b 72 2e 61 70 70 65 6e 64 4c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 74 2e 6d 61 78 44 65 62 75 67 4c 6f 67 7c 7c 32 35 2c 69 3d 28 6e 65 77 20 44 61 74 65 29 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 2b 22 3a 22 2b 65 3b 6e 2e 70 75 73 68 28 6f 2b 22 3a 22 2b 69 29 2c 6e 2e 6c 65 6e 67 74 68 3e 72 26 26 6e 2e 73 68 69 66 74 28 29 2c Data Ascii: cript type="text/javascript">//<![CDATA[!function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49732	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:25 UTC	82	OUT	GET /favicon.ico HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; fpc=Avk-wbVDnvdIr9avJqHlFZI; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2023-08-25 13:28:25 UTC	84	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 5ed61a02-7dde-4f57-9556-b7a1937a8a00 x-ms-ests-server: 2.1.16150.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Date: Fri, 25 Aug 2023 13:28:24 GMT Connection: close Content-Length: 0 Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49736	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:25 UTC	131	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
2023-08-25 13:28:25 UTC	331	IN	HTTP/1.1 200 OK Date: Fri, 25 Aug 2023 13:28:25 GMT Content-Type: text/css Content-Length: 20105 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 17 May 2023 19:54:03 GMT ETag: 0x8DB5710770A6D5D x-ms-request-id: 0b9105c7-b01e-0094-33fd-d57c0c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20230825T132825Z-n5bqezvs8d32m5n8kszxtvystw00000002n0000000004k9u X-Cache: TCP_HIT Accept-Ranges: bytes
2023-08-25 13:28:25 UTC	331	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 6b 73 e3 36 b2 e8 f7 f9 15 5c a7 52 3b ce 4a 8c 48 3d 2d 57 52 3b 99 cc 26 3e 67 5e 35 33 d9 47 a5 52 5b b4 44 59 3c 43 89 ba 24 65 8f 57 47 ff fd e2 8d 06 d0 20 29 8f b3 d9 7b 2b 27 67 13 0b dd 6c 00 dd 8d 06 1a e8 06 be fe ea 0f c1 f3 62 77 5f 66 37 eb 3a 78 fa fc 3c 78 95 2d ca a2 2a 56 35 29 2f 77 45 99 d4 59 b1 0d 83 67 79 1e 30 a4 2a 28 d3 2a 2d 6f d3 65 18 7c f5 f5 d7 5f fd e1 49 bf fb ff 05 ef 3f 3c 7b f7 21 78 f3 97 e0 c3 8f 57 ef be 0f de 92 5f ff 08 5e bf f9 70 f5 fc 45 d0 99 ca 93 27 1f d6 59 15 ac b2 3c 0d c8 7f af 93 2a 5d 06 c5 36 28 ca 20 db 2e 44 ab d3 2a d8 90 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 f4 21 cf aa 9a 7c 74 9d e6 c5 5d f0 94 90 2b 97 c1 db a4 ac ef 83 ab b7 e7 61 f0 81 e0 16 Data Ascii: }ks6\R;JH=-WR;&>g^53GR[DY<C$eWG ){+'glbw_f7:x<x-V5)/wEYgy0(-oe\|_I?<{!xW_^pE'Y<]6( .D*Y:ve?!\|t]+a
2023-08-25 13:28:25 UTC	347	IN	Data Raw: 7d 1e cf dc 03 77 34 cb c1 26 7e a1 a3 0d 81 a9 e1 86 c0 e4 78 03 95 19 dc f7 94 9b 0d c2 20 ad 02 68 68 68 1b 1e 26 02 71 8b b5 e1 a4 a0 a7 c9 e6 8d ae 15 59 38 a4 4f c3 8b d9 39 72 1f 2c 00 62 85 44 4c bc fb 3a 7b 16 3f 1c 07 13 01 dc ca 1e c9 74 34 f9 87 b1 cb e0 be 5e ee 39 cb fc d4 07 3b 59 ee 83 0f c8 11 be 9d 73 86 bf 59 e7 79 64 90 5d 48 2d 5e 8e 9c 6f 92 6d b6 db e7 8c bd ee 6d aa e2 de 0d e3 b5 3b 11 3b 66 bb a2 46 86 e9 6f 31 17 43 de bb 4f a9 9b 51 6d 70 3f cd 56 81 47 98 66 6d 8a bf c1 5c 68 37 e1 b7 1c 5d 72 6e 74 de fb eb 38 4d b6 0b af f3 d4 64 a2 3f be d5 37 e9 ff 26 4c 47 83 3c c1 86 f7 31 cc 96 34 cf b3 be ff 8e 9f 4d c3 cd 70 23 1e 92 c8 09 1e a6 bb 71 96 7d 83 9c 71 65 08 a3 d6 c1 72 e1 36 8a 47 d0 7d c7 b8 09 57 f6 9c 2a ef d7 c8 38 Data Ascii: }w4&~x hhh&qY8O9r,bDL:{?t4^9;YsYyd]H-^omm;;fFo1COQmp?VGfm\h7]rnt8Md?7&LG<14Mp#q}qer6G}W*8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49737	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:25 UTC	133	OUT	GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_2W3IEdsiCwViwvv0RWyRLg2.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
2023-08-25 13:28:25 UTC	137	IN	HTTP/1.1 200 OK Content-Length: 689016 Content-Type: application/x-javascript Date: Fri, 25 Aug 2023 13:28:25 GMT Connection: close
2023-08-25 13:28:25 UTC	137	IN	Data Raw: 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 6e 28 6e 29 20 7b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 74 2c 20 69 2c 20 6f 20 3d 20 6e 5b 30 5d 2c 20 72 20 3d 20 6e 5b 31 5d 2c 20 73 20 3d 20 30 2c 20 63 20 3d 20 5b 5d 3b 20 73 20 3c 20 6f 2e 6c 65 6e 67 74 68 3b 20 73 2b 2b 29 0a 20 20 20 20 20 20 28 69 20 3d 20 6f 5b 73 5d 29 2c 0a 20 20 20 20 20 20 20 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 20 69 29 20 26 26 20 61 5b 69 5d 20 26 26 20 63 2e 70 75 73 68 28 61 5b 69 5d 5b 30 5d 29 2c 0a 20 20 20 20 20 20 20 20 28 61 5b 69 5d 20 3d 20 30 29 3b 0a 20 20 20 20 66 6f 72 20 28 74 20 69 6e 20 72 29 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 Data Ascii: !(function (e) { function n(n) { for (var t, i, o = n[0], r = n[1], s = 0, c = []; s < o.length; s++) (i = o[s]), Object.prototype.hasOwnProperty.call(a, i) && a[i] && c.push(a[i][0]), (a[i] = 0); for (t in r) Object.protot
2023-08-25 13:28:25 UTC	153	IN	Data Raw: 63 6b 65 64 3a 20 31 30 30 2c 0a 20 20 20 20 20 20 20 20 54 69 6c 65 73 3a 20 31 30 32 2c 0a 20 20 20 20 20 20 20 20 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 3a 20 31 30 33 2c 0a 20 20 20 20 20 20 20 20 46 65 64 43 6f 6e 66 6c 69 63 74 3a 20 31 30 35 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 3a 20 31 30 36 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 4c 6f 67 69 6e 5f 50 68 6f 6e 65 53 69 67 6e 69 6e 3a 20 31 30 37 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 46 69 6e 69 73 68 3a 20 31 30 38 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 53 74 72 6f 6e 67 41 75 74 68 3a 20 31 30 39 2c 0a 20 20 20 20 20 20 20 20 57 69 6e 31 30 48 6f 73 74 5f 48 49 50 5f 4c 6f 67 69 6e 3a 20 31 31 30 Data Ascii: cked: 100, Tiles: 102, RemoteConnect: 103, FedConflict: 105, Win10Host_Login: 106, Win10Host_Login_PhoneSignin: 107, Win10Host_Finish: 108, Win10Host_StrongAuth: 109, Win10Host_HIP_Login: 110
2023-08-25 13:28:25 UTC	169	IN	Data Raw: 28 50 52 4f 4f 46 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 54 79 70 65 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 45 6d 61 69 6c 3a 20 31 2c 0a 20 20 20 20 20 20 20 20 20 20 41 6c 74 45 6d 61 69 6c 3a 20 32 2c 0a 20 20 20 20 20 20 20 20 20 20 53 4d 53 3a 20 33 2c 0a 20 20 20 20 20 20 20 20 20 20 44 65 76 69 63 65 49 64 3a 20 34 2c 0a 20 20 20 20 20 20 20 20 20 20 43 53 53 3a 20 35 2c 0a 20 20 20 20 20 20 20 20 20 20 53 51 53 41 3a 20 36 2c 0a 20 20 20 20 20 20 20 20 20 20 43 65 72 74 69 66 69 63 61 74 65 3a 20 37 2c 0a 20 20 20 20 20 20 20 20 20 20 48 49 50 3a 20 38 2c 0a 20 20 20 20 20 20 20 20 20 20 42 69 72 74 68 64 61 79 3a 20 39 2c 0a 20 20 20 20 20 20 20 20 20 20 54 4f 54 50 41 75 74 68 65 6e 74 69 63 61 74 6f 72 3a 20 31 30 2c 0a 20 20 20 20 20 20 20 Data Ascii: (PROOF = { Type: { Email: 1, AltEmail: 2, SMS: 3, DeviceId: 4, CSS: 5, SQSA: 6, Certificate: 7, HIP: 8, Birthday: 9, TOTPAuthenticator: 10,
2023-08-25 13:28:25 UTC	185	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 6e 20 7c 7c 20 22 22 20 3d 3d 3d 20 6e 20 7c 7c 20 28 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 50 2e 70 61 72 73 65 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 74 2e 71 75 65 72 79 20 3d 20 74 2e 71 75 65 72 79 20 7c 7c 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 20 3d 20 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 74 2e 71 75 65 72 79 2c 20 65 2c 20 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 69 20 3f 20 74 2e 71 75 65 72 79 5b 69 5d 20 3a 20 22 22 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 46 72 6f 6d 43 75 Data Ascii: n \|\| "" === n \|\| (n = document.location.search); var t = P.parse(n); t.query = t.query \|\| {}; var i = s.findOwnProperty(t.query, e, !0); return i ? t.query[i] : ""; }, appendOrReplaceFromCu
2023-08-25 13:28:25 UTC	201	IN	Data Raw: 2f 67 2c 0a 20 20 20 20 20 20 20 20 20 20 67 61 70 2c 0a 20 20 20 20 20 20 20 20 20 20 69 6e 64 65 6e 74 2c 0a 20 20 20 20 20 20 20 20 20 20 6d 65 74 61 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 62 22 3a 20 22 5c 5c 62 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 74 22 3a 20 22 5c 5c 74 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 6e 22 3a 20 22 5c 5c 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 66 22 3a 20 22 5c 5c 66 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 72 22 3a 20 22 5c 5c 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 22 27 3a 20 27 5c 5c 22 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 5c 5c 22 3a 20 22 5c 5c 5c 5c 22 2c 0a 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 72 Data Ascii: /g, gap, indent, meta = { "\b": "\\b", "\t": "\\t", "\n": "\\n", "\f": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\", }, r
2023-08-25 13:28:25 UTC	219	IN	Data Raw: 20 20 20 76 61 72 20 6d 20 3d 20 66 2e 61 64 64 28 64 2c 20 63 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 2e 74 61 72 67 65 74 55 72 6c 20 3d 20 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 61 2e 48 61 6e 64 6c 65 72 2e 63 61 6c 6c 28 6e 2c 20 70 29 2c 20 6e 2e 73 65 6e 64 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 42 65 61 63 6f 6e 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 74 2c 20 69 2c 20 61 2c 20 6f 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 76 28 21 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 70 2e 66 6f 72 45 61 63 68 28 73 Data Ascii: var m = f.add(d, c); p.targetUrl = m; } } a.Handler.call(n, p), n.sendRequest(); }), (n.Beacon = function (e, t, i, a, o) { var r = [], s = v(!0); p.forEach(s
2023-08-25 13:28:25 UTC	235	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 6e 20 3f 20 28 6c 20 3d 3d 3d 20 70 2e 46 54 45 72 72 6f 72 20 3f 20 68 28 65 2c 20 64 29 20 3a 20 76 28 65 2c 20 64 29 29 20 3a 20 62 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6b 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 67 20 3d 20 22 22 29 2c 20 28 6c 20 3d 20 70 2e 45 72 72 6f 72 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 54 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6c 20 3d 20 70 2e 54 69 6d 65 6f 75 74 29 2c 20 28 75 20 3d 20 22 22 29 2c 20 28 66 20 3d 20 22 22 29 2c 20 28 67 20 3d 20 22 22 29 2c 20 76 28 64 29 3b 0a 20 20 20 20 20 Data Ascii: n ? (l === p.FTError ? h(e, d) : v(e, d)) : b(e); } function k() { (g = ""), (l = p.Error), (u = ""), (f = ""), v(d); } function T() { (l = p.Timeout), (u = ""), (f = ""), (g = ""), v(d);
2023-08-25 13:28:25 UTC	251	IN	Data Raw: 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 74 20 3d 20 7b 20 63 72 65 64 54 79 70 65 3a 20 6d 2e 4f 6e 65 54 69 6d 65 43 6f 64 65 2c 20 70 72 6f 6f 66 3a 20 65 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 77 69 74 63 68 20 28 28 28 74 2e 70 72 6f 6f 66 2e 69 73 45 6e 63 72 79 70 74 65 64 20 3d 20 21 30 29 2c 20 65 2e 74 79 70 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 53 4d 53 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 50 52 4f 4f 46 2e 54 79 70 65 2e 56 6f 69 63 65 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 21 65 2e 69 73 56 6f 69 63 65 4f 6e 6c 79 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: n) { var t = { credType: m.OneTimeCode, proof: e }; switch (((t.proof.isEncrypted = !0), e.type)) { case PROOF.Type.SMS: case PROOF.Type.Voice: if (!e.isVoiceOnly) {
2023-08-25 13:28:25 UTC	267	IN	Data Raw: 20 70 2e 61 70 70 65 6e 64 4f 72 52 65 70 6c 61 63 65 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 3f 22 20 2b 20 67 65 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 77 63 74 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4c 6f 67 69 6e 4f 70 74 69 6f 6e 73 25 33 44 33 25 32 36 22 20 2b 20 70 2e 65 78 74 72 61 63 74 28 22 77 63 74 78 22 2c 20 22 3f 22 20 2b 20 67 65 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 74 20 3d 20 74 2e 73 75 62 73 74 72 28 31 29 29 2c 20 28 65 20 3d 20 70 2e 61 70 70 65 6e 64 28 65 2c 20 74 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: p.appendOrReplace( "?" + ge, "wctx", "LoginOptions%3D3%26" + p.extract("wctx", "?" + ge) ); (t = t.substr(1)), (e = p.append(e, t));
2023-08-25 13:28:25 UTC	283	IN	Data Raw: 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 70 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 74 28 34 29 2c 0a 20 20 20 20 20 20 72 20 3d 20 74 28 30 29 2c 0a 20 20 20 20 20 20 73 20 3d 20 77 69 6e 64 6f 77 2c 0a 20 20 20 20 20 20 63 20 3d 20 72 2e 44 69 61 6c 6f 67 49 64 3b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 64 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 68 69 73 2c 0a 20 20 20 20 20 20 20 20 74 20 3d 20 65 2e 69 73 50 6c 61 74 66 6f 72 6d 41 75 74 68 65 6e 74 69 63 61 74 6f 72 41 76 61 69 6c 61 62 6c 65 3b 0a 20 20 20 20 20 20 28 6e 2e 6f 6e 52 65 67 69 Data Ascii: (e.exports = p); }, function (e, n, t) { var i = t(2), a = t(1), o = t(4), r = t(0), s = window, c = r.DialogId; function d(e) { var n = this, t = e.isPlatformAuthenticatorAvailable; (n.onRegi
2023-08-25 13:28:25 UTC	299	IN	Data Raw: 74 65 6e 73 69 6f 6e 73 3a 20 21 30 2c 0a 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 28 65 2e 65 78 70 6f 72 74 73 20 3d 20 73 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 74 2e 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 70 69 63 6b 65 72 5f 61 63 63 6f 75 6e 74 5f 6d 73 61 5f 34 65 33 36 31 39 61 34 39 39 66 64 37 34 63 30 63 36 36 64 35 32 31 35 35 31 34 62 35 36 36 61 2e 70 6e 67 22 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 74 2e 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 Data Ascii: tensions: !0, }), (e.exports = s); }, function (e, n, t) { e.exports = t.p + "content/images/picker_account_msa_4e3619a499fd74c0c66d5215514b566a.png"; }, function (e, n, t) { e.exports = t.p + "content/ima
2023-08-25 13:28:25 UTC	315	IN	Data Raw: 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 57 69 6e 64 6f 77 73 53 73 6f 3a 20 65 2e 69 73 57 69 6e 64 6f 77 73 53 73 6f 20 7c 7c 20 21 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 4d 65 43 6f 6e 74 72 6f 6c 53 65 73 73 69 6f 6e 3a 20 21 30 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 73 47 69 74 48 75 62 46 65 64 3a 20 65 2e 69 73 47 69 74 48 75 62 46 65 64 20 7c 7c 20 21 31 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 70 61 72 73 65 42 73 73 6f 53 65 73 73 69 6f 6e 73 3a 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 Data Ascii: , isWindowsSso: e.isWindowsSso \|\| !1, isMeControlSession: !0, isGitHubFed: e.isGitHubFed \|\| !1, } ); }); }, parseBssoSessions: function (e) { ret
2023-08-25 13:28:25 UTC	365	IN	Data Raw: 6f 2e 73 65 74 44 65 66 61 75 6c 74 46 6f 63 75 73 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 65 20 3d 20 4d 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 65 20 26 26 20 65 2e 73 65 74 44 65 66 61 75 6c 74 46 6f 63 75 73 20 26 26 20 65 2e 73 65 74 44 65 66 61 75 6c 74 46 6f 63 75 73 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6f 2e 67 65 74 43 75 72 72 65 6e 74 56 69 65 77 49 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 55 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6f 2e 67 65 74 53 68 61 72 65 64 44 61 74 61 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: o.setDefaultFocus = function () { var e = M(); e && e.setDefaultFocus && e.setDefaultFocus(); }), (o.getCurrentViewId = function () { return U(); }), (o.getSharedData = function () {
2023-08-25 13:28:25 UTC	381	IN	Data Raw: 6e 20 6e 29 20 61 2e 63 61 6c 6c 28 6e 2c 20 74 29 20 26 26 20 28 65 5b 74 5d 20 3d 20 6e 5b 74 5d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 20 3d 20 6e 29 2c 20 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 20 6e 2c 20 74 2c 20 69 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 20 3d 20 65 5b 6e 5d 2e 6d 61 74 63 68 28 68 29 20 7c 7c 20 5b 5d 3b Data Ascii: n n) a.call(n, t) && (e[t] = n[t]); return e; } function t(e, n) { return (e.__proto__ = n), e; } function i(e, n, t, i) { var a = e[n].match(h) \|\| [];
2023-08-25 13:28:25 UTC	397	IN	Data Raw: 20 20 61 5b 64 5b 6c 5d 2e 6e 61 6d 65 5d 20 3d 20 64 5b 6c 5d 2e 76 61 6c 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 53 2e 61 2e 66 28 74 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 20 3d 20 63 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 66 6f 72 6d 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 70 20 69 6e 20 28 28 75 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 75 2e 61 63 74 69 6f 6e 20 3d 20 72 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 75 2e 6d 65 74 68 6f 64 20 Data Ascii: a[d[l].name] = d[l].value; } t = S.a.f(t); var u = c.createElement("form"); for (var p in ((u.style.display = "none"), (u.action = r), (u.method
2023-08-25 13:28:25 UTC	413	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 28 69 20 3d 20 21 30 29 2c 20 65 2e 6e 6f 74 69 66 79 53 75 62 73 63 72 69 62 65 72 73 28 72 2c 20 22 64 69 72 74 79 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 66 69 6e 61 6c 6c 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 20 3d 20 21 31 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 6f Data Ascii: (i = !0), e.notifySubscribers(r, "dirty"); } finally { i = !1; } } }; })); }, no
2023-08-25 13:28:25 UTC	429	IN	Data Raw: 20 20 20 20 20 20 20 20 63 20 3d 20 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 54 20 3d 20 53 2e 61 2e 44 61 28 22 5f 73 74 61 74 65 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 53 2e 6f 20 3d 20 53 2e 24 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 69 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 30 20 3c 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: c = a; } }); } }); var T = S.a.Da("_state"); S.o = S.$ = function (e, n, t) { function i() { if (0 < arguments.length) {
2023-08-25 13:28:25 UTC	445	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 64 2c 20 6c 20 3d 20 30 3b 20 28 64 20 3d 20 72 5b 6c 5d 29 3b 20 2b 2b 6c 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 20 3d 20 64 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 34 34 20 3d 3d 3d 20 75 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 30 20 3e 3d 20 63 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 70 75 73 68 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 20 26 26 20 73 2e 6c 65 6e 67 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: for (var d, l = 0; (d = r[l]); ++l) { var u = d.charCodeAt(0); if (44 === u) { if (0 >= c) { t.push( n && s.length
2023-08-25 13:28:25 UTC	461	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 61 5b 65 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 67 2e 67 65 74 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 61 5b 65 5d 20 26 26 20 69 28 62 28 65 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 67 2e 68 61 73 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 65 20 69 6e 20 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: return a[e]; }; (g.get = function (e) { return a[e] && i(b(e)); }), (g.has = function (e) { return e in a;
2023-08-25 13:28:25 UTC	477	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 28 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 45 72 72 6f 72 28 22 43 6f 6d 70 6f 6e 65 6e 74 20 27 22 20 2b 20 65 20 2b 20 22 27 3a 20 22 20 2b 20 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 20 3d 20 7b 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 53 2e 6a 2e 72 65 67 69 73 74 65 72 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 29 20 7b 0a 20 Data Ascii: } function o(e) { return function (n) { throw Error("Component '" + e + "': " + n); }; } var r = {}; (S.j.register = function (e, n) {
2023-08-25 13:28:25 UTC	493	IN	Data Raw: 20 20 20 20 20 20 20 20 6f 20 3d 20 61 2e 62 6f 64 79 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 20 3d 20 6f 20 3d 3d 3d 20 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 61 20 3d 20 6e 28 29 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 2e 6d 2e 65 62 28 61 2c 20 74 2c 20 22 68 61 73 66 6f 63 75 73 22 2c 20 69 2c 20 21 30 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 5f 5f 6b 6f 5f 68 61 73 66 6f 63 75 73 4c 61 73 74 56 61 6c 75 65 20 3d 20 69 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 5f 5f 6b Data Ascii: o = a.body; } i = o === e; } (a = n()), S.m.eb(a, t, "hasfocus", i, !0), (e.__ko_hasfocusLastValue = i), (e.__k
2023-08-25 13:28:25 UTC	509	IN	Data Raw: 20 20 20 20 20 20 53 2e 6d 2e 65 62 28 69 2c 20 74 2c 20 22 76 61 6c 75 65 22 2c 20 61 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 21 53 2e 61 2e 57 20 7c 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 21 61 20 7c 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 74 65 78 74 22 20 21 3d 20 65 2e 74 79 70 65 20 7c 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6f 66 66 22 20 3d 3d 20 65 2e 61 75 74 6f 63 6f 6d 70 6c 65 74 65 20 7c 7c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 66 6f 72 6d 20 26 26 20 22 6f 66 66 22 20 3d 3d 20 65 2e 66 6f 72 6d 2e 61 75 74 6f 63 6f 6d 70 6c 65 74 65 Data Ascii: S.m.eb(i, t, "value", a); }; !S.a.W \|\| !a \|\| "text" != e.type \|\| "off" == e.autocomplete \|\| (e.form && "off" == e.form.autocomplete
2023-08-25 13:28:26 UTC	525	IN	Data Raw: 20 20 72 65 74 75 72 6e 20 28 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 20 3d 3d 3d 20 72 20 7c 7c 20 6e 75 6c 6c 20 3d 3d 3d 20 65 20 7c 7c 20 21 53 2e 61 2e 66 28 65 2e 5f 64 65 73 74 72 6f 79 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 28 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6e 75 6c 6c 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: return ( e === r \|\| null === e \|\| !S.a.f(e._destroy) ); })), d(e); }, null,
2023-08-25 13:28:26 UTC	541	IN	Data Raw: 20 20 20 20 20 20 20 20 20 7d 29 28 69 2c 20 74 2e 65 6c 65 6d 65 6e 74 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 28 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 20 3d 20 65 2e 62 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 73 2e 63 6f 6d 70 6f 6e 65 6e 74 2e 69 6e 69 74 29 2c 0a 20 20 20 20 20 20 20 20 28 65 2e 62 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 73 2e 63 6f 6d 70 6f 6e 65 6e 74 2e 69 6e 69 74 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 74 2c 20 6f 2c 20 72 2c 20 73 2c 20 63 Data Ascii: })(i, t.element), i ); })), i(n); }); }, }), (n = e.bindingHandlers.component.init), (e.bindingHandlers.component.init = function (t, o, r, s, c
2023-08-25 13:28:26 UTC	557	IN	Data Raw: 6e 2c 20 74 29 20 7b 0a 20 20 20 20 76 61 72 20 69 20 3d 20 74 28 33 29 2c 0a 20 20 20 20 20 20 61 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 6f 20 3d 20 69 2e 53 74 72 69 6e 67 3b 0a 20 20 20 20 6e 2e 61 70 70 6c 79 45 78 74 65 6e 73 69 6f 6e 73 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 6e 3b 0a 20 20 20 20 20 20 28 6e 20 3d 20 65 2e 62 69 6e 64 69 6e 67 50 72 6f 76 69 64 65 72 2e 69 6e 73 74 61 6e 63 65 2e 70 72 65 70 72 6f 63 65 73 73 4e 6f 64 65 29 2c 0a 20 20 20 20 20 20 20 20 28 65 2e 62 69 6e 64 69 6e 67 50 72 6f 76 69 64 65 72 2e 69 6e 73 74 61 6e 63 65 2e 70 72 65 70 72 6f 63 65 73 73 4e 6f 64 65 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 69 66 20 28 0a 20 20 20 Data Ascii: n, t) { var i = t(3), a = t(1), o = i.String; n.applyExtensions = function (e) { var n; (n = e.bindingProvider.instance.preprocessNode), (e.bindingProvider.instance.preprocessNode = function (t) { if (
2023-08-25 13:28:26 UTC	573	IN	Data Raw: 20 3a 20 66 65 20 26 26 20 6e 2e 67 65 74 53 65 72 76 65 72 45 72 72 6f 72 28 29 20 26 26 20 28 73 20 3d 20 44 2e 55 73 65 72 6e 61 6d 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 75 65 20 7c 7c 20 6f 20 7c 7c 20 62 65 20 7c 7c 20 67 65 29 20 26 26 20 28 72 20 3d 20 73 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 6e 20 26 26 20 28 72 20 3d 20 73 20 3d 20 44 2e 52 65 6d 6f 74 65 43 6f 6e 6e 65 63 74 4c 6f 63 61 74 69 6f 6e 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 6e 2e 69 6e 69 74 69 61 6c 56 69 65 77 49 64 20 3d 20 72 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 6e 2e 63 75 72 72 65 6e 74 56 69 65 77 49 64 20 3d 20 73 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 29 28 74 2c Data Ascii: : fe && n.getServerError() && (s = D.Username); (ue \|\| o \|\| be \|\| ge) && (r = s); } sn && (r = s = D.RemoteConnectLocation), (n.initialViewId = r), (n.currentViewId = s); })(t,
2023-08-25 13:28:26 UTC	589	IN	Data Raw: 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 66 65 74 63 68 53 65 73 73 69 6f 6e 73 5f 6f 6e 55 70 64 61 74 65 55 73 65 72 54 69 6c 65 73 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 6e 28 65 2c 20 6e 29 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 66 65 74 63 68 53 65 73 73 69 6f 6e 73 5f 6f 6e 49 6e 63 72 65 6d 65 6e 74 41 73 79 6e 63 54 69 6c 65 52 65 71 75 65 73 74 43 6f 75 6e 74 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 6e 2e 61 73 79 6e 63 54 69 6c 65 52 65 71 75 65 73 74 43 6f 75 6e 74 Data Ascii: , (n.fetchSessions_onUpdateUserTiles = function (e, n) { setTimeout(function () { hn(e, n); }); }), (n.fetchSessions_onIncrementAsyncTileRequestCount = function () { n.asyncTileRequestCount
2023-08-25 13:28:26 UTC	605	IN	Data Raw: 20 20 20 28 6e 2e 76 69 65 77 5f 6f 6e 53 65 74 50 65 6e 64 69 6e 67 52 65 71 75 65 73 74 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 6e 2e 69 73 52 65 71 75 65 73 74 50 65 6e 64 69 6e 67 28 65 29 2c 20 6e 2e 73 68 6f 77 4c 69 67 68 74 62 6f 78 50 72 6f 67 72 65 73 73 28 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 2c 0a 20 20 20 20 20 20 20 20 28 6e 2e 66 6f 6f 74 65 72 5f 61 67 72 65 65 6d 65 6e 74 43 6c 69 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 28 6e 2e 61 67 72 65 65 6d 65 6e 74 54 79 70 65 20 3d 20 65 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 6e 2e 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 4d 65 74 68 6f 64 73 28 29 2e 76 69 65 77 5f 6f 6e 53 77 69 74 Data Ascii: (n.view_onSetPendingRequest = function (e) { n.isRequestPending(e), n.showLightboxProgress(e); }), (n.footer_agreementClick = function (e) { (n.agreementType = e), n.paginationControlMethods().view_onSwit
2023-08-25 13:28:26 UTC	621	IN	Data Raw: 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 70 70 62 61 63 6b 67 72 6f 75 6e 64 73 2f 31 31 5f 63 66 65 39 63 62 36 32 65 62 62 36 36 30 35 65 30 33 66 62 38 64 32 38 35 63 36 31 31 62 34 38 2e 6a 70 67 22 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 74 2e 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 70 70 62 61 63 6b 67 72 6f 75 6e 64 73 2f 31 33 2d 73 6d 61 6c 6c 5f 61 31 39 65 37 62 63 61 34 34 36 36 30 35 39 65 61 64 64 33 34 34 61 62 31 31 65 36 39 30 34 66 2e 6a 70 67 22 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 Data Ascii: p + "content/images/appbackgrounds/11_cfe9cb62ebb6605e03fb8d285c611b48.jpg"; }, function (e, n, t) { e.exports = t.p + "content/images/appbackgrounds/13-small_a19e7bca4466059eadd344ab11e6904f.jpg"; }, function (e, n, t) {
2023-08-25 13:28:26 UTC	637	IN	Data Raw: 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 74 2e 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 70 70 62 61 63 6b 67 72 6f 75 6e 64 73 2f 36 37 2d 73 6d 61 6c 6c 5f 34 66 36 33 63 34 33 37 61 32 30 39 61 37 61 64 30 62 63 66 37 63 35 33 32 61 34 62 35 63 32 62 2e 6a 70 67 22 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 74 2e 70 20 2b 0a 20 20 20 20 20 20 22 63 6f 6e 74 65 6e 74 2f 69 6d 61 67 65 73 2f 61 70 70 62 61 63 6b 67 72 6f 75 6e 64 73 2f 36 37 5f 37 34 39 36 32 64 39 36 65 64 34 34 39 38 61 35 33 62 32 37 33 64 37 63 37 66 39 37 63 64 39 35 2e 6a 70 67 22 3b 0a 20 20 7d 2c 0a 20 Data Ascii: e.exports = t.p + "content/images/appbackgrounds/67-small_4f63c437a209a7ad0bcf7c532a4b5c2b.jpg"; }, function (e, n, t) { e.exports = t.p + "content/images/appbackgrounds/67_74962d96ed4498a53b273d7c7f97cd95.jpg"; },
2023-08-25 13:28:26 UTC	653	IN	Data Raw: 20 20 20 20 20 28 6e 20 3d 20 5f 2e 66 69 72 73 74 43 68 69 6c 64 29 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 21 65 29 0a 20 20 20 20 20 20 20 20 20 20 74 68 72 6f 77 20 6e 65 77 20 75 2e 45 72 72 6f 72 28 22 4e 6f 45 78 74 65 6e 73 69 6f 6e 22 2c 20 22 45 78 74 65 6e 73 69 6f 6e 20 69 73 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 2e 22 2c 20 6e 75 6c 6c 29 3b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 28 0a 20 20 20 20 20 20 20 20 20 20 70 2e 6c 6f 67 44 61 74 61 50 6f 69 6e 74 28 22 65 78 74 65 6e 73 69 6f 6e 2e 69 64 22 2c 20 65 29 2c 0a 20 20 20 20 20 20 20 20 20 20 70 2e 6c 6f 67 4d 65 73 73 61 67 65 28 22 55 73 69 6e 67 20 43 68 72 6f 6d 65 20 65 78 74 65 6e 73 69 6f 6e 20 77 69 74 68 20 69 64 20 22 20 2b 20 65 29 2c 0a 20 20 20 20 20 20 20 20 Data Ascii: (n = _.firstChild); if (!e) throw new u.Error("NoExtension", "Extension is not installed.", null); return ( p.logDataPoint("extension.id", e), p.logMessage("Using Chrome extension with id " + e),
2023-08-25 13:28:26 UTC	669	IN	Data Raw: 20 20 20 43 68 65 63 6b 62 6f 78 3a 20 22 63 68 65 63 6b 62 6f 78 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 42 75 74 74 6f 6e 3a 20 22 62 75 74 74 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 45 78 63 65 70 74 69 6f 6e 44 61 74 61 3a 20 22 45 78 63 65 70 74 69 6f 6e 44 61 74 61 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 50 61 67 65 41 63 74 69 6f 6e 44 61 74 61 3a 20 22 50 61 67 65 41 63 74 69 6f 6e 44 61 74 61 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 45 78 63 65 70 74 69 6f 6e 73 54 61 62 6c 65 73 75 66 66 69 78 3a 20 22 45 78 63 65 70 74 69 6f 6e 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 50 61 67 65 41 63 74 74 69 6f 6e 73 54 61 62 6c 65 73 75 66 66 69 78 3a 20 22 55 73 65 72 41 63 74 69 6f 6e 73 22 2c 0a 20 20 20 20 20 20 20 20 20 Data Ascii: Checkbox: "checkbox", Button: "button", ExceptionData: "ExceptionData", PageActionData: "PageActionData", ExceptionsTablesuffix: "Exceptions", PageActtionsTablesuffix: "UserActions",
2023-08-25 13:28:26 UTC	685	IN	Data Raw: 6f 76 69 64 65 72 20 3d 20 69 2e 45 6d 70 74 79 45 76 65 6e 74 50 72 6f 76 69 64 65 72 29 3b 0a 20 20 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 20 20 2c 0a 20 20 20 20 20 20 20 20 2c 0a 20 20 20 20 20 20 20 20 2c 0a 20 20 20 20 20 20 20 20 2c 0a 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 76 61 72 20 69 3b 0a 20 20 20 20 20 20 20 20 20 20 21 28 66 75 6e 63 74 69 6f 6e 20 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6e 20 3d 20 74 28 31 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 20 3d 20 74 28 32 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 20 3d 20 69 2e 45 76 65 6e 74 41 70 69 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 20 3d 20 69 Data Ascii: ovider = i.EmptyEventProvider); }, , , , , function (e, n, t) { var i; !(function (e) { var n = t(1), i = t(2), a = i.EventApi, o = i
2023-08-25 13:28:26 UTC	701	IN	Data Raw: 61 6c 56 69 65 77 49 64 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 72 65 6e 74 56 69 65 77 49 64 3a 20 63 75 72 72 65 6e 74 56 69 65 77 49 64 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 69 74 69 61 6c 53 68 61 72 65 64 44 61 74 61 3a 20 69 6e 69 74 69 61 6c 53 68 61 72 65 64 44 61 74 61 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 6e 69 74 69 61 6c 45 72 72 6f 72 3a 20 24 6c 6f 67 69 6e 50 61 67 65 2e 67 65 74 53 65 72 76 65 72 45 72 72 6f 72 28 29 20 7d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 3a 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6e 63 65 6c 3a 20 70 61 67 69 6e 61 74 69 6f 6e 43 6f 6e 74 72 6f 6c 5f 6f 6e 43 61 6e 63 65 6c 2c 5c 6e 20 20 20 20 20 Data Ascii: alViewId,\n currentViewId: currentViewId,\n initialSharedData: initialSharedData,\n initialError: $loginPage.getServerError() },\n event: {\n cancel: paginationControl_onCancel,\n
2023-08-25 13:28:26 UTC	717	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 64 69 72 65 63 74 3a 20 24 6c 6f 67 69 6e 50 61 67 65 2e 76 69 65 77 5f 6f 6e 52 65 64 69 72 65 63 74 20 7d 20 7d 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 64 61 74 61 2d 76 69 65 77 69 64 3d 22 27 20 2b 0a 20 20 20 20 20 20 74 28 30 29 2e 50 61 67 69 6e 61 74 65 64 53 74 61 74 65 2e 49 64 70 52 65 64 69 72 65 63 74 53 70 65 65 64 62 75 6d 70 20 2b 0a 20 20 20 20 20 20 27 22 20 64 61 74 61 2d 73 68 6f 77 49 64 65 6e 74 69 74 79 42 61 6e 6e 65 72 3d 22 74 72 75 65 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 70 61 67 65 56 69 65 77 43 6f 6d 70 6f 6e 65 6e 74 3a 20 7b 20 6e 61 6d 65 3a 20 5c 27 6c 6f 67 69 6e 2d 69 Data Ascii: redirect: $loginPage.view_onRedirect } }">\n </div>\n\n <div data-viewid="' + t(0).PaginatedState.IdpRedirectSpeedbump + '" data-showIdentityBanner="true" data-bind="pageViewComponent: { name: \'login-i
2023-08-25 13:28:26 UTC	733	IN	Data Raw: 5c 6e 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 4e 65 77 55 73 65 72 22 20 76 61 6c 75 65 3d 22 31 22 20 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 46 6f 75 6e 64 4d 53 41 73 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 76 61 6c 75 65 3a 20 73 76 72 2e 73 46 6f 75 6e 64 4d 53 41 73 22 20 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 66 73 70 6f 73 74 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 76 61 6c 75 65 3a 20 73 76 72 2e 66 50 4f 53 54 5f 46 6f 72 63 65 53 69 67 6e 69 6e 20 3f 20 31 20 3a 20 30 22 20 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 Data Ascii: \n <input type="hidden" name="NewUser" value="1" />\n <input type="hidden" name="FoundMSAs" data-bind="value: svr.sFoundMSAs" />\n <input type="hidden" name="fspost" data-bind="value: svr.fPOST_ForceSignin ? 1 : 0" />\n <input
2023-08-25 13:28:26 UTC	749	IN	Data Raw: 69 20 3d 20 7b 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 65 61 6d 2e 70 6e 67 22 3a 20 33 34 33 2c 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 65 61 6d 2e 73 76 67 22 3a 20 33 34 34 2c 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 65 61 6d 5f 77 68 69 74 65 2e 70 6e 67 22 3a 20 33 34 35 2c 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 65 61 6d 5f 77 68 69 74 65 2e 73 76 67 22 3a 20 33 34 36 2c 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 69 6e 67 2e 70 6e 67 22 3a 20 33 34 37 2c 0a 20 20 20 20 20 20 22 2e 2f 41 70 70 43 65 6e 74 69 70 65 64 65 5f 42 69 6e 67 2e 73 76 67 22 3a 20 33 34 38 2c 0a 20 20 20 20 20 20 22 2e 2f Data Ascii: i = { "./AppCentipede_Beam.png": 343, "./AppCentipede_Beam.svg": 344, "./AppCentipede_Beam_white.png": 345, "./AppCentipede_Beam_white.svg": 346, "./AppCentipede_Bing.png": 347, "./AppCentipede_Bing.svg": 348, "./
2023-08-25 13:28:26 UTC	765	IN	Data Raw: 6e 74 61 69 6e 65 72 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 65 78 74 65 72 6e 61 6c 43 73 73 3a 20 7b 20 5c 27 68 65 61 64 65 72 5c 27 3a 20 74 72 75 65 20 7d 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 69 64 3d 22 68 65 61 64 65 72 4c 6f 67 6f 22 20 72 6f 6c 65 3d 22 69 6d 67 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 74 74 72 3a 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 68 65 61 64 65 72 4c 6f 67 6f 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 74 3a 20 73 74 72 5b 5c 27 Data Ascii: ntainer">\n <div id="header" data-bind="externalCss: { \'header\': true }">\n <img id="headerLogo" role="img" data-bind="\n attr: {\n src: headerLogo,\n alt: str[\'
2023-08-25 13:28:26 UTC	781	IN	Data Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 3a 20 73 76 72 2e 66 53 68 6f 77 43 6f 70 79 44 65 62 75 67 44 65 74 61 69 6c 73 4c 69 6e 6b 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 65 62 75 67 2d 64 65 74 61 69 6c 73 2d 68 65 61 64 65 72 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 64 65 62 75 67 44 65 74 61 69 6c 73 48 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 62 6f 6c 64 20 64 65 62 75 67 2d 64 65 74 61 69 6c 73 2d 68 65 61 64 69 6e 67 2d 74 65 78 74 22 20 72 6f 6c 65 3d 22 68 65 61 64 69 6e 67 22 20 61 72 69 61 2d 6c 65 76 65 Data Ascii: <div class="table-cell">\n \x3c!-- ko if: svr.fShowCopyDebugDetailsLink --\x3e\n <div class="debug-details-header">\n <div id="debugDetailsHeader" class="bold debug-details-heading-text" role="heading" aria-leve
2023-08-25 13:28:26 UTC	797	IN	Data Raw: 69 64 65 49 6e 4e 65 78 74 28 29 2c 5c 6e 20 20 20 20 20 20 20 20 27 73 6c 69 64 65 2d 6f 75 74 2d 62 61 63 6b 27 3a 20 61 6e 69 6d 61 74 65 2e 69 73 53 6c 69 64 65 4f 75 74 42 61 63 6b 28 29 2c 5c 6e 20 20 20 20 20 20 20 20 27 73 6c 69 64 65 2d 69 6e 2d 62 61 63 6b 27 3a 20 61 6e 69 6d 61 74 65 2e 69 73 53 6c 69 64 65 49 6e 42 61 63 6b 28 29 20 7d 5c 22 3e 5c 6e 5c 6e 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 66 6f 72 65 61 63 68 3a 20 76 69 65 77 73 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 3a 20 24 70 61 72 65 6e 74 2e 63 75 72 72 65 6e 74 56 69 65 77 49 6e 64 65 78 28 29 20 3d 3d 3d 20 24 69 6e 64 65 78 28 29 20 2d 2d 5c 78 33 65 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ideInNext(),\n 'slide-out-back': animate.isSlideOutBack(),\n 'slide-in-back': animate.isSlideInBack() }\">\n\n \x3c!-- ko foreach: views --\x3e\n \x3c!-- ko if: $parent.currentViewIndex() === $index() --\x3e\n
2023-08-25 13:28:26 UTC	813	IN	Data Raw: 76 69 63 65 43 6f 64 65 20 3d 20 74 20 3f 20 74 2e 64 65 76 69 63 65 43 6f 64 65 20 3a 20 6e 75 6c 6c 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 70 72 6f 6f 66 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 20 3d 20 22 22 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 75 73 65 45 76 69 63 74 65 64 43 72 65 64 65 6e 74 69 61 6c 73 20 3d 20 21 31 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 73 68 6f 77 43 72 65 64 56 69 65 77 42 72 61 6e 64 69 6e 67 44 65 73 63 20 3d 20 21 31 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 28 65 2e 69 73 53 69 67 6e 75 70 50 6f 73 74 20 3d 20 21 31 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 4e 65 20 26 26 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 28 65 2e 61 76 61 69 6c 61 62 6c 65 43 72 65 64 73 20 3d Data Ascii: viceCode = t ? t.deviceCode : null), (e.proofConfirmation = ""), (e.useEvictedCredentials = !1), (e.showCredViewBrandingDesc = !1), (e.isSignupPost = !1), Ne && ((e.availableCreds =
2023-08-25 13:28:26 UTC	829	IN	Data Raw: 20 73 74 72 5b 5c 27 53 54 52 5f 53 53 53 55 5f 53 69 67 6e 75 70 5f 4c 69 6e 6b 5c 27 5d 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3a 20 73 76 72 2e 75 72 6c 53 69 67 6e 55 70 20 7c 7c 20 5c 27 23 5c 27 2c 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 69 63 6b 3a 20 73 69 67 6e 75 70 5f 6f 6e 43 6c 69 63 6b 22 3e 3c 2f 61 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 2f 6b 6f 20 2d 2d 5c 78 33 65 5c 6e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 6e 6f 74 3a 20 73 76 72 2e 66 49 73 53 65 6c 66 53 65 72 76 69 63 65 Data Ascii: str[\'STR_SSSU_Signup_Link\'],\n href: svr.urlSignUp \|\| \'#\',\n click: signup_onClick"></a>\n </div>\n \x3c!-- /ko --\x3e\n\n \x3c!-- ko ifnot: svr.fIsSelfService
2023-08-25 13:28:26 UTC	845	IN	Data Raw: 3d 20 64 29 3b 0a 20 20 7d 2c 0a 20 20 66 75 6e 63 74 69 6f 6e 20 28 65 2c 20 6e 2c 20 74 29 20 7b 0a 20 20 20 20 65 2e 65 78 70 6f 72 74 73 20 3d 0a 20 20 20 20 20 20 22 5c 78 33 63 21 2d 2d 20 22 20 2b 0a 20 20 20 20 20 20 28 74 28 31 33 29 2c 0a 20 20 20 20 20 20 27 20 2d 2d 5c 78 33 65 5c 6e 5c 6e 5c 78 33 63 21 2d 2d 20 6b 6f 20 69 66 3a 20 6d 6f 72 65 49 6e 66 6f 54 69 74 6c 65 20 2d 2d 5c 78 33 65 5c 6e 3c 64 69 76 20 69 64 3d 22 6d 6f 72 65 49 6e 66 6f 48 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 72 6f 77 22 20 72 6f 6c 65 3d 22 68 65 61 64 69 6e 67 22 20 61 72 69 61 2d 6c 65 76 65 6c 3d 22 31 22 20 64 61 74 61 2d 62 69 6e 64 3d 22 74 65 78 74 3a 20 6d 6f 72 65 49 6e 66 6f 54 69 74 6c 65 2c 20 65 78 74 65 72 6e 61 6c 43 73 73 3a 20 7b 20 5c 27 74 Data Ascii: = d); }, function (e, n, t) { e.exports = "\x3c!-- " + (t(13), ' --\x3e\n\n\x3c!-- ko if: moreInfoTitle --\x3e\n<div id="moreInfoHeader" class="row" role="heading" aria-level="1" data-bind="text: moreInfoTitle, externalCss: { \'t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49738	46.243.183.6	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-08-25 13:28:25 UTC	135	OUT	GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_vts8ra1it9l0lgwizaxzhg2.js HTTP/1.1 Host: 0ffice-authentication.com Connection: keep-alive sec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://0ffice-authentication.com/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: qPdM=3LLuUALVcdxm; qPdM.sig=cetwzwVUjaGABqN2Xw3_y9RWw6I; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AU4AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAAtyolDObpQQ5VtlI4uGjEPIsXwUtzjezO-e7ZNxKF6l-bKxkFN5vjWT953orPkLGechW-XXIqdiVGSll4h8zNO4axP5vQLs5TBQ380iSlAFfbaYQ3Rdz6QZ0whPXbziS0gAA; esctx=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPs_5MNkwjNOKl49mM6kVZPsChkx_zm-vFsapfBkhONR7hN5VRQ5XRFDuKcwFrftO0KBe4Eg-aTNfTBC-hmg2oM3OKCHIcwMDujsivX_d_IzSdd2kTfiNsYYdl4n9gvVAoDwpr6hdIScOZy9aLv9gKFNbvp53OEzkIwW_WdPOJXMfT79mxWUKlVPMMMTi5N6nd0tnSaGVQQ9_GFTLOcwFjWkjAOlFvoicYNO-vEaVqbMQgAA; fpc=Avk-wbVDnvdIr9avJqHlFZK8Ae7AAQAAAHijetwOAAAA
2023-08-25 13:28:25 UTC	217	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=31536000 content-length: 49972 Content-Type: application/x-javascript Content-Encoding: gzip Content-MD5: F796jFOPcfyA2yQHgXtB1w== Last-Modified: Thu, 13 Jul 2023 00:28:45 GMT ETag: 0x8DB83381EAF7708 X-Cache: TCP_HIT x-ms-request-id: a9105260-201e-003d-309b-d2c979000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * X-Azure-Ref-OriginShield: 0k7ngZAAAAABvmQovJJfrTJ6GvKc8inKeQU1TMDRFREdFMTkwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= X-Azure-Ref: 0eazoZAAAAAAIDZiUejeqT5oZZwhL934lU1RPRURHRTE0MTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 Date: Fri, 25 Aug 2023 13:28:24 GMT Connection: close Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
2023-08-25 13:28:25 UTC	219	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 Data Ascii:
2023-08-25 13:28:25 UTC	351	IN	Data Raw: dd 7d cb 76 23 47 b2 d8 de 5f 51 83 f1 51 37 af aa 21 3c f8 44 0b 6a 83 00 d8 c4 6d 10 80 00 b0 29 1d 49 c6 29 a2 92 64 4d 03 55 b8 55 85 66 73 a8 f6 99 9d 17 77 e1 ad bd f3 c2 2b 2f bd f1 de 9f 32 e7 5c 7f 87 e3 91 99 95 f5 00 40 4a 1a cd bd 9e 33 a7 45 e4 23 32 32 32 32 32 22 32 32 ea 0f 37 6b 7f 1e 7b 81 ff 52 ec 3d aa bf ad e0 a5 bf f7 e8 dd bc f4 7e f0 7f da 0b 45 bc 0e 7d 0b ff 2e 8b 4f ab 20 8c a3 d7 1f 9d d0 8a 9b 58 d4 7c 94 65 8d c7 cf b6 e7 36 7c 7b 11 38 ae 70 1b 7f a8 7e 7e 2d bb 0a ec 3a 77 16 8b 97 b1 82 60 c7 76 f2 77 b0 07 3f b8 5b f3 0f 95 a4 e2 33 0e e3 35 1f 35 a0 a0 bc 6c 0a 3b 28 cf 9b 1e fc bb 6a 96 4a 76 f0 b2 b2 f7 f9 e5 0f c9 34 ec c0 f6 00 f9 97 b5 3d c2 d2 6f 7a 2f ab 00 1f fe 73 b0 67 87 f0 9f c3 3d db 69 86 e5 49 1c 7a fe 6d Data Ascii: }v#G_QQ7!<Djm)I)dMUUfsw+/2\@J3E#22222"227k{R=~E}.O X\|e6\|{8p~~-:w`vw?[355l;(jJv4=oz/sg=iIzm

Target ID:	0
Start time:	15:28:13
Start date:	25/08/2023
Path:	C:\Windows\SysWOW64\mspaint.exe
Wow64 process (32bit):	true
Commandline:	mspaint.exe "C:\Users\user\Desktop\MFA.png"
Imagebase:	0xc0000
File size:	6'589'440 bytes
MD5 hash:	B59CF145BBAE39672321768B33A01CFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:28:20
Start date:	25/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://0ffice-authentication.com/?mfknxooz
Imagebase:	0x7ff71d210000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:28:21
Start date:	25/08/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1888,i,2116380640700791652,7274111503676162324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff71d210000
File size:	3'219'224 bytes
MD5 hash:	8D1C4713ACB7CC2AAAEE4477C58A80BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MFA.png

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_metadata\verified_contents.json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_pnacl_json

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.fingerprint

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5992_595698718\manifest.json

C:\Windows\debug\WIA\wiatrace.log

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Windows Analysis Report
MFA.png